|
| 1 | +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> |
| 2 | +<HTML> |
| 3 | +<HEAD> |
| 4 | + <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.66"> |
| 5 | + <TITLE>sqlmap - Frequently Asked Questions</TITLE> |
| 6 | +</HEAD> |
| 7 | +<BODY> |
| 8 | +<H1>sqlmap - Frequently Asked Questions</H1> |
| 9 | + |
| 10 | +<H2>by |
| 11 | +<A HREF="mailto:bernardo.damele@gmail.com">Bernardo Damele A. G.</A>, |
| 12 | +<A HREF="mailto:miroslav.stampar@gmail.com">Miroslav Stampar</A></H2> |
| 13 | +<HR> |
| 14 | +<EM>This document contains frequently asked questions for |
| 15 | +<A HREF="http://www.sqlmap.org">sqlmap</A>.</EM> |
| 16 | +<HR> |
| 17 | +<P> |
| 18 | +<H2><A NAME="toc1">1.</A> <A HREF="FAQ.html#s1">Frequently Asked Questions</A></H2> |
| 19 | + |
| 20 | +<UL> |
| 21 | +<LI><A NAME="toc1.1">1.1</A> <A HREF="FAQ.html#ss1.1">What is sqlmap?</A> |
| 22 | +<LI><A NAME="toc1.2">1.2</A> <A HREF="FAQ.html#ss1.2">How do I execute sqlmap?</A> |
| 23 | +<LI><A NAME="toc1.3">1.3</A> <A HREF="FAQ.html#ss1.3">Can I integrate sqlmap with a security tool I am developing?</A> |
| 24 | +<LI><A NAME="toc1.4">1.4</A> <A HREF="FAQ.html#ss1.4">How can I integrate sqlmap with my own tool?</A> |
| 25 | +<LI><A NAME="toc1.5">1.5</A> <A HREF="FAQ.html#ss1.5">Will you support other database management systems?</A> |
| 26 | +<LI><A NAME="toc1.6">1.6</A> <A HREF="FAQ.html#ss1.6">How can I occasionally contribute?</A> |
| 27 | +<LI><A NAME="toc1.7">1.7</A> <A HREF="FAQ.html#ss1.7">Can I actively contribute in the long-term development?</A> |
| 28 | +<LI><A NAME="toc1.8">1.8</A> <A HREF="FAQ.html#ss1.8">How can I support the development?</A> |
| 29 | +<LI><A NAME="toc1.9">1.9</A> <A HREF="FAQ.html#ss1.9">Can you hack a site for me?</A> |
| 30 | +<LI><A NAME="toc1.10">1.10</A> <A HREF="FAQ.html#ss1.10">When sqlmap will switch to the Python 3?</A> |
| 31 | +<LI><A NAME="toc1.11">1.11</A> <A HREF="FAQ.html#ss1.11">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A> |
| 32 | +<LI><A NAME="toc1.12">1.12</A> <A HREF="FAQ.html#ss1.12">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A> |
| 33 | +<LI><A NAME="toc1.13">1.13</A> <A HREF="FAQ.html#ss1.13">Why is sqlmap not able to get password hashes in some cases?</A> |
| 34 | +<LI><A NAME="toc1.14">1.14</A> <A HREF="FAQ.html#ss1.14">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A> |
| 35 | +<LI><A NAME="toc1.15">1.15</A> <A HREF="FAQ.html#ss1.15">sqlmap is retrieving weird characters for even simplest data (e.g. <CODE>--banner</CODE>)?</A> |
| 36 | +<LI><A NAME="toc1.16">1.16</A> <A HREF="FAQ.html#ss1.16">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A> |
| 37 | +<LI><A NAME="toc1.17">1.17</A> <A HREF="FAQ.html#ss1.17">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A> |
| 38 | +<LI><A NAME="toc1.18">1.18</A> <A HREF="FAQ.html#ss1.18">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A> |
| 39 | +<LI><A NAME="toc1.19">1.19</A> <A HREF="FAQ.html#ss1.19">sqlmap is not able to detect/exploit injection while other commercial tools are?</A> |
| 40 | +</UL> |
| 41 | + |
| 42 | +<HR> |
| 43 | +<H2><A NAME="s1">1.</A> <A HREF="#toc1">Frequently Asked Questions</A></H2> |
| 44 | + |
| 45 | +<H2><A NAME="ss1.1">1.1</A> <A HREF="#toc1.1">What is sqlmap?</A> |
| 46 | +</H2> |
| 47 | + |
| 48 | +<P>sqlmap is an open source penetration testing tool that automates the |
| 49 | +process of detecting and exploiting SQL injection flaws and taking over |
