diff --git a/doc/README.html b/doc/README.html index 065af666f..5ba29dc8e 100644 --- a/doc/README.html +++ b/doc/README.html @@ -9,7 +9,7 @@
$ python sqlmap.py -h
- sqlmap/0.9 - automatic SQL injection and database takeover tool
+ sqlmap/1.0 - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
Usage: python sqlmap.py [options]
@@ -961,6 +961,8 @@ Options:
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
+ --schema Enumerate DBMS schema
+ --count Retrieve number of entries for table(s)
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
--search Search column(s), table(s) and/or database name(s)
@@ -1039,6 +1041,7 @@ Options:
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
--forms Parse and test forms on target url
--gpage=GOOGLEPAGE Use Google dork results from specified page number
+ --mobile Imitate smartphone through HTTP User-Agent header
--page-rank Display page rank (PR) for Google dork results
--parse-errors Parse DBMS error messages from response pages
--replicate Replicate dumped data into a sqlite3 database
@@ -1537,6 +1540,28 @@ on the value of --level too.
User-Agent only, provide -p id,user-agent.
+URI injection point
+
+There are special cases when injection point is within the URI itself.
+sqlmap does not perform any automatic test against URI paths, unless
+manually pointed to.
+You have to specify these injection points in the command line by
+appending an asterisk (*) after each URI point that you want
+sqlmap to test for and exploit a SQL injection.
+
+This is particularly useful when, for instance, Apache web server's
+mod_rewrite module is in use or other similar technologies.
+
+An example of valid command line would be:
+
+
+
+$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"
+
+
+
+
+
Force the database management system name
Switch: --dbms
@@ -2147,6 +2172,20 @@ application's user is connected to, which is always aliased by
public.
+Enumerate database management system schema
+
+Switches: --schema
+
+TODO
+
+
+Retrieve number of entries for table(s)
+
+Switches: --count
+
+TODO
+
+
Dump database table entries
Switches: --dump, -C, -T, -D,
@@ -3081,6 +3120,13 @@ this switch, --gpage, some page other than the first o
to retrieve target URLs from.
+Imitate smartphone
+
+Switch: --mobile
+
+TODO
+
+
Display page rank (PR) for Google dork results
Switch: --page-rank
diff --git a/doc/README.pdf b/doc/README.pdf
index 22e82a260..73a482973 100644
--- a/doc/README.pdf
+++ b/doc/README.pdf
@@ -298,1670 +298,1614 @@ endobj
<< /S /GoTo /D (subsubsection.5.5.2) >>
endobj
200 0 obj
-(Force the database management system name)
+(URI injection point)
endobj
201 0 obj
<< /S /GoTo /D (subsubsection.5.5.3) >>
endobj
204 0 obj
-(Force the database management system operating system name)
+(Force the database management system name)
endobj
205 0 obj
<< /S /GoTo /D (subsubsection.5.5.4) >>
endobj
208 0 obj
-(Custom injection payload)
+(Force the database management system operating system name)
endobj
209 0 obj
<< /S /GoTo /D (subsubsection.5.5.5) >>
endobj
212 0 obj
-(Tamper injection data)
+(Custom injection payload)
endobj
213 0 obj
-<< /S /GoTo /D (subsection.5.6) >>
+<< /S /GoTo /D (subsubsection.5.5.6) >>
endobj
216 0 obj
-(Detection)
+(Tamper injection data)
endobj
217 0 obj
