Skip to content

Commit d305183

Browse files
bdamelebdamele
committed
More updates to user's manual
1 parent be11e25 commit d305183

3 files changed

Lines changed: 139 additions & 9 deletions

File tree

‎doc/README.html‎

Lines changed: 68 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -937,7 +937,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
937937
These options can be used to tweak testing of specific SQL injection
938938
techniques.
939939

940-
--technique=TECH SQL injection techniques to test for (default all)
940+
--technique=TECH SQL injection techniques to test for (default BEUST)
941941
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
942942
--union-cols=UCOLS Range of columns to test for UNION query SQL injection
943943
--union-char=UCHAR Character to use for bruteforcing number of columns
@@ -1844,14 +1844,31 @@ <H3>Number of columns in UNION query SQL injection</H3>
18441844

18451845
<P>Switch: <CODE>-</CODE><CODE>-union-cols</CODE></P>
18461846

1847-
<P>TODO</P>
1847+
<P>By default sqlmap tests for UNION query SQL injection technique using 1 to
1848+
10 columns. However, this range can be increased up to 50 columns by
1849+
providing an higher <CODE>-</CODE>-<CODE>level</CODE> value. See the relevant
1850+
paragraph for details.</P>
1851+
1852+
<P>You can manually tell sqlmap to test for this type of SQL injection with a
1853+
specific range of columns by providing the tool with the
1854+
<CODE>-</CODE><CODE>-union-cols</CODE> switch followed by a range of integers. For
1855+
instance, <CODE>12-16</CODE> means tests for UNION query SQL injection by
1856+
using 12 up to 16 columns.</P>
18481857

18491858

18501859
<H3>Character to use to test for UNION query SQL injection</H3>
18511860

18521861
<P>Switch: <CODE>-</CODE><CODE>-union-char</CODE></P>
18531862

1854-
<P>TODO</P>
1863+
<P>By default sqlmap tests for UNION query SQL injection technique using
1864+
<CODE>NULL</CODE> character. However, by providing an higher
1865+
<CODE>-</CODE>-<CODE>level</CODE> value sqlmap will performs tests also with a
1866+
random number because there are some corner cases where UNION query tests
1867+
with <CODE>NULL</CODE> fail whereas with a random integer they succeed.</P>
1868+
1869+
<P>You can manually tell sqlmap to test for this type of SQL injection with a
1870+
specific character by providing the tool with the
1871+
<CODE>-</CODE><CODE>-union-char</CODE> switch followed by a string.</P>
18551872

18561873

18571874
<H2><A NAME="ss5.8">5.8</A> <A HREF="#toc5.8">Fingerprint</A>
@@ -2279,14 +2296,60 @@ <H3>Brute force tables names</H3>
22792296

22802297
<P>Switches: <CODE>-</CODE><CODE>-common-tables</CODE></P>
22812298

2282-
<P>TODO</P>
2299+
<P>There are cases where <CODE>-</CODE>-<CODE>tables</CODE> switch can not be used to
2300+
retrieve the databases' table names. These cases usually fit into one
2301+
of the following categories:</P>
2302+
<P>
2303+
<UL>
2304+
<LI>The database management system is MySQL <B>&lt; 5.0</B> where
2305+
<CODE>information_schema</CODE> is not available.</LI>
2306+
<LI>The database management system is Microsoft Access where there TODO.</LI>
2307+
<LI>The session user does not have read privileges against the system
2308+
table storing the scheme of the databases.</LI>
2309+
</UL>
2310+
</P>
2311+
2312+
<P>If any of the first two cases apply and you provided the
2313+
<CODE>-</CODE>-<CODE>tables</CODE> switch, sqlmap will prompt you with a question
2314+
to fall back to this technique.
2315+
Either of these cases apply to your situation, sqlmap can possibly still
2316+
identify some existing tables if you provide it with the
2317+
<CODE>-</CODE><CODE>-common-tables</CODE> switch. sqlmap will perform a
2318+
brute-force attack in order to detect the existence of common tables
2319+
across the DBMS.</P>
2320+
2321+
<P>The list of common table names is <CODE>txt/common-tables.txt</CODE> and you
2322+
can edit it as you wish.</P>
22832323

22842324

22852325
<H3>Brute force columns names</H3>
22862326

22872327
<P>Switches: <CODE>-</CODE><CODE>-common-columns</CODE></P>
22882328

2289-
<P>TODO</P>
2329+
<P>As per tables, there are cases where <CODE>-</CODE>-<CODE>columns</CODE> switch
2330+
can not be used to retrieve the databases' tables' column names. These
2331+
cases usually fit into one of the following categories:</P>
2332+
<P>
2333+
<UL>
2334+
<LI>The database management system is MySQL <B>&lt; 5.0</B> where
2335+
<CODE>information_schema</CODE> is not available.</LI>
2336+
<LI>The database management system is Microsoft Access where there TODO.</LI>
2337+
<LI>The session user does not have read privileges against the system
2338+
table storing the scheme of the databases.</LI>
2339+
</UL>
2340+
</P>
2341+
2342+
<P>If any of the first two cases apply and you provided the
2343+
<CODE>-</CODE>-<CODE>columns</CODE> switch, sqlmap will prompt you with a question
2344+
to fall back to this technique.
2345+
Either of these cases apply to your situation, sqlmap can possibly still
2346+
identify some existing tables if you provide it with the
2347+
<CODE>-</CODE><CODE>-common-columns</CODE> switch. sqlmap will perform a
2348+
brute-force attack in order to detect the existence of common columns
2349+
across the DBMS.</P>
2350+
2351+
<P>The list of common table names is <CODE>txt/common-columns.txt</CODE> and you
2352+
can edit it as you wish.</P>
22902353

