7c3773a5d7
Minor bug fix to -d
2010-06-30 14:00:49 +00:00
12a5ec9f3d
more unicode refactoring
2010-06-02 12:45:40 +00:00
b798222dd7
Minor fixes
2010-05-30 14:53:13 +00:00
1387ed0c25
This %TEMP% is a mere cause of problems (e.g. --os-cmd in MSSQL the BULK INSERT with '%TEMP%\foo' does not work), stick with C:/WINDOWS/Temp
2010-05-29 15:27:49 +00:00
89c721a451
More replacements from open() to codecs.open(). conf.dataEncoding has to be used only for non-binary files.
2010-05-29 10:10:28 +00:00
06af405efd
Adapted and merged in patch to support XML output (-x switch) - still in beta.
...
Minor bug fixes and adjustments.
2010-05-28 16:43:04 +00:00
f24187f251
few fixes here and there
2010-05-28 12:47:03 +00:00
dc83f794ea
fix regarding proper string isinstance checking (including unicode)
2010-05-25 10:09:35 +00:00
20d05cc404
way to handle re.I (ignore case) while using getCompiledRegex
2010-05-21 15:03:40 +00:00
e0e2349529
Refactor to --search -C and minor bug fix - See #190 .
2010-05-17 16:16:49 +00:00
c9ee11e0e4
Added support to search for tables (--search with -T). See #190 .
2010-05-16 20:46:17 +00:00
762781e94d
Minor bug fix, %TEMP% is expanded only in xp_cmdshell (MSSQL), so disabled for MySQL/PGSQL
2010-05-13 10:40:15 +00:00
091e0b2e05
Layout adjustment
2010-05-13 09:51:15 +00:00
2323d858a9
modification of temporary directory from C:/Windows/Temp to %TEMP%
2010-05-13 09:32:27 +00:00
65a05452f7
Added option --search to work in conjunction with -D (done), -T (soon) or -C (replaces --dump -C) - See #190 :
...
* --search -D foobar: searches all database names like the ones provided
* --search -T foobar: searches all databases' table names like the ones provided (soon)
* --search -C foobar: replaces --dump -C
2010-05-07 13:40:57 +00:00
90d9900371
Minor bug fix to consider --start and --stop also in partial UNION query SQL injection
2010-04-30 15:48:40 +00:00
a1b1f960cc
Finally fixed and adapted all code around to the new isWindowsDriveLetterPath() function
2010-04-23 16:34:20 +00:00
17554759b7
implemented feature request from Ole Rasmussen regarding table name retrieval speedup
2010-04-15 09:36:13 +00:00
b19de015c5
Minor bugs fixes
2010-03-31 13:52:51 +00:00
5fdebb5d5b
Added support to directly connect also to Microsoft SQL Server database.
...
Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output).
Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods.
Forced conf.timeout to 10 seconds when directly connecting to database.
Slightly improved regular expression to parse -d parameter.
Added import check for all connectors' third-party libraries.
Code refactoring:
* Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed).
* Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
1973024ebf
added support for reusing connections
2010-03-30 13:52:47 +00:00
1416cd0d86
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158 . This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module).
...
Minor layout adjustments.
2010-03-26 23:23:25 +00:00
eaa9dd07bc
Minor bug fix for --roles
2010-03-26 20:45:22 +00:00
2aadc5c939
Added support for --roles (for Oracle ROLE_PRIVS). Enhanced Oracle --privileges to fall-back to USER_SYS_PRIVS if DBA_SYS_PRIVS is not accessible (so session user is not DBA) - Fixes ticket #180 .
...
Minor enhancement to Firebird to determine if a DB user is a DBA.
Minor code refactoring.
2010-03-25 15:46:06 +00:00
09768a7b62
Major code refactoring: moved and split plugins (mysql, pgsql, mssql, oracle) more granularly and organized.
...
Todo for firebird, sqlite, access.
2010-03-22 22:57:57 +00:00
0d559d14df
Initial support for SQLite (90% approx).
...
Initial support for Firebird (30% approx).
Initial support for Access (10% approx).
Shared libraries code/installation scripts ported to 64bit, directory structure adapted.
Minor code adjustments.
2010-03-18 17:20:54 +00:00
5f76d27779
minor typo correction
2010-03-13 10:44:24 +00:00
7d8cc1a482
Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:
...
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.
Minor layout adjustments.
2010-03-12 22:43:35 +00:00
0a2fe651ab
some fixes regarding registry reading
2010-03-12 22:09:58 +00:00
18d1d09f1c
Minor bug fix
2010-03-12 13:34:46 +00:00
cc611c0010
Minor layout adjustments
2010-03-09 22:14:26 +00:00
5bd8504f21
Newline adjustment
2010-03-04 14:23:52 +00:00
58d54b6515
added new option --flush-session
2010-03-04 13:01:18 +00:00
156fdd96ef
Updated copyright
2010-03-03 15:26:27 +00:00
694356821d
sqlmap does not save nor leave back in temporary folder any file named 'sqlmapRANDOM', only random names now, less suspicious
2010-02-26 13:13:50 +00:00
8c68d25b39
Major bug fix, be careful when editing isWindowsPath() and normalizePath() in common.py, they can break all
2010-02-26 12:00:47 +00:00
89dc99188d
--read-file on PostgreSQL now relies on the new sys_fileread() UDF so that also binary files can be read.
...
Fixed a minor bug in custom UDF injection feature --udf-inject.
Major code refactoring.
2010-02-11 22:57:50 +00:00
5c92fad5dc
Avoid to check for existence of not needed UDFs and minor code adjustment for cleanup() method
2010-02-05 23:14:16 +00:00
d291464cd4
code refactoring regarding path normalization
2010-02-04 14:50:54 +00:00
ec63fc4036
code refactoring - added functions posixToNtSlashes and ntToPosixSlashes
2010-02-04 14:37:00 +00:00
950dba5139
Minor bug fix for --start and --stop
2010-02-02 14:17:39 +00:00
7faefcca88
Minor logging messages adjustments
2010-01-29 23:19:52 +00:00
200518724c
By default do not use Churrasco, but still let the user choose it.
...
The default technique to privilege escalate the OS user to SYSTEM when --priv-esc is provided now it 'run kitrap0d'.
2010-01-29 02:27:50 +00:00
144dc1b8c4
Show proper warning message when --priv-esc is provided and underlying OS is not Windows
2010-01-28 17:22:17 +00:00
732ed48e2b
some refactoring regarding decloaking
2010-01-28 16:50:34 +00:00
921e449454
added support for cloaking Churrasco.exe file
2010-01-28 00:07:33 +00:00
6437c16156
run kitrap0d script along with listing Windows Impersonation Tokens via meterpreter's incognito extension when --priv-esc is provided (see #149 ).
2010-01-26 01:14:44 +00:00
6d697d60b2
Minor adjustment
2010-01-15 18:00:15 +00:00
1d968f51e9
More code refactoring
2010-01-14 15:11:32 +00:00
c9863bc1d2
Minor code refactoring
2010-01-14 14:33:08 +00:00
Bernardo Damele