News
- 9th of November 2008: sqlmap Subversion repository
is now online on
https://svn.sqlmap.org/sqlmap/trunk/sqlmap/.
You can checkout it if you want to give a try to the development version.
- 4th of November 2008: sqlmap 0.6.2 is out
with some major bugs fixed and a few minor enhancements.
Give it a try!
- 24th of October 2008: sqlmap auxiliary module
commited on the
official Metasploit Framework 3
Subversion
repository. Thanks Efrain
Torres!
- 20th of October 2008: sqlmap 0.6.1 is out
with the integration with Metasploit,
a few new features and some bugs fixed.
- 1st of September 2008: sqlmap 0.6 is out
with many new features, complete code refactoring and many bugs fixed.
Introduction
sqlmap is an automatic
SQL injection
tool developed in Python. Its goal is
to detect and take advantage of SQL injection vulnerabilities on web
applications. Once it detects one or more SQL injections on the target
host, the user can choose among a variety of options to perform an
extensive back-end database management system fingerprint, retrieve DBMS
session user and database, enumerate users, password hashes, privileges,
databases, dump entire or user's specific DBMS tables/columns, run his own
SQL SELECT statement, read specific files on the file system
and much more.
Features
Major features implemented in sqlmap include:
- Full support for MySQL, Oracle, PostgreSQL
and Microsoft SQL Server back-end database management systems.
Besides these four database management systems, sqlmap can also identify
Microsoft Access, DB2, Informix, Sybase and Interbase.
- Extensive back-end database management system fingerprint
based upon
inband error messages,
banner parsing,
functions output comparison and
specific features
such as MySQL comment injection. It is also possible to force the back-end
database management system name if you already know it.
- Full support for two SQL injection techniques: blind SQL
injection and inband SQL injection.
- Options to retrieve on all four back-end database management system
banner, current user, current database,
enumerate users, users password hashes, users
privileges, databases, tables, columns,
dump tables entries, dump whole database management
system and run your own SQL
SELECT statement.
- If the back-end database management system is MySQL it is also
possible to read a specific file content and in some
circumstances prompt for an interactive operating system shell
with TAB completion and history support.
- Automatically tests all provided GET parameters,
POST parameters, HTTP Cookie header values and HTTP
User-Agent header value to find the dynamic ones, which means
those that vary the HTTP response page content.
On the dynamic ones sqlmap automatically tests and detects the ones
affected by SQL injection. Each dynamic parameter is tested for
numeric, single quoted string, double quoted
string and all of these three datatypes with zero to two parenthesis
to correctly detect which is the
SELECT statement syntax to
perform further injections with. It is also possible to specify the
parameter(s) that you want to perform tests and use for injection on.
- Option to specify the maximum number of concurrent HTTP
requests to speed up the blind SQL injection algorithms
(multithreading).
- HTTP
Cookie header string support, useful when the
web application requires authentication based upon cookies and you have
such data or in case you just want to test for and exploit SQL injection
on such header.
- Automatically handle HTTP
Set-Cookie header from
target url, re-establishing of the session if it expires. Test and exploit
on these values is supported too.
- HTTP Basic and Digest authentications support.
- Anonymous HTTP proxy support to pass by the HTTP requests
to the target URL.
- Options to fake the HTTP
Referer header value and
the HTTP User-Agent header value specified by user or
randomly selected from a text file.
- Support to increase the verbosity level of output messages:
there exist six levels. The default level is 0 (silent) in which
only warnings, errors and tracebacks, if they occur, will be shown.
- Estimated time of arrival support for each query, updated
in real time while fetching the information to give to the user an
overview on how long it will take to retrieve the output.
- Support to save the session (queries and their output, even if
partially retrieved) in real time while fetching the data on a text file
and resume the injection from this file in a second time.
- Support to read options from a configuration INI file rather than
specify each time all of the options on the command line. Support also to
save command line options on a configuration INI file.
- Integration with other IT security related open source projects,
Metasploit and
w3af.
- PHP setting
magic_quotes_gpc bypass by encoding
every query string, between single quotes, with CHAR, or similar,
database management system function.
Download
sqlmap can be downloaded from its
SourceForge File List page.
It is available in various formats:
You can also checkout the source code from the sqlmap
Subversion
repository to give a try to the development release:
$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap/
Documentation
Mailing lists
sqlmap has two mailing lists hosted on SourceForge:
The sqlmap-users mailing list is the preferred way to ask questions,
report bugs, suggest new features and discuss with other users.
The mailing list is archived
online. To subscribe use the online
web form.
The sqlmap-devel mailing list is for advanced users and developers
who want to contribute to the sqlmap development and anyone with questions
or suggestions concerning the code base.
The mailing list is archived
online. To subscribe use the online
web form.
License
sqlmap is released under the terms of the
General Public License v2.
sqlmap is copyrighted by
Bernardo Damele A. G.
and
Daniele Bellucci.
Authors
Contribute
If you want to contribute to sqlmap development reporting a bug,
providing a patch, commenting on the code base or simply need to find help
to run sqlmap first refer to the sqlmap documentation,
then surf the sqlmap mailing lists online archives and
if you still have something to say, do that on the appropriate sqlmap
mailing list. If nobody gets back to you, then drop us
an e-mail.
Sponsorship
Donations