-<< /S /GoTo /D (subsubsection.5.6.1) >>
+<< /S /GoTo /D (subsection.5.6) >>
endobj
220 0 obj
-(Level)
+(Detection)
endobj
221 0 obj
-<< /S /GoTo /D (subsubsection.5.6.2) >>
+<< /S /GoTo /D (subsubsection.5.6.1) >>
endobj
224 0 obj
-(Risk)
+(Level)
endobj
225 0 obj
-<< /S /GoTo /D (subsubsection.5.6.3) >>
+<< /S /GoTo /D (subsubsection.5.6.2) >>
endobj
228 0 obj
-(Page comparison)
+(Risk)
endobj
229 0 obj
-<< /S /GoTo /D (subsection.5.7) >>
+<< /S /GoTo /D (subsubsection.5.6.3) >>
endobj
232 0 obj
-(Techniques)
+(Page comparison)
endobj
233 0 obj
-<< /S /GoTo /D (subsubsection.5.7.1) >>
+<< /S /GoTo /D (subsection.5.7) >>
endobj
236 0 obj
-(SQL injection techniques to test for)
+(Techniques)
endobj
237 0 obj
-<< /S /GoTo /D (subsubsection.5.7.2) >>
+<< /S /GoTo /D (subsubsection.5.7.1) >>
endobj
240 0 obj
-(Seconds to delay the DBMS response for time-based blind SQL injection)
+(SQL injection techniques to test for)
endobj
241 0 obj
-<< /S /GoTo /D (subsubsection.5.7.3) >>
+<< /S /GoTo /D (subsubsection.5.7.2) >>
endobj
244 0 obj
-(Number of columns in UNION query SQL injection)
+(Seconds to delay the DBMS response for time-based blind SQL injection)
endobj
245 0 obj
-<< /S /GoTo /D (subsubsection.5.7.4) >>
+<< /S /GoTo /D (subsubsection.5.7.3) >>
endobj
248 0 obj
-(Character to use to test for UNION query SQL injection)
+(Number of columns in UNION query SQL injection)
endobj
249 0 obj
-<< /S /GoTo /D (subsection.5.8) >>
+<< /S /GoTo /D (subsubsection.5.7.4) >>
endobj
252 0 obj
-(Fingerprint)
+(Character to use to test for UNION query SQL injection)
endobj
253 0 obj
-<< /S /GoTo /D (subsubsection.5.8.1) >>
+<< /S /GoTo /D (subsection.5.8) >>
endobj
256 0 obj
-(Extensive database management system fingerprint)
+(Fingerprint)
endobj
257 0 obj
-<< /S /GoTo /D (subsection.5.9) >>
+<< /S /GoTo /D (subsubsection.5.8.1) >>
endobj
260 0 obj
-(Enumeration)
+(Extensive database management system fingerprint)
endobj
261 0 obj
-<< /S /GoTo /D (subsubsection.5.9.1) >>
+<< /S /GoTo /D (subsection.5.9) >>
endobj
264 0 obj
-(Banner)
+(Enumeration)
endobj
265 0 obj
-<< /S /GoTo /D (subsubsection.5.9.2) >>
+<< /S /GoTo /D (subsubsection.5.9.1) >>
endobj
268 0 obj
-(Session user)
+(Banner)
endobj
269 0 obj
-<< /S /GoTo /D (subsubsection.5.9.3) >>
+<< /S /GoTo /D (subsubsection.5.9.2) >>
endobj
272 0 obj
-(Current database)
+(Session user)
endobj
273 0 obj
-<< /S /GoTo /D (subsubsection.5.9.4) >>
+<< /S /GoTo /D (subsubsection.5.9.3) >>
endobj
276 0 obj
-(Detect whether or not the session user is a database administrator)
+(Current database)
endobj
277 0 obj
-<< /S /GoTo /D (subsubsection.5.9.5) >>
+<< /S /GoTo /D (subsubsection.5.9.4) >>
endobj
280 0 obj
-(List database management system users)
+(Detect whether or not the session user is a database administrator)
endobj
281 0 obj
-<< /S /GoTo /D (subsubsection.5.9.6) >>
+<< /S /GoTo /D (subsubsection.5.9.5) >>
endobj
284 0 obj
-(List and crack database management system users password hashes)
+(List database management system users)
endobj
285 0 obj
-<< /S /GoTo /D (subsubsection.5.9.7) >>
+<< /S /GoTo /D (subsubsection.5.9.6) >>
endobj
288 0 obj
-(List database management system users privileges)
+(List and crack database management system users password hashes)
endobj
289 0 obj
