sqlmap

No entries match these filters. Clear filters

1. 1.0 Feb 27, 2016 · release notes

   sqlmap 1.0 adds multi-target scanning (-m), pivot-based dumping (--pivot-column), and SQLite session storage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.0 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 1.0

   └──▷ USE IT
   Scan a list of URLs from a file for SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. vulnerabilities
   shell copy

   sqlmap -m targets.txt

   • Adds -m option to scan multiple targets listed in a text file
   • Replaces old resume files with faster SQLite based session mechanism

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Old resume files are deprecated and replaced by SQLite based session mechanism, rendering previous session files incompatible.
2. 0.9 Apr 10, 2011 · release notes

   sqlmap 0.9 adds direct DB connections (-d), form parsing (--forms), and role enumeration.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.9

   • Adds -d option to directly connect to a database without exploiting SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does.
   • Adds --roles switch to enumerate roles on Oracle databases
   • Adds --replicate switch to replicate backend DBMS tables and entries into a local SQLite 3 database
   • Adds --search option to search for specific databases, tables, and columns during dump operations
   • Adds --forms switch to automatically parse and test HTML forms on the target URL

   +1 more show less

   • Adds --proxy-cred option to configure HTTP(s) proxy authentication credentials

   6 details in Everything

3. 0.8 Mar 14, 2010 · release notes

   v0.8 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./cert auth, --dump -C, --ignore-proxy, Burp scope, and HTTP decompression

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.8 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.8

   └──▷ USE IT
   Enumerate tables in all databases that specifically contain a password column
   shell copy

   sqlmap -u <url> --dump -C password

   Authenticate using an SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate for database access or proxy verification
   shell copy

   sqlmap -u <url> --auth-cert /path/to/cert.pem

   • Adds --auth-type NTLM for NTLM authentication via python-ntlm
   • Adds --auth-cert option for Certificate authentication
   • Adds --dump -C <columns> to enumerate and dump tables containing specific columns
   • Adds -C support in --columns to filter column enumeration by name pattern
   • Adds --ignore-proxy switch to bypass system default HTTP proxy

   +10 more show less

   • Adds --drop-set-cookie to ignore Set-Cookie headers in responses
   • Adds automatic decoding of deflate, gzip, and x-gzip HTTP responses
   • Adds --scope for regular expression based scope when parsing Burp/Web Scarab logs (-l)
   • Adds -r flag to load a single HTTP request from a text file
   • Adds --gpage option to specify which Google dork result page to parse with -g
   • Adds sys_fileread() user-defined function support for reading binary files via PostgreSQL (--read-file)
   • Adds takeover features support on PostgreSQL 8.4
   • Enhances --priv-esc to use Metasploit Meterpreter's getsystem command for SYSTEM elevation on Windows
   • Enhances --os-pwn to automatically upload and execute payloads via web backdoor when stacked queries are unsupported
   • Adds extra/cloak/cloak.py utility for encrypting/compressing executables to evade antivirus detection

   15 details in Everything

4. 0.6.4 Feb 3, 2009 · release notes

   sqlmap 0.6.4 adds --is-dba check and stacking support with --union-tech control

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6.4 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.6.4

   • Adds --is-dba option to determine if the current database user has administrator privileges
   • Enables stacked query execution for SQL data definition and manipulation statements via user-provided queries
   • Adds --union-tech option to select UNION-based column detection technique (NULL bruteforcing or ORDER BY clause bruteforcing)

   3 details in Everything

5. 0.6.3 Dec 18, 2008 · release notes

   Adds Burp/WebScarab log import via -l, stacked/time-based blind detection flags, and --delay/--headers tuning.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6.3 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.6.3

   └──▷ TRY IT
   Import potential vulnerable parameters from a WebScarab proxy log to scan automatically.
   copy

   $ ./sqlmap.py -l /path/to/webscarab/conversations/

   Force sqlmap to check for stacked query support and apply a 2-second delay between requests.
   copy

   $ ./sqlmap.py -u 'http://example.com/page?id=1' --stacked-test --delay 2

   Inject a custom User-Agent header while testing for time-based blind injection.
   copy

   $ ./sqlmap.py -u 'http://example.com/page?id=1' --time-test --headers 'User-Agent: MyBot/1.0'

   • Adds -l <filepath> option to import test targets directly from a Burp proxy or WebScarab conversations/ folder path
   • Adds --stacked-test option to detect support for stacked queries (multiple statements)
   • Adds --time-test option to verify if an injectable parameter is susceptible to time-based blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does.
   • Adds --delay # option to specify the seconds to wait between each HTTP request
   • Adds --headers option to provide extra HTTP headers for requests

   +1 more show less

   • Adds support for Partial UNION query SQL injection technique

   6 details in Everything

6. 0.6 Sep 1, 2008 · release notes

   sqlmap 0.6 adds multithreading, OS/SQL shells, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy support and config file I/O

