diff --git a/doc/README.html b/doc/README.html index cba2fd39c..ecd79c802 100644 --- a/doc/README.html +++ b/doc/README.html @@ -937,7 +937,7 @@ Options: These options can be used to tweak testing of specific SQL injection techniques. - --technique=TECH SQL injection techniques to test for (default all) + --technique=TECH SQL injection techniques to test for (default BEUST) --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) --union-cols=UCOLS Range of columns to test for UNION query SQL injection --union-char=UCHAR Character to use for bruteforcing number of columns @@ -1844,14 +1844,31 @@ By default delay is set to 5 seconds.

Switch: --union-cols

-

TODO

+

By default sqlmap tests for UNION query SQL injection technique using 1 to +10 columns. However, this range can be increased up to 50 columns by +providing an higher --level value. See the relevant +paragraph for details.

+ +

You can manually tell sqlmap to test for this type of SQL injection with a +specific range of columns by providing the tool with the +--union-cols switch followed by a range of integers. For +instance, 12-16 means tests for UNION query SQL injection by +using 12 up to 16 columns.

Character to use to test for UNION query SQL injection

Switch: --union-char

-

TODO

+

By default sqlmap tests for UNION query SQL injection technique using +NULL character. However, by providing an higher +--level value sqlmap will performs tests also with a +random number because there are some corner cases where UNION query tests +with NULL fail whereas with a random integer they succeed.

+ +

You can manually tell sqlmap to test for this type of SQL injection with a +specific character by providing the tool with the +--union-char switch followed by a string.

5.8 Fingerprint @@ -2279,14 +2296,60 @@ This feature provides TAB completion and history support too.

Switches: --common-tables

-

TODO

+

There are cases where --tables switch can not be used to +retrieve the databases' table names. These cases usually fit into one +of the following categories:

+

+

+

+ +

If any of the first two cases apply and you provided the +--tables switch, sqlmap will prompt you with a question +to fall back to this technique. +Either of these cases apply to your situation, sqlmap can possibly still +identify some existing tables if you provide it with the +--common-tables switch. sqlmap will perform a +brute-force attack in order to detect the existence of common tables +across the DBMS.

+ +

The list of common table names is txt/common-tables.txt and you +can edit it as you wish.

Brute force columns names

Switches: --common-columns

-

TODO

+

As per tables, there are cases where --columns switch +can not be used to retrieve the databases' tables' column names. These +cases usually fit into one of the following categories:

+

+

+

+ +

If any of the first two cases apply and you provided the +--columns switch, sqlmap will prompt you with a question +to fall back to this technique. +Either of these cases apply to your situation, sqlmap can possibly still +identify some existing tables if you provide it with the +--common-columns switch. sqlmap will perform a +brute-force attack in order to detect the existence of common columns +across the DBMS.

+ +

The list of common table names is txt/common-columns.txt and you +can edit it as you wish.

5.11 User-defined function injection diff --git a/doc/README.pdf b/doc/README.pdf index bf6445c2a..daf2af846 100644 Binary files a/doc/README.pdf and b/doc/README.pdf differ diff --git a/doc/README.sgml b/doc/README.sgml index b5b7b65ea..efe75f155 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -1841,7 +1841,17 @@ By default delay is set to 5 seconds. Switch: --union-cols

-TODO +By default sqlmap tests for UNION query SQL injection technique using 1 to +10 columns. However, this range can be increased up to 50 columns by +providing an higher --level value. See the relevant +paragraph for details. + +

+You can manually tell sqlmap to test for this type of SQL injection with a +specific range of columns by providing the tool with the +--union-cols switch followed by a range of integers. For +instance, 12-16 means tests for UNION query SQL injection by +using 12 up to 16 columns. Character to use to test for UNION query SQL injection @@ -1850,7 +1860,16 @@ TODO Switch: --union-char

-TODO +By default sqlmap tests for UNION query SQL injection technique using +NULL character. However, by providing an higher +--level value sqlmap will performs tests also with a +random number because there are some corner cases where UNION query tests +with NULL fail whereas with a random integer they succeed. + +

+You can manually tell sqlmap to test for this type of SQL injection with a +specific character by providing the tool with the +--union-char switch followed by a string. Fingerprint @@ -2331,7 +2350,31 @@ These options can be used to run brute force checks. Switches: --common-tables

-TODO +There are cases where --tables switch can not be used to +retrieve the databases' table names. These cases usually fit into one +of the following categories: + + +The database management system is MySQL < 5.0 where +information_schema is not available. +The database management system is Microsoft Access where there TODO. +The session user does not have read privileges against the system +table storing the scheme of the databases. + + +

+If any of the first two cases apply and you provided the +--tables switch, sqlmap will prompt you with a question +to fall back to this technique. +Either of these cases apply to your situation, sqlmap can possibly still +identify some existing tables if you provide it with the +--common-tables switch. sqlmap will perform a +brute-force attack in order to detect the existence of common tables +across the DBMS. + +

+The list of common table names is txt/common-tables.txt and you +can edit it as you wish. Brute force columns names @@ -2340,7 +2383,31 @@ TODO Switches: --common-columns

-TODO +As per tables, there are cases where --columns switch +can not be used to retrieve the databases' tables' column names. These +cases usually fit into one of the following categories: + + +The database management system is MySQL < 5.0 where +information_schema is not available. +The database management system is Microsoft Access where there TODO. +The session user does not have read privileges against the system +table storing the scheme of the databases. + + +

+If any of the first two cases apply and you provided the +--columns switch, sqlmap will prompt you with a question +to fall back to this technique. +Either of these cases apply to your situation, sqlmap can possibly still +identify some existing tables if you provide it with the +--common-columns switch. sqlmap will perform a +brute-force attack in order to detect the existence of common columns +across the DBMS. + +

+The list of common table names is txt/common-columns.txt and you +can edit it as you wish. User-defined function injection