-<< /S /GoTo /D (subsubsection.5.9.8) >>
+<< /S /GoTo /D (subsubsection.5.9.7) >>
endobj
292 0 obj
-(List database management system users roles)
+(List database management system users privileges)
endobj
293 0 obj
-<< /S /GoTo /D (subsubsection.5.9.9) >>
+<< /S /GoTo /D (subsubsection.5.9.8) >>
endobj
296 0 obj
-(List database management system's databases)
+(List database management system users roles)
endobj
297 0 obj
-<< /S /GoTo /D (subsubsection.5.9.10) >>
+<< /S /GoTo /D (subsubsection.5.9.9) >>
endobj
300 0 obj
-(Enumerate database's tables)
+(List database management system's databases)
endobj
301 0 obj
-<< /S /GoTo /D (subsubsection.5.9.11) >>
+<< /S /GoTo /D (subsubsection.5.9.10) >>
endobj
304 0 obj
-(Enumerate database table columns)
+(Enumerate database's tables)
endobj
305 0 obj
-<< /S /GoTo /D (subsubsection.5.9.12) >>
+<< /S /GoTo /D (subsubsection.5.9.11) >>
endobj
308 0 obj
-(Dump database table entries)
+(Enumerate database table columns)
endobj
309 0 obj
-<< /S /GoTo /D (subsubsection.5.9.13) >>
+<< /S /GoTo /D (subsubsection.5.9.12) >>
endobj
312 0 obj
-(Dump all databases tables entries)
+(Enumerate database management system schema)
endobj
313 0 obj
-<< /S /GoTo /D (subsubsection.5.9.14) >>
+<< /S /GoTo /D (subsubsection.5.9.13) >>
endobj
316 0 obj
-(Search for columns, tables or databases)
+(Retrieve number of entries for table\(s\))
endobj
317 0 obj
-<< /S /GoTo /D (subsubsection.5.9.15) >>
+<< /S /GoTo /D (subsubsection.5.9.14) >>
endobj
320 0 obj
-(Run custom SQL statement)
+(Dump database table entries)
endobj
321 0 obj
-<< /S /GoTo /D (subsection.5.10) >>
+<< /S /GoTo /D (subsubsection.5.9.15) >>
endobj
324 0 obj
-(Brute force)
+(Dump all databases tables entries)
endobj
325 0 obj
-<< /S /GoTo /D (subsubsection.5.10.1) >>
+<< /S /GoTo /D (subsubsection.5.9.16) >>
endobj
328 0 obj
-(Brute force tables names)
+(Search for columns, tables or databases)
endobj
329 0 obj
-<< /S /GoTo /D (subsubsection.5.10.2) >>
+<< /S /GoTo /D (subsubsection.5.9.17) >>
endobj
332 0 obj
-(Brute force columns names)
+(Run custom SQL statement)
endobj
333 0 obj
-<< /S /GoTo /D (subsection.5.11) >>
+<< /S /GoTo /D (subsection.5.10) >>
endobj
336 0 obj
-(User-defined function injection)
+(Brute force)
endobj
337 0 obj
-<< /S /GoTo /D (subsubsection.5.11.1) >>
+<< /S /GoTo /D (subsubsection.5.10.1) >>
endobj
340 0 obj
-(Inject custom user-defined functions \(UDF\))
+(Brute force tables names)
endobj
341 0 obj
-<< /S /GoTo /D (subsection.5.12) >>
+<< /S /GoTo /D (subsubsection.5.10.2) >>
endobj
344 0 obj
-(File system access)
+(Brute force columns names)
endobj
345 0 obj
-<< /S /GoTo /D (subsubsection.5.12.1) >>
+<< /S /GoTo /D (subsection.5.11) >>
endobj
348 0 obj
-(Read a file from the database server's file system)
+(User-defined function injection)
endobj
349 0 obj
-<< /S /GoTo /D (subsubsection.5.12.2) >>
+<< /S /GoTo /D (subsubsection.5.11.1) >>
endobj
352 0 obj
-(Upload a file to the database server's file system)
+(Inject custom user-defined functions \(UDF\))
endobj
353 0 obj
-<< /S /GoTo /D (subsection.5.13) >>
+<< /S /GoTo /D (subsection.5.12) >>
endobj
356 0 obj
-(Operating system takeover)
+(File system access)
endobj
357 0 obj
-<< /S /GoTo /D (subsubsection.5.13.1) >>
+<< /S /GoTo /D (subsubsection.5.12.1) >>
