implementation of switch --hex for 4 major DBMSes

This commit is contained in:
Miroslav Stampar
2012-02-21 11:44:48 +00:00
parent 77723a7aee
commit bcf3255fe1
7 changed files with 108 additions and 53 deletions

View File

@@ -102,7 +102,7 @@ proxy =
# Syntax: username:password
pCred =
# Ignore system default HTTP proxy
# Ignore system default HTTP proxy.
# Valid: True or False
ignoreProxy = False
@@ -121,21 +121,21 @@ timeout = 30
# Default: 3
retries = 3
# Regular expression for filtering targets from provided Burp
# Regular expression for filtering targets from provided Burp.
# or WebScarab proxy log.
# Example: (google|yahoo)
scope =
# Url address to visit frequently during testing
# Url address to visit frequently during testing.
# Example: http://192.168.1.121/index.html
safUrl =
# Test requests between two visits to a given safe url (default 0)
# Test requests between two visits to a given safe url (default 0).
# Valid: integer
# Default: 0
saFreq = 0
# Evaluate provided Python code before the request
# Evaluate provided Python code before the request.
# Example: import hashlib;id2=hashlib.md5(id).hexdigest()
evalCode =
@@ -188,20 +188,20 @@ dbms =
# Valid: linux, windows
os =
# Injection payload prefix string
# Injection payload prefix string.
prefix =
# Injection payload suffix string
# Injection payload suffix string.
suffix =
# Use logic operation(s) instead of negating values
# Use logic operation(s) instead of negating values.
# Valid: True or False
logicNegative = False
# Skip testing for given parameter(s)
# Skip testing for given parameter(s).
skip =
# Use given script(s) for tampering injection data
# Use given script(s) for tampering injection data.
tamper =
@@ -209,14 +209,14 @@ tamper =
# content from HTTP responses when using blind SQL injection technique.
[Detection]
# Level of tests to perform
# Level of tests to perform.
# The higher the value is, the higher the number of HTTP(s) requests are
# as well as the better chances to detect a tricky SQL injection.
# Valid: Integer between 1 and 5
# Default: 1
level = 1
# Risk of tests to perform
# Risk of tests to perform.
# Note: boolean-based blind SQL injection tests with AND are considered
# risk 1, with OR are considered risk 3.
# Valid: Integer between 0 and 3
@@ -236,17 +236,17 @@ string =
# (http://www.python.org/doc/2.5.2/lib/re-syntax.html)
regexp =
# HTTP response code to match when the query is valid
# HTTP response code to match when the query is valid.
# Valid: Integer
# Example: 200 (assuming any False statement returns a different response
# code)
# code =
# Compare pages based only on the textual content
# Compare pages based only on the textual content.
# Valid: True or False
textOnly = False
# Compare pages based only on their titles
# Compare pages based only on their titles.
# Valid: True or False
titles = False
@@ -497,28 +497,28 @@ tmpPath =
# system Windows registry.
[Windows]
# Read a Windows registry key value
# Read a Windows registry key value.
# Valid: True or False
regRead = False
# Write a Windows registry key value data
# Write a Windows registry key value data.
# Valid: True or False
regAdd = False
# Delete a Windows registry key value
# Delete a Windows registry key value.
# Valid: True or False
regDel = False
# Windows registry key
# Windows registry key.
regKey =
# Windows registry key value
# Windows registry key value.
regVal =
# Windows registry key value data
# Windows registry key value data.
regData =
# Windows registry key value type
# Windows registry key value type.
regType =
@@ -538,11 +538,11 @@ batch = False
# Force character encoding used for data retrieval.
charset =
# Check to see if Tor is used properly
# Check to see if Tor is used properly.
# Valid: True or False
checkTor = False
# Crawl the website starting from the target url
# Crawl the website starting from the target url.
# Valid: integer
# Default: 0
crawlDepth = 0
@@ -560,7 +560,7 @@ eta = False
# Valid: True or False
flushSession = False
# Parse and test forms on target url
# Parse and test forms on target url.
# Valid: True or False
forms = False
@@ -568,6 +568,10 @@ forms = False
# Valid: True or False
freshQueries = False
# Uses DBMS hex conversion function(s) for data retrieval.
# Valid: True or False
hexConvert = False
# Parse and display DBMS error messages from responses.
# Valid: True or False
parseErrors = False
@@ -580,7 +584,7 @@ replicate = False
# Valid: True or False
tor = False
# Set Tor proxy port other than default
# Set Tor proxy port other than default.
# Valid: integer
# torPort =