From 9dbad512f13d9970ec1da4421492055171a757b9 Mon Sep 17 00:00:00 2001
From: Bernardo Damele
Option: --string
Option: --dbms
By default the distinction of a True query by a False one (basic concept +
By default sqlmap automatically detects the web application's back-end +database manangement system. +At the moment the fully supported database management system are four:
++
It is possible to force the name if you already know it so that sqlmap
+will skip the fingerprint with an exception for MySQL to only identify if
+it is MySQL < 5.0 or MySQL >= 5.0.
+To avoid also this check you can provide instead MySQL 4 or
+MySQL 5.
Example on a PostgreSQL 8.2.7 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
+ --dbms "PostgreSQL"
+
+[...]
+[hh:mm:31] [DEBUG] skipping to test for MySQL
+[hh:mm:31] [DEBUG] skipping to test for Oracle
+back-end DBMS: PostgreSQL
+
+
+
+
+In case you provide --fingerprint together with --dbms,
+sqlmap will only perform the extensive fingerprint for the specified
+database management system, read the following section for further
+details.
Note that this option is not mandatory and it is strongly +recommended to use it only if you are absolutely sure about the +back-end database management system. If you do not know it, let sqlmap +automatically identify it for you.
+ + +Options: --prefix and --postfix
TODO
+ + +Options: --string and --regexp
TODO +By default the distinction of a True query by a False one (basic concept for standard blind SQL injection attacks) is done comparing injected pages content MD5 hash with the original not-injected page content MD5. Not always this concept works because sometimes the page content changes at @@ -1410,53 +1472,6 @@ content that changes itself at each refresh without modifying the user's input.
-Option: --dbms
By default sqlmap automatically detects the web application's back-end -database manangement system. -At the moment the fully supported database management system are four:
--
It is possible to force the name if you already know it so that sqlmap
-will skip the fingerprint with an exception for MySQL to only identify if
-it is MySQL < 5.0 or MySQL >= 5.0.
-To avoid also this check you can provide instead MySQL 4 or
-MySQL 5.
Example on a PostgreSQL 8.2.7 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
- --dbms "PostgreSQL"
-
-[...]
-[hh:mm:31] [DEBUG] skipping to test for MySQL
-[hh:mm:31] [DEBUG] skipping to test for Oracle
-back-end DBMS: PostgreSQL
-
-
-
-
-In case you provide --fingerprint together with --dbms,
-sqlmap will only perform the extensive fingerprint for the specified
-database management system, read the following section for further
-details.
Note that this option is not mandatory and it is strongly -recommended to use it only if you are absolutely sure about the -back-end database management system. If you do not know it, let sqlmap -automatically identify it for you.
- -JtTn0UM3oE-Mg^Hl+0j}^ d3QuuHSvo37^mU7Vfl?>{JE!tEYDn1T{#T$!^+6EK
zXTLSm9o6uj!1p0b&f+iP`ouOPO?Y3vd{Z-NK5}zOq)Sy3p-u8|fL!ev7A{H4?eC$S
zU_wro$g+TSNDGKWV`X-$V7UAs;i)30J4{ID0rjTlJv_d%b2gj~QKD(=d2msNIa_$)
z;U>Z7AsTK4P}{JWqa1h-f`6DlKzMobTg`Bz_qS8l?{ATZe@c@?)xXeB9lvu|)z&UY
z#ilp0>maIY$E&%6p`f20T@q8N)u*YJX_KdVpeELkSKNRz0AiWW;-WB|we5u2GNW^=
zbJ157iisXfNMI6bPb@b!-`DFv${Oz8S?sPM6+(jmPnKn%ZNMvHl{B3zTk;^wqcy+J
zhgGuM^mAX7CM}eBR&0;M4d447YFnunEO3`0-0k^N4kFGxw0a tyJP}(fh-Td#vG4%Xky2dqZ94*Q?e{5*SE!;7_D39|BY)2a$kafUu!(
z0i5d7<}nT=)oCXz!?q$=6GkE=4+ev6z)kl{_o*R+t~`o3sSyq&rj=O$F<>Zf^9y`s
zFfvY%;PuugU+nhqd3()WAdiG62CN4UPLrh