endobj
360 0 obj
-(Run arbitrary operating system command)
+(Read a file from the database server's file system)
endobj
361 0 obj
-<< /S /GoTo /D (subsubsection.5.13.2) >>
+<< /S /GoTo /D (subsubsection.5.12.2) >>
endobj
364 0 obj
-(Out-of-band stateful connection: Meterpreter \046 friends)
+(Upload a file to the database server's file system)
endobj
365 0 obj
-<< /S /GoTo /D (subsection.5.14) >>
+<< /S /GoTo /D (subsection.5.13) >>
endobj
368 0 obj
-(Windows registry access)
+(Operating system takeover)
endobj
369 0 obj
-<< /S /GoTo /D (subsubsection.5.14.1) >>
+<< /S /GoTo /D (subsubsection.5.13.1) >>
endobj
372 0 obj
-(Read a Windows registry key value)
+(Run arbitrary operating system command)
endobj
373 0 obj
-<< /S /GoTo /D (subsubsection.5.14.2) >>
+<< /S /GoTo /D (subsubsection.5.13.2) >>
endobj
376 0 obj
-(Write a Windows registry key value)
+(Out-of-band stateful connection: Meterpreter \046 friends)
endobj
377 0 obj
-<< /S /GoTo /D (subsubsection.5.14.3) >>
+<< /S /GoTo /D (subsection.5.14) >>
endobj
380 0 obj
-(Delete a Windows registry key)
+(Windows registry access)
endobj
381 0 obj
-<< /S /GoTo /D (subsubsection.5.14.4) >>
+<< /S /GoTo /D (subsubsection.5.14.1) >>
endobj
384 0 obj
-(Auxiliary registry switches)
+(Read a Windows registry key value)
endobj
385 0 obj
-<< /S /GoTo /D (subsection.5.15) >>
+<< /S /GoTo /D (subsubsection.5.14.2) >>
endobj
388 0 obj
-(General)
+(Write a Windows registry key value)
endobj
389 0 obj
-<< /S /GoTo /D (subsubsection.5.15.1) >>
+<< /S /GoTo /D (subsubsection.5.14.3) >>
endobj
392 0 obj
-(Log HTTP\(s\) traffic to a textual file)
+(Delete a Windows registry key)
endobj
393 0 obj
-<< /S /GoTo /D (subsubsection.5.15.2) >>
+<< /S /GoTo /D (subsubsection.5.14.4) >>
endobj
396 0 obj
-(Session file: save and resume data retrieved)
+(Auxiliary registry switches)
endobj
397 0 obj
-<< /S /GoTo /D (subsubsection.5.15.3) >>
+<< /S /GoTo /D (subsection.5.15) >>
endobj
400 0 obj
-(Flush session file)
+(General)
endobj
401 0 obj
-<< /S /GoTo /D (subsubsection.5.15.4) >>
+<< /S /GoTo /D (subsubsection.5.15.1) >>
endobj
404 0 obj
-(Ignores query results stored in session file)
+(Log HTTP\(s\) traffic to a textual file)
endobj
405 0 obj
-<< /S /GoTo /D (subsubsection.5.15.5) >>
+<< /S /GoTo /D (subsubsection.5.15.2) >>
endobj
408 0 obj
-(Estimated time of arrival)
+(Session file: save and resume data retrieved)
endobj
409 0 obj
-<< /S /GoTo /D (subsubsection.5.15.6) >>
+<< /S /GoTo /D (subsubsection.5.15.3) >>
endobj
412 0 obj
-(Update sqlmap)
+(Flush session file)
endobj
413 0 obj
-<< /S /GoTo /D (subsubsection.5.15.7) >>
+<< /S /GoTo /D (subsubsection.5.15.4) >>
endobj
416 0 obj
-(Save options in a configuration INI file)
+(Ignores query results stored in session file)
endobj
417 0 obj
-<< /S /GoTo /D (subsubsection.5.15.8) >>
+<< /S /GoTo /D (subsubsection.5.15.5) >>
endobj
420 0 obj
-(Act in non-interactive mode)
+(Estimated time of arrival)
endobj
421 0 obj
-<< /S /GoTo /D (subsection.5.16) >>
+<< /S /GoTo /D (subsubsection.5.15.6) >>
endobj
424 0 obj
-(Miscellaneous)
+(Update sqlmap)
endobj
425 0 obj
-<< /S /GoTo /D (subsubsection.5.16.1) >>
+<< /S /GoTo /D (subsubsection.5.15.7) >>
endobj
428 0 obj
-(Alert when a SQL injection is detected)
+(Save options in a configuration INI file)
