d324704844
Removed unused code
2011-04-10 20:39:15 +00:00
17844eb87c
Refactoring to --technique
2011-04-07 10:00:47 +00:00
05d12790f1
closes #219 - unhidden switch --technique and adapted code accordingly (renamed conf.technique to conf.tech to fit properly in the -h help message)
2011-04-06 14:41:44 +00:00
adfbfef8c1
minor refactoring
2011-03-29 21:01:47 +00:00
e20d460809
Bernardo will kill me (added --wizard for total beginners)
2011-03-29 11:42:55 +00:00
a2d5358b08
minor fix
2011-03-28 23:40:46 +00:00
9e900ccbac
minor comment update
2011-03-28 23:12:04 +00:00
a61e287d23
making updates for dummy Windows users
2011-03-28 23:09:19 +00:00
e42cdfd138
adding possibility to run only one live test (e.g. --run-case=8)
2011-03-24 12:07:47 +00:00
ecbbfeba6e
introduction of --fresh-queries
2011-03-24 10:08:47 +00:00
bd75fd26e9
implementing a --page-rank switch as requested by l0rda@l0rda.biz
2011-03-23 11:57:57 +00:00
1abcd507b8
hidding --group-concat switch
2011-03-21 12:13:21 +00:00
19e2ed9803
Layout fix
2011-03-21 00:40:25 +00:00
088c815567
minor update (exposing --tor switch)
2011-03-19 18:28:51 +00:00
00b9d85ffc
fix regarding bug report from andyroyalbattle@yahoo.it
2011-03-18 16:26:39 +00:00
99adbbeaa3
los cosmeticados
2011-03-07 22:04:17 +00:00
6e8ebd35f4
Hide switch -x (XML output format) as it is incomplete and bugged and won't make it for 0.9 stable
2011-02-27 12:17:41 +00:00
d05bd75068
adding experimental for --group-concat
2011-02-22 14:35:38 +00:00
023a80c31c
Section explanation change to reflect recent enhancements
2011-02-19 21:06:24 +00:00
199f14df46
implementation of MySQL GROUP_CONCAT technique
2011-02-15 00:28:27 +00:00
9f7d666451
removing --method per request of buawig
2011-02-12 19:50:27 +00:00
5f2fcd1eea
minor adjustment regarding "file" switches
2011-02-10 19:55:47 +00:00
4295a78c5f
minor update
2011-02-10 19:51:34 +00:00
b56a77e573
removing obsolete switches (--threshold, --excl-reg, --excl-str)
2011-02-03 15:55:19 +00:00
1b9850b73a
revert of last commit (conf dictionary has a method "update" which caused if conf.update to True always :) )
2011-02-03 12:21:29 +00:00
5edba2ffbc
minor change (conf.updateAll to conf.update)
2011-02-03 11:13:39 +00:00
5f49e20cc8
adding --random-agent and removing -a
2011-02-02 14:51:12 +00:00
a6f2cd56ff
removed junky import
2011-01-31 11:59:58 +00:00
ddf23ba7cc
refactoring
2011-01-30 11:36:03 +00:00
3060c369a5
minor fix for previous commit
2011-01-30 07:44:47 +00:00
1abf354630
minor update
2011-01-30 07:41:09 +00:00
d63339ca26
minor bug fix
2011-01-30 07:34:07 +00:00
e8883de2c6
minor update regarding unicode decoding of supplied arguments
2011-01-29 23:01:39 +00:00
6cc69f5e16
now --technique is appliable also after the injections have been identified
2011-01-24 16:47:24 +00:00
30d6791968
update regarding time based data retrieval
2011-01-16 17:52:42 +00:00
fb9d7cdfaa
refactoring, code clearing and removal of obsolete switch --longest-common
2011-01-14 14:37:03 +00:00
2f5995a7eb
Added generic and mysql UNION tests from 1 to 25 columns.
...
Adapted config file and command line removing now outdated --union-test switch.
Minor bug fix.
Minor code refactoring.
Got rid of some debug messages, standardized logging of UNION tests.
2011-01-11 22:56:21 +00:00
300128042c
First big commit to move UNION query tests to detection phase - there are some improvements and tuning to do yet though.
...
Major refactoring to Agent.payload() method.
Minor bug fixes, some code refactoring and a lot of core adjustments here and there.
Added more checks for injection in GROUP BY and ORDER BY.
2011-01-11 22:18:47 +00:00
017ea9e686
update
2010-12-23 14:06:22 +00:00
19d8733e9a
this is strictly for educational purposes
2010-12-20 17:30:47 +00:00
10a7a2dfb2
kids, don't use this at home
2010-12-20 10:13:14 +00:00
5fb04515d3
Added hidden (for the moment) switch --technique
2010-12-09 13:47:17 +00:00
8b9706656e
Got rid of unreliable 'ORDER BY' technique to detect UNION query SQL injection, consequently switch --union-tech has gone now.
...
Minor code refactoring too.
2010-11-29 17:18:38 +00:00
c22338ce90
Removed --error-test, --stacked-test and --time-test switches and adapted the code accordingly. This is due to the fact that the new XML based detection engine already supports all of those tests (and more).
2010-11-29 11:47:58 +00:00
7e3b24afe6
Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.
...
All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 18:10:54 +00:00
c23126547e
Improved --union-cols to accept a range to test for union SQL injection. By default it is 1-20.
2010-11-19 15:48:24 +00:00
ad17e9ed2a
Added new switch --union-char to be able to provide the character used in union-test and exploit (default is still NULL, but can be any)
2010-11-19 14:56:20 +00:00
17486e472a
Proper english (--postfix is now --suffix) and --string/--regexp does not necessarily need to match into the original response body, it might well be in the injected True condition only!
2010-11-17 22:00:09 +00:00
76c3f5768b
cosmetics
2010-11-17 09:12:48 +00:00
cccb565859
cosmetics
2010-11-16 14:11:32 +00:00
Bernardo Damele