22912354

22922355
<H2><A NAME="ss5.11">5.11</A> <A HREF="#toc5.11">User-defined function injection</A>

‎doc/README.pdf‎

3.16 KB
Binary file not shown.

‎doc/README.sgml‎

Lines changed: 71 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1841,7 +1841,17 @@ By default delay is set to <bf>5 seconds</bf>.
18411841
Switch: <tt>-</tt><tt>-union-cols</tt>
18421842

18431843
<p>
1844-
TODO
1844+
By default sqlmap tests for UNION query SQL injection technique using 1 to
1845+
10 columns. However, this range can be increased up to 50 columns by
1846+
providing an higher <tt>-</tt>-<tt>level</tt> value. See the relevant
1847+
paragraph for details.
1848+
1849+
<p>
1850+
You can manually tell sqlmap to test for this type of SQL injection with a
1851+
specific range of columns by providing the tool with the
1852+
<tt>-</tt><tt>-union-cols</tt> switch followed by a range of integers. For
1853+
instance, <tt>12-16</tt> means tests for UNION query SQL injection by
1854+
using 12 up to 16 columns.
18451855

18461856

18471857
<sect2>Character to use to test for UNION query SQL injection
@@ -1850,7 +1860,16 @@ TODO
18501860
Switch: <tt>-</tt><tt>-union-char</tt>
18511861

18521862
<p>
1853-
TODO
1863+
By default sqlmap tests for UNION query SQL injection technique using
1864+
<tt>NULL</tt> character. However, by providing an higher
1865+
<tt>-</tt>-<tt>level</tt> value sqlmap will performs tests also with a
1866+
random number because there are some corner cases where UNION query tests
1867+
with <tt>NULL</tt> fail whereas with a random integer they succeed.
1868+
1869+
<p>
1870+
You can manually tell sqlmap to test for this type of SQL injection with a
1871+
specific character by providing the tool with the
1872+
<tt>-</tt><tt>-union-char</tt> switch followed by a string.
18541873

18551874

18561875
<sect1>Fingerprint
@@ -2331,7 +2350,31 @@ These options can be used to run brute force checks.
23312350
Switches: <tt>-</tt><tt>-common-tables</tt>
23322351

23332352
<p>
2334-
TODO
2353+
There are cases where <tt>-</tt>-<tt>tables</tt> switch can not be used to
2354+
retrieve the databases' table names. These cases usually fit into one
2355+
of the following categories:
2356+
2357+
<itemize>
2358+
<item>The database management system is MySQL <bf>&lt; 5.0</bf> where
2359+
<tt>information_schema</tt> is not available.
2360+
<item>The database management system is Microsoft Access where there TODO.
2361+
<item>The session user does not have read privileges against the system
2362+
table storing the scheme of the databases.
2363+
</itemize>
2364+
2365+
<p>
2366+
If any of the first two cases apply and you provided the
2367+
<tt>-</tt>-<tt>tables</tt> switch, sqlmap will prompt you with a question
2368+
to fall back to this technique.
2369+
Either of these cases apply to your situation, sqlmap can possibly still
2370+
identify some existing tables if you provide it with the
2371+
<tt>-</tt><tt>-common-tables</tt> switch. sqlmap will perform a
2372+
brute-force attack in order to detect the existence of common tables
2373+
across the DBMS.
2374+
2375+
<p>
2376+
The list of common table names is <tt>txt/common-tables.txt</tt> and you
2377+
can edit it as you wish.
23352378

23362379

23372380
<sect2>Brute force columns names
@@ -2340,7 +2383,31 @@ TODO
23402383
Switches: <tt>-</tt><tt>-common-columns</tt>
23412384

23422385
<p>
2343-
TODO
2386+
As per tables, there are cases where <tt>-</tt>-<tt>columns</tt> switch
2387+
can not be used to retrieve the databases' tables' column names. These
2388+
cases usually fit into one of the following categories:
2389+
2390+
<itemize>
2391+
<item>The database management system is MySQL <bf>&lt; 5.0</bf> where
2392+
<tt>information_schema</tt> is not available.
2393+
<item>The database management system is Microsoft Access where there TODO.
2394+
<item>The session user does not have read privileges against the system
2395+
table storing the scheme of the databases.
2396+
</itemize>
2397+
2398+
<p>
2399+
If any of the first two cases apply and you provided the
2400+
<tt>-</tt>-<tt>columns</tt> switch, sqlmap will prompt you with a question
2401+
to fall back to this technique.
2402+
Either of these cases apply to your situation, sqlmap can possibly still
2403+
identify some existing tables if you provide it with the
2404+
<tt>-</tt><tt>-common-columns</tt> switch. sqlmap will perform a
2405+
brute-force attack in order to detect the existence of common columns
2406+
across the DBMS.
2407+
2408+
<p>
2409+
The list of common table names is <tt>txt/common-columns.txt</tt> and you
2410+
can edit it as you wish.
23442411

23452412

23462413
<sect1>User-defined function injection

0 commit comments

Comments
 (0)