diff --git a/doc/FAQ.html b/doc/FAQ.html new file mode 100644 index 000000000..93a3ed208 --- /dev/null +++ b/doc/FAQ.html @@ -0,0 +1,246 @@ + + +
+ ++
"WARNING unknown charset '...'" mean?
+mod_rewrite enabled?
+--text-only switch?
+--banner)?
+"CRITICAL connection timed" while I am able to browse the site normally?
+"INSERT/UPDATE" SQL commands via --sql-query
+"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
+sqlmap is an open source penetration testing tool that automates the +process of detecting and exploiting SQL injection flaws and taking over +of database servers. It comes with a powerful detection engine, many niche +features for the ultimate penetration tester and a broad range of switches +lasting from database fingerprinting, over data fetching from the +database, to accessing the underlying file system and executing commands +on the operating system via out-of-band connections.
+ +If you are running on a Unix/Linux system type the following command +from a terminal: +
+
+python sqlmap.py -h
+
+
+
+
+If you are running on a Windows system type the following command +from a terminal: +
+
+C:\Python26\python.exe sqlmap.py -h
+
+
+
+
+Where C:\Python26 is the path where you installed
+Python >= 2.6.
Yes. sqlmap is released under the terms of the GPLv2, which means that any +derivative work must be distributed without further restrictions on the +rights granted by the GPL itself. If this constitutes a problem, feel free +to contact us so we can find a solution.
+ +TODO
+ +Yes. There are plans to support also IBM DB2, Informix and Ingres at some +point.
+ +All help is greatly appreciated. First of all download the tool, make sure +you are running the latest development version from the Subversion +repository, read the user's manual carefully, have fun with it during your +penetration tests. +If you find bugs or have ideas for possible improvements, feel free to +get in touch on the mailing list. Many people have +contributed in different ways to the sqlmap development. +You can be the next!
+ +Yes, we are looking for people who can write some clean Python code, are +up to do security research, know about web application security, database +assessment and takeover, software refactoring and are motivated to join +the development team. +If this sounds interesting to you, +get in touch!
+ +If you think that sqlmap is a great tool, it really played well during +your penetration tests, or you simply like it, you, or your boss, can +donate some money to the developers via PayPal.
+ +No.
+ +Currently there is no huge pressure on Python projects to switch to the new +version of Python interpreter, as the process of switching, especially on +larger projects can be cumbersome (due to the few backward incompatibilities). +The switch will take place eventually, but currently it's a very low priority task.
+ +"WARNING unknown charset '...'" mean?
+sqlmap needs to properly decode page content to be able to properly
+detect and deal with internationalized characters. In some cases web developers
+are doing mistakes when declaring used web page charset (e.g. iso_8859 instead
+of standardized name iso-8859), which can cause problems. As a failsafe mechanism
+we've incorporated heuristic detection engine
+chardet,
+so in most cases sqlmap will deal with this kind of problems automatically.
+Nevertheless, you are strongly advised to report us back those typographic "mistakes"
+so we could handle them manually inside the code.
mod_rewrite enabled?
+Just put * to the place where sqlmap should check for injections in URI
+itself. In example: ./sqlmap.py -u "www.site.com/id1/1*/id2/2" sqlmap
+will try to inject the payloads just at that place marked with * character.
You most probably don't have enough permissions for querying on a system +table containing password hashes.
+ +Question(s): +#1
+ +--text-only switch?
+Switch --text-only is used for removing non-textual data (tags,
+javascripts, styles,...) from the retrieved page content to further
+improve detection capabilities.
Question(s): +#1
+ +--banner)?
+If everything you retrieve from the target is garbled, then you are +most probably dealing with false positive blind injection. Please +report the problem to the +developers.
+ + + +"CRITICAL connection timed" while I am able to browse the site normally?
+There are few IDSes that filter out all sqlmap requests based on default
+User-Agent HTTP header used (e.g. "User-agent: sqlmap/1.0-dev"). To prevent this
+kind of situations you are advised to use switch --random-agent.
+If you are getting those kind of messages for all targets then you
+most probably need to properly set up your proxy settings (switches --proxy
+and/or --ignore-proxy)
Question(s): +#1
+ +"INSERT/UPDATE" SQL commands via --sql-query
+and/or --sql-shell?It is possible to use those commands, but only if the stacked injection is supported +by the vulnerable target.
+ +Question(s): +#1
+ +"finally: SyntaxError: invalid syntax" when trying to run sqlmap?
+You are most probably using outdated version of Python. sqlmap is generally +supported by Python versions in range 2.5, 2.6 and 2.7, while you are strongly +advised to use versions 2.6 and 2.7.
+ +Question(s): +#1
+ +Currently there are only two of us working on a pure good will and donating our +free time to the community. If you are not willing to help us achive better tool +you are strongly advised to buy those commercial tool(s) and just +forget about the sqlmap.
+ +Question(s): +#1
+ + + diff --git a/doc/FAQ.pdf b/doc/FAQ.pdf new file mode 100644 index 000000000..c963f28d2 Binary files /dev/null and b/doc/FAQ.pdf differ diff --git a/doc/FAQ.sgml b/doc/FAQ.sgml index 2cccee351..151bfa04d 100644 --- a/doc/FAQ.sgml +++ b/doc/FAQ.sgml @@ -7,7 +7,7 @@
If you think that sqlmap is a great tool, it really played well during
your penetration tests, or you simply like it, you, or your boss, can
-
This document is the user's manual to use
-sqlmap.
+sqlmap.
1. Introduction
@@ -123,7 +123,7 @@ for the database management system that you are going to attack:
This is strongly recommended before reporting any bug to the -mailing list.
+mailing list.
-sqlmap/0.9 (http://sqlmap.sourceforge.net)
+sqlmap/0.9 (http://www.sqlmap.org)
@@ -3032,7 +3032,7 @@ by right-clicking in Windows Explorer into your sqlmap working copy and
clicking on Update.
This is strongly recommended before reporting any bug to the -mailing lists.
+mailing lists.