diff --git a/doc/ChangeLog b/doc/ChangeLog index 1a3cb438d..860921e1a 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -21,6 +21,8 @@ sqlmap (0.9-1) stable; urgency=low * Added support to fetch unicode data (Bernardo and Miroslav). * Added support to use persistent HTTP(s) connection for speed improvement, --keep-alive switch (Miroslav). + * Implemented several optimization switches to speed up the exploitation + of SQL injections (Bernardo and Miroslav). * Support to test and inject against HTTP Referer header (Miroslav). * Implemented HTTP(s) proxy authentication support, --proxy-cred switch (Miroslav). diff --git a/doc/README.html b/doc/README.html index ae8ab131e..ef1899571 100644 --- a/doc/README.html +++ b/doc/README.html @@ -359,8 +359,9 @@ list of specific parameter(s) to test.
  • Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection -techniques. It is also possible to specify the number of seconds to -hold between each HTTP(S) request. +techniques. Vice versa, it is also possible to specify the number of +seconds to hold between each HTTP(S) request. Others optimization switches +to speed up the exploitation are implemented as well.
  • HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have @@ -1051,21 +1052,28 @@ Options:

    This switch can be used to set the verbosity level of output messages. There exist seven levels of verbosity. -The default level is 1 in which information, warning, error and critical messages and Python tracebacks (if any occur) will be displayed.

    +The default level is 1 in which information, warning, error and +critical messages and Python tracebacks (if any occur) will be displayed.

    -

    A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice. -In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too.

    +

    A reasonable level of verbosity to further understand what sqlmap does +under the hood is level 2, primarily for the detection phase and +the take-over functionalities. Whereas if you want to see the SQL payloads +the tools sends, level 3 is your best choice. +In order to further debug potential bugs or unexpected behaviours, we +recommend you to set the verbosity to level 4 or above. This +level is recommended to be used when you feed the developers with a bug +report too.

    5.2 Target @@ -1078,7 +1086,7 @@ In order to further debug potential bugs or unexpected behaviours, we recommend

    Switch: -u or --url

    Run sqlmap against a single target URL. This switch requires an argument -which is the target URL in the form http(s)://targeturl/[...].

    +which is the target URL in the form http(s)://targeturl[:port]/[...].

    Parse targets from Burp or WebScarab proxy logs

    @@ -1441,7 +1449,7 @@ it.

    Switch: -o

    -

    This switch is an alias that implicitly sets the following:

    +

    This switch is an alias that implicitly sets the following switches:

    -

    Read below for details about every single switch.

    +

    Read below for details about each switch.

    Output prediction

    @@ -2654,12 +2662,15 @@ counts the number of retrieved output characters.

    version directly from the subversion repository. You obviously need Internet access.

    -

    If, for any reason, this operation fails, try with a manual svn -update from your sqlmap working copy. It will perform the exact same -operation of switch --update. +

    If, for any reason, this operation fails, run svn update from +your sqlmap working copy. It will perform the exact same operation of +switch --update. If you are running sqlmap on Windows, you can use the TartoiseSVN client -by right-clicking in Windows Explorer into your local sqlmap working copy -and Update.

    +by right-clicking in Windows Explorer into your sqlmap working copy and +clicking on Update.

    + +

    This is strongly recommended before reporting any bug to the +mailing lists.

    Save options in a configuration INI file

    diff --git a/doc/README.pdf b/doc/README.pdf index c5eecbed3..8652d3735 100644 Binary files a/doc/README.pdf and b/doc/README.pdf differ diff --git a/doc/README.sgml b/doc/README.sgml index 65929b3f2..1163863a8 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -287,8 +287,9 @@ list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection -techniques. It is also possible to specify the number of seconds to -hold between each HTTP(S) request. +techniques. Vice versa, it is also possible to specify the number of +seconds to hold between each HTTP(S) request. Others optimization switches +to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have @@ -964,21 +965,28 @@ Switch: -v

    This switch can be used to set the verbosity level of output messages. There exist seven levels of verbosity. -The default level is 1 in which information, warning, error and critical messages and Python tracebacks (if any occur) will be displayed. +The default level is 1 in which information, warning, error and +critical messages and Python tracebacks (if any occur) will be displayed. -0: Show only Python tracebacks, error and critical messages. -1: Show also information and warning messages. -2: Show also debug messages. -3: Show also payloads injected. -4: Show also HTTP requests. -5: Show also HTTP responses' headers. -6: Show also HTTP responses' page content. +0: Show only Python tracebacks, error and critical messages. +1: Show also information and warning messages. +2: Show also debug messages. +3: Show also payloads injected. +4: Show also HTTP requests. +5: Show also HTTP responses' headers. +6: Show also HTTP responses' page content.

    -A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice. -In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too. +A reasonable level of verbosity to further understand what sqlmap does +under the hood is level 2, primarily for the detection phase and +the take-over functionalities. Whereas if you want to see the SQL payloads +the tools sends, level 3 is your best choice. +In order to further debug potential bugs or unexpected behaviours, we +recommend you to set the verbosity to level 4 or above. This +level is recommended to be used when you feed the developers with a bug +report too. Target @@ -993,7 +1001,7 @@ Switch: -u or --url

    Run sqlmap against a single target URL. This switch requires an argument -which is the target URL in the form http(s)://targeturl/[...]. +which is the target URL in the form http(s)://targeturl[:port]/[...]. Parse targets from Burp or WebScarab proxy logs @@ -1395,7 +1403,7 @@ These switches can be used to optimize the performance of sqlmap. Switch: -o

    -This switch is an alias that implicitly sets the following: +This switch is an alias that implicitly sets the following switches: --keep-alive @@ -1405,7 +1413,7 @@ This switch is an alias that implicitly sets the following:

    -Read below for details about every single switch. +Read below for details about each switch. Output prediction @@ -2742,12 +2750,16 @@ version directly from the subversion repository. You obviously need Internet access.

    -If, for any reason, this operation fails, try with a manual svn -update from your sqlmap working copy. It will perform the exact same -operation of switch --update. +If, for any reason, this operation fails, run svn update from +your sqlmap working copy. It will perform the exact same operation of +switch --update. If you are running sqlmap on Windows, you can use the TartoiseSVN client -by right-clicking in Windows Explorer into your local sqlmap working copy -and Update. +by right-clicking in Windows Explorer into your sqlmap working copy and +clicking on Update. + +

    +This is strongly recommended before reporting any bug to the +. Save options in a configuration INI file