endobj
429 0 obj
-<< /S /GoTo /D (subsubsection.5.16.2) >>
+<< /S /GoTo /D (subsubsection.5.15.8) >>
endobj
432 0 obj
-(IDS detection testing of injection payloads)
+(Act in non-interactive mode)
endobj
433 0 obj
-<< /S /GoTo /D (subsubsection.5.16.3) >>
+<< /S /GoTo /D (subsection.5.16) >>
endobj
436 0 obj
-(Cleanup the DBMS from sqlmap specific UDF\(s\) and table\(s\))
+(Miscellaneous)
endobj
437 0 obj
-<< /S /GoTo /D (subsubsection.5.16.4) >>
+<< /S /GoTo /D (subsubsection.5.16.1) >>
endobj
440 0 obj
-(Parse and test forms' input fields)
+(Alert when a SQL injection is detected)
endobj
441 0 obj
-<< /S /GoTo /D (subsubsection.5.16.5) >>
+<< /S /GoTo /D (subsubsection.5.16.2) >>
endobj
444 0 obj
-(Use Google dork results from specified page number)
+(IDS detection testing of injection payloads)
endobj
445 0 obj
-<< /S /GoTo /D (subsubsection.5.16.6) >>
+<< /S /GoTo /D (subsubsection.5.16.3) >>
endobj
448 0 obj
-(Display page rank \(PR\) for Google dork results)
+(Cleanup the DBMS from sqlmap specific UDF\(s\) and table\(s\))
endobj
449 0 obj
-<< /S /GoTo /D (subsubsection.5.16.7) >>
+<< /S /GoTo /D (subsubsection.5.16.4) >>
endobj
452 0 obj
-(Parse DBMS error messages from response pages)
+(Parse and test forms' input fields)
endobj
453 0 obj
-<< /S /GoTo /D (subsubsection.5.16.8) >>
+<< /S /GoTo /D (subsubsection.5.16.5) >>
endobj
456 0 obj
-(Replicate dumped data into a sqlite3 database)
+(Use Google dork results from specified page number)
endobj
457 0 obj
-<< /S /GoTo /D (subsubsection.5.16.9) >>
+<< /S /GoTo /D (subsubsection.5.16.6) >>
endobj
460 0 obj
-(Simple wizard interface for beginner users)
+(Imitate smartphone)
endobj
461 0 obj
-<< /S /GoTo /D (section.6) >>
+<< /S /GoTo /D (subsubsection.5.16.7) >>
endobj
464 0 obj
-(License and copyright)
+(Display page rank \(PR\) for Google dork results)
endobj
465 0 obj
-<< /S /GoTo /D (section.7) >>
+<< /S /GoTo /D (subsubsection.5.16.8) >>
endobj
468 0 obj
-(Disclaimer)
+(Parse DBMS error messages from response pages)
endobj
469 0 obj
-<< /S /GoTo /D (section.8) >>
+<< /S /GoTo /D (subsubsection.5.16.9) >>
endobj
472 0 obj
-(Authors)
+(Replicate dumped data into a sqlite3 database)
endobj
473 0 obj
-<< /S /GoTo /D [474 0 R /Fit ] >>
+<< /S /GoTo /D (subsubsection.5.16.10) >>
endobj
-507 0 obj <<
-/Length 1243
+476 0 obj
+(Simple wizard interface for beginner users)
+endobj
+477 0 obj
+<< /S /GoTo /D (section.6) >>
+endobj
+480 0 obj
+(License and copyright)
+endobj
+481 0 obj
+<< /S /GoTo /D (section.7) >>
+endobj
+484 0 obj
+(Disclaimer)
+endobj
+485 0 obj
+<< /S /GoTo /D (section.8) >>
+endobj
+488 0 obj
+(Authors)
+endobj
+489 0 obj
+<< /S /GoTo /D [490 0 R /Fit ] >>
+endobj
+523 0 obj <<
+/Length 1247
/Filter /FlateDecode
>>
stream
-xZw6VBǦdӗ؊C#vW Aq4qŒ<#}hf:3:#hۃ#:_9!vB!x\&G`]fPZ>BęG3" )'9pb?f5Q(0/]Z*gVȹ@z"Ms=AB!TOi}+,Bk"".W#\UY4c@!$h42IMAC*Ah
x,uR40r.2e5?z(9i2c,:zë.n*0S-5>iSmKf?kJUܣP@ݕ\/820P>r*|;SqH^u(
}`kbMHѮ]DE3
@aCx?I'˽"-x4==(Buf>Vv?4hkK//?l#O}æS羇yU4'Ks^;2d݁osm{=6/U}UD";Ah\ϻiJ\WS\6e+!3]+ͯ\^n_fF %セݚGi>׀~-~7POGӓUHmOHh*z
Tf)!@Ɗ#
-{1Em@9h[˺/EmK<,xV.N~;yиkǣ
-
+xZs6~_[AxlK.k{I؊Cπ# Hc5qʋ%0J߷]́`<>9+'N@P쌧oX(s~ȫ~znFHe#DI2Q: stFfD~1oЧ!3/]ZfVȹ@z M3=@BH\Oi}+LBǔk|.\[#BUYg,5O#zSy\7"TxKx@#5pܼXMPLsFf͔F$72X|#;k)p75ʱ6dƀ PH@P(2Pw8b 0'Za!8 ~>cx'x Z}A)c%5$Z(X5pÆFv/