| 50 | +of database servers. It comes with a powerful detection engine, many niche |
| 51 | +features for the ultimate penetration tester and a broad range of switches |
| 52 | +lasting from database fingerprinting, over data fetching from the |
| 53 | +database, to accessing the underlying file system and executing commands |
| 54 | +on the operating system via out-of-band connections.</P> |
| 55 | + |
| 56 | +<H2><A NAME="ss1.2">1.2</A> <A HREF="#toc1.2">How do I execute sqlmap?</A> |
| 57 | +</H2> |
| 58 | + |
| 59 | +<P>If you are running on a Unix/Linux system type the following command |
| 60 | +from a terminal: |
| 61 | +<BLOCKQUOTE><CODE> |
| 62 | +<PRE> |
| 63 | +python sqlmap.py -h |
| 64 | +</PRE> |
| 65 | +</CODE></BLOCKQUOTE> |
| 66 | +</P> |
| 67 | + |
| 68 | +<P>If you are running on a Windows system type the following command |
| 69 | +from a terminal: |
| 70 | +<BLOCKQUOTE><CODE> |
| 71 | +<PRE> |
| 72 | +C:\Python26\python.exe sqlmap.py -h |
| 73 | +</PRE> |
| 74 | +</CODE></BLOCKQUOTE> |
| 75 | +</P> |
| 76 | + |
| 77 | +<P>Where <CODE>C:\Python26</CODE> is the path where you installed |
| 78 | +<A HREF="http://www.python.org">Python</A> <B>>= 2.6</B>.</P> |
| 79 | + |
| 80 | +<H2><A NAME="ss1.3">1.3</A> <A HREF="#toc1.3">Can I integrate sqlmap with a security tool I am developing?</A> |
| 81 | +</H2> |
| 82 | + |
| 83 | +<P>Yes. sqlmap is released under the terms of the GPLv2, which means that any |
| 84 | +derivative work must be distributed without further restrictions on the |
| 85 | +rights granted by the GPL itself. If this constitutes a problem, feel free |
| 86 | +to contact us so we can find a solution.</P> |
| 87 | + |
| 88 | +<H2><A NAME="ss1.4">1.4</A> <A HREF="#toc1.4">How can I integrate sqlmap with my own tool?</A> |
| 89 | +</H2> |
| 90 | + |
| 91 | +<P>TODO</P> |
| 92 | + |
| 93 | +<H2><A NAME="ss1.5">1.5</A> <A HREF="#toc1.5">Will you support other database management systems?</A> |
| 94 | +</H2> |
| 95 | + |
| 96 | +<P>Yes. There are plans to support also IBM DB2, Informix and Ingres at some |
| 97 | +point.</P> |
| 98 | + |
| 99 | +<H2><A NAME="ss1.6">1.6</A> <A HREF="#toc1.6">How can I occasionally contribute?</A> |
| 100 | +</H2> |
| 101 | + |
| 102 | +<P>All help is greatly appreciated. First of all download the tool, make sure |
| 103 | +you are running the latest development version from the Subversion |
| 104 | +repository, read the user's manual carefully, have fun with it during your |
| 105 | +penetration tests. |
| 106 | +If you find bugs or have ideas for possible improvements, feel free to |
| 107 | +<A HREF="http://www.sqlmap.org/#ml">get in touch on the mailing list</A>. Many people have |
| 108 | +<A HREF="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/doc/THANKS">contributed</A> in different ways to the sqlmap development. |
| 109 | +<B>You</B> can be the next!</P> |
| 110 | + |
| 111 | +<H2><A NAME="ss1.7">1.7</A> <A HREF="#toc1.7">Can I actively contribute in the long-term development?</A> |
| 112 | +</H2> |
| 113 | + |
| 114 | +<P>Yes, we are looking for people who can write some clean Python code, are |
| 115 | +up to do security research, know about web application security, database |
| 116 | +assessment and takeover, software refactoring and are motivated to join |
| 117 | +the development team. |
| 118 | +If this sounds interesting to you, |
| 119 | +<A HREF="http://www.sqlmap.org/#developers">get in touch</A>!</P> |
| 120 | + |
