From 32ca99da53a7ec2e1cf79b2652a9891436994d86 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar Yes. sqlmap is released under the terms of the GPLv2, which means that any
derivative work must be distributed without further restrictions on the
-rights granted by the GPL itself. If this constitutes a problem, feel free
-to contact us so we can find a solution."WARNING unknown charset '...'" mean?
-mod_rewrite enabled?
---text-only switch?
---banner)?
-"CRITICAL connection timed" while I am able to browse the site normally?
-"INSERT/UPDATE" SQL commands via --sql-query
-"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
-"WARNING unknown charset '...'" mean?
+mod_rewrite enabled?
+--text-only switch?
+"CRITICAL connection timed" while I am able to browse the site normally?
+"INSERT/UPDATE" SQL commands via --sql-query
+"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
+
@@ -82,21 +80,15 @@ C:\Python26\python.exe sqlmap.py -h
TODO
+Yes. There are plans to support also Informix and Ingres at some +point of time.
-Yes. There are plans to support also IBM DB2, Informix and Ingres at some -point.
- -All help is greatly appreciated. First of all download the tool, make sure @@ -108,7 +100,7 @@ If you find bugs or have ideas for possible improvements, feel free to contributed in different ways to the sqlmap development. You can be the next!
-Yes, we are looking for people who can write some clean Python code, are @@ -118,27 +110,27 @@ the development team. If this sounds interesting to you, get in touch!
-If you think that sqlmap is a great tool, it really played well during your penetration tests, or you simply like it, you, or your boss, can donate some money to the developers via PayPal.
-No.
-Currently there is no huge pressure on Python projects to switch to the new +
Currently there is no pressure on Python projects to switch to the new version of Python interpreter, as the process of switching, especially on larger projects can be cumbersome (due to the few backward incompatibilities). The switch will take place eventually, but currently it's a very low priority task.
-"WARNING unknown charset '...'" mean?
+"WARNING unknown charset '...'" mean?
sqlmap needs to properly decode page content to be able to properly @@ -156,7 +148,7 @@ so we could handle them manually inside the code.
#2 #3 -mod_rewrite enabled?
+mod_rewrite enabled?
Just put * to the place where sqlmap should check for injections in URI @@ -168,7 +160,7 @@ will try to inject the payloads just at that place marked with * character.
#2 #3 -You most probably don't have enough permissions for querying on a system @@ -177,7 +169,7 @@ table containing password hashes.
Question(s): #1
---text-only switch?
+--text-only switch?
Switch --text-only is used for removing non-textual data (tags,
@@ -187,19 +179,7 @@ improve detection capabilities.
Question(s): #1
---banner)?
-If everything you retrieve from the target is garbled, then you are -most probably dealing with false positive blind injection. Please -report the problem to the -developers.
- - - -"CRITICAL connection timed" while I am able to browse the site normally?
+"CRITICAL connection timed" while I am able to browse the site normally?
There are few IDSes that filter out all sqlmap requests based on default
@@ -212,16 +192,17 @@ and/or --ignore-proxy)
Question(s): #1
-"INSERT/UPDATE" SQL commands via --sql-query
+"INSERT/UPDATE" SQL commands via --sql-query
and/or --sql-shell?It is possible to use those commands, but only if the stacked injection is supported -by the vulnerable target.
+by the vulnerable target. In vast majority of cases affected DBMSes by these kind of +attacks are Microsoft SQL Server and PostgreSQL.Question(s): #1
-"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
+"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
You are most probably using outdated version of Python. sqlmap is generally @@ -231,13 +212,14 @@ advised to use versions 2.6 and 2.7.
Question(s): #1
-Currently there are only two of us working on a pure good will and donating our -free time to the community. If you are not willing to help us achive better tool -you are strongly advised to buy those commercial tool(s) and just -forget about the sqlmap.
+In most of those kind of cases blatant error message detection is used by commercial +tools making some "false positive" claims. You have to be aware that +DBMS error message doesn't mean that the affected web application is vulnerable to +SQL injection attacks. sqlmap goes several steps further and never claims +an injection point without making through tests if it can be exploited at the first place.
Question(s): #1
diff --git a/doc/FAQ.pdf b/doc/FAQ.pdf index 007e9f9d14e389ae538fb3f26a90ad6cb1be10df..05dc5e9f1c6c3ad694f07a9b1d38dc2aafe6fe3e 100644 GIT binary patch delta 30500 zcmbV#30REZ7r%GfQ)!u*va~1?ZL=>*sHC(h`_hIYX;Zc=V=p0e