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.6

   • Added multithreading support via --thread to control the maximum number of concurrent HTTP requests
   • Implemented SQL shell functionality via --sql-shell subcommand for running SELECT statements during injection attacks
   • Added --os-shell option to execute operating system commands on MySQL targets with PHP write access
   • Added --privileges option to retrieve DBMS user privileges and check for administrator status
   • Added support (-c) to read options from a configuration file (e.g. sqlmap.conf) and --save to store current options

   +4 more show less

   • Added --update option to automatically update sqlmap to the latest stable version
   • Implemented support for HTTPS requests over HTTP(S) proxy
   • Added support to inject on Set-Cookie parameters in addition to GET/POST data
   • Enhanced logging with three additional verbosity levels to display HTTP sent and received traffic

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --sql-query option was previously called -e for the SQL query feature
7. 0.6.1 Aug 20, 2008 · release notes

   sqlmap 0.6.1 adds LIKE support, --start/--stop table dump bounds, and --batch mode

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6.1 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.6.1

   └──▷ USE IT
   Dump a specific range of rows from a table to avoid timeouts or focus on critical data.
   shell copy

   sqlmap -u "http://example.com/page?id=1" --table users --start 10 --stop 20

   Run sqlmap in the background or within another automation tool without user interaction.
   shell copy

   sqlmap -u "http://example.com/page?id=1" --batch --dbs

   • Added --start and --stop options to limit the range of table entries dumped by sqlmap.
   • Added --batch option for non-interactive/batch-mode execution.
   • Implemented detection and injection support for SQL LIKE statements.

   3 details in Everything

8. 0.5 Nov 4, 2007 · release notes

   sqlmap 0.5 adds Oracle support, --dump-all, and cookie/User-Agent injection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.5 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.5

   • Adds support for Oracle database management system
   • Implements --dump-all functionality to dump entire DBMS data from all databases tables
   • Adds support for SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. on HTTP Cookie and User-Agent headers
   • Added support to exclude DBMS system databases' when enumeration tables and dumping their entries (--exclude-sysdbs)

   4 details in Everything

9. 0.4 Jun 15, 2007 · release notes

   sqlmap 0.4 adds DBMS fingerprinting, --eta, password hash extraction, Google dorking -g, HTTP auth flags, and UNION inband injection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.4 https://github.com/sqlmapproject/sqlmap.git
   # already have the repo? check out this version:
   $ git checkout 0.4

   └──▷ TRY IT
   Use Google dorking to find vulnerable targets and run a specific injection test on them.
   copy

   $ sqlmap -g "inurl:products.php?id=1" --dbs

   Extract password hashes from a MySQL target to attempt offline cracking.
   copy

   $ sqlmap -u "http://example.com/vuln?id=1" --dbs --passwords -D mysql

   Enable inband SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. using UNION queries with comment characters.
   copy

   $ sqlmap -u "http://example.com/vuln?id=1" --union-use --comments --tech MySQL

   • Added Google dorking feature (-g) to take advantage of Google results affected by SQL injection to perform other command line argument on their DBMS
   • Added Microsoft SQL Server extensive DBMS fingerprint checks based upon accurate @@version parsing matching on an XML file to get also the exact patching level of the DBMS
   • Added DBMS fingerprint based also upon HTML error messages parsing defined in lib/parser.py which reads an XML file defining default error messages for each supported DBMS
   • Added support for query ETA (Estimated Time of Arrival) real time calculation (--eta)
   • Added support to extract database management system users password hash on MySQL and PostgreSQL (--passwords)

   +8 more show less

   • Implemented Google dorking feature (-g) to take advantage of Google results affected by SQL injection to perform other command line argument on their DBMS
   • Added support for more than one parameter in -p command line option
   • Added support for HTTP Basic and Digest authentication methods (--basic-auth and --digest-auth)
   • Added the command line option --remote-dbms to manually specify the remote DBMS
   • Major improvements in union.UnionCheck() and union.UnionUse() functions to make it possible to exploit inband SQL injection also with database comment characters (-- and #) in UNION query statements
   • Added the possibility to save the output into a file while performing the queries (-o OUTPUTFILE) so it is possible to stop and resume the same query output retrieving in a second time (--resume)
   • Added support to specify the database table column to enumerate (-C COL)
   • Added inband SQL injection (UNION query) support (--union-use)

   13 details in Everything

10. 0.3 Jan 20, 2007 · release notes

    Adds --union-check flag and MS SQL Server module support in sqlmap 0.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3 https://github.com/sqlmapproject/sqlmap.git
    # already have the repo? check out this version:
    $ git checkout 0.3

    └──▷ TRY IT
    Force sqlmap to verify the injection via UNION SELECT queries.
    copy

    $ sqlmap -u 'http://example.com/vuln?id=1' --union-check

    Pass a custom POST payload to test for injection.
    copy

    $ sqlmap -u 'http://example.com/vuln' --data 'id=1&submit=ok'

    Verify the injection point by checking for a specific response string.
    copy

    $ sqlmap -u 'http://example.com/vuln?id=1' --string 'Success'

    • Added module for MS SQL Server
    • Added --string option to match a specific string in the response page
    • Added --union-check flag to enable UNION-based injection checks
    • Added --data argument to pass POST request payloads

    4 details in Everything