| 121 | +<H2><A NAME="ss1.8">1.8</A> <A HREF="#toc1.8">How can I support the development?</A> |
| 122 | +</H2> |
| 123 | + |
| 124 | +<P>If you think that sqlmap is a great tool, it really played well during |
| 125 | +your penetration tests, or you simply like it, you, or your boss, can |
| 126 | +<A HREF="http://www.sqlmap.org/#donate">donate some money</A> to the developers via PayPal.</P> |
| 127 | + |
| 128 | +<H2><A NAME="ss1.9">1.9</A> <A HREF="#toc1.9">Can you hack a site for me?</A> |
| 129 | +</H2> |
| 130 | + |
| 131 | +<P><B>No</B>.</P> |
| 132 | + |
| 133 | +<H2><A NAME="ss1.10">1.10</A> <A HREF="#toc1.10">When sqlmap will switch to the Python 3?</A> |
| 134 | +</H2> |
| 135 | + |
| 136 | +<P>Currently there is no huge pressure on Python projects to switch to the new |
| 137 | +version of Python interpreter, as the process of switching, especially on |
| 138 | +larger projects can be cumbersome (due to the few backward incompatibilities). |
| 139 | +The switch will take place eventually, but currently it's a very low priority task.</P> |
| 140 | + |
| 141 | +<H2><A NAME="ss1.11">1.11</A> <A HREF="#toc1.11">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A> |
| 142 | +</H2> |
| 143 | + |
| 144 | +<P>sqlmap needs to properly decode page content to be able to properly |
| 145 | +detect and deal with internationalized characters. In some cases web developers |
| 146 | +are doing mistakes when declaring used web page charset (e.g. <CODE>iso_8859</CODE> instead |
| 147 | +of standardized name <CODE>iso-8859</CODE>), which can cause problems. As a failsafe mechanism |
| 148 | +we've incorporated heuristic detection engine |
| 149 | +<A HREF="http://chardet.feedparser.org/">chardet</A>, |
| 150 | +so in most cases sqlmap will deal with this kind of problems automatically. |
| 151 | +Nevertheless, you are strongly advised to report us back those typographic "mistakes" |
| 152 | +so we could handle them manually inside the code.</P> |
| 153 | + |
| 154 | +<P>Question(s): |
| 155 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/737">#1</A> |
| 156 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1232">#2</A> |
| 157 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1239">#3</A></P> |
| 158 | + |
| 159 | +<H2><A NAME="ss1.12">1.12</A> <A HREF="#toc1.12">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A> |
| 160 | +</H2> |
| 161 | + |
| 162 | +<P>Just put * to the place where sqlmap should check for injections in URI |
| 163 | +itself. In example: <CODE>./sqlmap.py -u "www.site.com/id1/1*/id2/2"</CODE> sqlmap |
| 164 | +will try to inject the payloads just at that place marked with * character.</P> |
| 165 | + |
| 166 | +<P>Question(s): |
| 167 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/731">#1</A> |
| 168 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/728">#2</A> |
| 169 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1258">#3</A></P> |
| 170 | + |
| 171 | +<H2><A NAME="ss1.13">1.13</A> <A HREF="#toc1.13">Why is sqlmap not able to get password hashes in some cases?</A> |
| 172 | +</H2> |
| 173 | + |
| 174 | +<P>You most probably don't have enough permissions for querying on a system |
| 175 | +table containing password hashes.</P> |
| 176 | + |
| 177 | +<P>Question(s): |
| 178 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/714">#1</A></P> |
| 179 | + |
| 180 | +<H2><A NAME="ss1.14">1.14</A> <A HREF="#toc1.14">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A> |
| 181 | +</H2> |
