Is your feature request related to a problem? Please describe.
When it has been identified that the FILE privilege is available you often want to start reading files of the web application but you don't always know the web server document root.
If you don't know it you will need to bruteforce it which requires running sqlmap for each potential root path.
python sqlmap.py -r req -p id --technique U --file-read=/var/www/index.php
python sqlmap.py -r req -p id --technique U --file-read=/var/www/html/index.php
python sqlmap.py -r req -p id --technique U --file-read=/var/www/htdocs/index.php
...
Describe the solution you'd like
It would be nice to have an option for some kind of path prefix when trying to read file similar to when trying to run --os-shell.
do you want sqlmap to further try to provoke the full path disclosure? [Y/n]
[16:57:59] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
Another solution would be to have an option to find the web root. You could pass it the path of a known file of the web application. sqlmap would then try to read the file by bruteforcing the web server root.
Is your feature request related to a problem? Please describe.
When it has been identified that the
FILEprivilege is available you often want to start reading files of the web application but you don't always know the web server document root.If you don't know it you will need to bruteforce it which requires running sqlmap for each potential root path.
Describe the solution you'd like
It would be nice to have an option for some kind of path prefix when trying to read file similar to when trying to run
--os-shell.Another solution would be to have an option to find the web root. You could pass it the path of a known file of the web application. sqlmap would then try to read the file by bruteforcing the web server root.