| 182 | + |
| 183 | +<P>Switch <CODE>-</CODE><CODE>-text-only</CODE> is used for removing non-textual data (tags, |
| 184 | +javascripts, styles,...) from the retrieved page content to further |
| 185 | +improve detection capabilities.</P> |
| 186 | + |
| 187 | +<P>Question(s): |
| 188 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/699">#1</A></P> |
| 189 | + |
| 190 | +<H2><A NAME="ss1.15">1.15</A> <A HREF="#toc1.15">sqlmap is retrieving weird characters for even simplest data (e.g. <CODE>--banner</CODE>)?</A> |
| 191 | +</H2> |
| 192 | + |
| 193 | +<P>If everything you retrieve from the target is garbled, then you are |
| 194 | +most probably dealing with false positive blind injection. Please |
| 195 | +report the problem to the |
| 196 | +<A HREF="mailto:dev@sqlmap.org">developers</A>.</P> |
| 197 | + |
| 198 | +<P>Question(s): |
| 199 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/686">#1</A> |
| 200 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1181">#2</A></P> |
| 201 | + |
| 202 | +<H2><A NAME="ss1.16">1.16</A> <A HREF="#toc1.16">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A> |
| 203 | +</H2> |
| 204 | + |
| 205 | +<P>There are few IDSes that filter out all sqlmap requests based on default |
| 206 | +User-Agent HTTP header used (e.g. <CODE>"User-agent: sqlmap/1.0-dev"</CODE>). To prevent this |
| 207 | +kind of situations you are advised to use switch <CODE>-</CODE><CODE>-random-agent</CODE>. |
| 208 | +If you are getting those kind of messages for all targets then you |
| 209 | +most probably need to properly set up your proxy settings (switches <CODE>-</CODE><CODE>-proxy</CODE> |
| 210 | +and/or <CODE>-</CODE><CODE>-ignore-proxy</CODE>)</P> |
| 211 | + |
| 212 | +<P>Question(s): |
| 213 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1241">#1</A></P> |
| 214 | + |
| 215 | +<H2><A NAME="ss1.17">1.17</A> <A HREF="#toc1.17">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A> |
| 216 | +and/or <CODE>-</CODE><CODE>-sql-shell</CODE>?</H2> |
| 217 | + |
| 218 | +<P>It is possible to use those commands, but only if the stacked injection is supported |
| 219 | +by the vulnerable target.</P> |
| 220 | + |
| 221 | +<P>Question(s): |
| 222 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1237">#1</A></P> |
| 223 | + |
| 224 | +<H2><A NAME="ss1.18">1.18</A> <A HREF="#toc1.18">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A> |
| 225 | +</H2> |
| 226 | + |
| 227 | +<P>You are most probably using outdated version of Python. sqlmap is generally |
| 228 | +supported by Python versions in range 2.5, 2.6 and 2.7, while you are strongly |
| 229 | +advised to use versions 2.6 and 2.7.</P> |
| 230 | + |
| 231 | +<P>Question(s): |
| 232 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1231">#1</A></P> |
| 233 | + |
| 234 | +<H2><A NAME="ss1.19">1.19</A> <A HREF="#toc1.19">sqlmap is not able to detect/exploit injection while other commercial tools are?</A> |
| 235 | +</H2> |
| 236 | + |
| 237 | +<P>Currently there are only two of us working on a pure good will and donating our |
| 238 | +free time to the community. If you are not willing to help us achive better tool |
| 239 | +you are strongly advised to buy those commercial tool(s) and just |
| 240 | +forget about the sqlmap.</P> |
| 241 | + |
| 242 | +<P>Question(s): |
| 243 | +<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/970">#1</A></P> |
| 244 | + |
| 245 | +</BODY> |
| 246 | +</HTML> |
0 commit comments