From 021fce560106619459afd0b668dbf7f4c988fdb8 Mon Sep 17 00:00:00 2001
From: Bernardo Damele
Date: Mon, 28 Feb 2011 15:23:05 +0000
Subject: [PATCH] Should be done with the ChangeLog - ready for 0.9. Minor
adjustments to user's manual too.
---
doc/ChangeLog | 2 +
doc/README.html | 51 +-
doc/README.pdf | 4362 ++++++++++++++++++++++++-----------------------
doc/README.sgml | 52 +-
4 files changed, 2249 insertions(+), 2218 deletions(-)
diff --git a/doc/ChangeLog b/doc/ChangeLog
index 1a3cb438d..860921e1a 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -21,6 +21,8 @@ sqlmap (0.9-1) stable; urgency=low
* Added support to fetch unicode data (Bernardo and Miroslav).
* Added support to use persistent HTTP(s) connection for speed
improvement, --keep-alive switch (Miroslav).
+ * Implemented several optimization switches to speed up the exploitation
+ of SQL injections (Bernardo and Miroslav).
* Support to test and inject against HTTP Referer header (Miroslav).
* Implemented HTTP(s) proxy authentication support, --proxy-cred switch
(Miroslav).
diff --git a/doc/README.html b/doc/README.html
index ae8ab131e..ef1899571 100644
--- a/doc/README.html
+++ b/doc/README.html
@@ -359,8 +359,9 @@ list of specific parameter(s) to test.
Option to specify the maximum number of concurrent HTTP(S)
requests (multi-threading) to speed up the blind SQL injection
-techniques. It is also possible to specify the number of seconds to
-hold between each HTTP(S) request.
+techniques. Vice versa, it is also possible to specify the number of
+seconds to hold between each HTTP(S) request. Others optimization switches
+to speed up the exploitation are implemented as well.
HTTP Cookie header string support, useful when the
web application requires authentication based upon cookies and you have
@@ -1051,21 +1052,28 @@ Options:
This switch can be used to set the verbosity level of output messages.
There exist seven levels of verbosity.
-The default level is 1 in which information, warning, error and critical messages and Python tracebacks (if any occur) will be displayed.
+The default level is 1 in which information, warning, error and
+critical messages and Python tracebacks (if any occur) will be displayed.
-0: Show only Python tracebacks, error and critical messages.
-1: Show also information and warning messages.
-2: Show also debug messages.
-3: Show also payloads injected.
-4: Show also HTTP requests.
-5: Show also HTTP responses' headers.
-6: Show also HTTP responses' page content.
+- 0: Show only Python tracebacks, error and critical messages.
+- 1: Show also information and warning messages.
+- 2: Show also debug messages.
+- 3: Show also payloads injected.
+- 4: Show also HTTP requests.
+- 5: Show also HTTP responses' headers.
+- 6: Show also HTTP responses' page content.
-A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice.
-In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too.
+A reasonable level of verbosity to further understand what sqlmap does
+under the hood is level 2, primarily for the detection phase and
+the take-over functionalities. Whereas if you want to see the SQL payloads
+the tools sends, level 3 is your best choice.
+In order to further debug potential bugs or unexpected behaviours, we
+recommend you to set the verbosity to level 4 or above. This
+level is recommended to be used when you feed the developers with a bug
+report too.
5.2 Target
@@ -1078,7 +1086,7 @@ In order to further debug potential bugs or unexpected behaviours, we recommend
Switch: -u or --url
Run sqlmap against a single target URL. This switch requires an argument
-which is the target URL in the form http(s)://targeturl/[...].
+which is the target URL in the form http(s)://targeturl[:port]/[...].
Parse targets from Burp or WebScarab proxy logs
@@ -1441,7 +1449,7 @@ it.
Switch: -o
-This switch is an alias that implicitly sets the following:
+This switch is an alias that implicitly sets the following switches:
--keep-alive
@@ -1451,7 +1459,7 @@ it.
-Read below for details about every single switch.
+Read below for details about each switch.
Output prediction
@@ -2654,12 +2662,15 @@ counts the number of retrieved output characters.
version directly from the subversion repository. You obviously need
Internet access.
-If, for any reason, this operation fails, try with a manual svn
-update from your sqlmap working copy. It will perform the exact same
-operation of switch --update.
+
If, for any reason, this operation fails, run svn update from
+your sqlmap working copy. It will perform the exact same operation of
+switch --update.
If you are running sqlmap on Windows, you can use the TartoiseSVN client
-by right-clicking in Windows Explorer into your local sqlmap working copy
-and Update.
+by right-clicking in Windows Explorer into your sqlmap working copy and
+clicking on Update.
+
+This is strongly recommended before reporting any bug to the
+mailing lists.
Save options in a configuration INI file
diff --git a/doc/README.pdf b/doc/README.pdf
index c5eecbed3..8652d3735 100644
--- a/doc/README.pdf
+++ b/doc/README.pdf
@@ -1925,22 +1925,18 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
656 0 obj <<
-/Length 2782
+/Length 2848
/Filter /FlateDecode
>>
stream
-xÚ½ZI“Û¶¾Ï¯Ð-T•Åp¸¼[œØ~NÙI왼ªWv�IŒ)Q&ÁYþ}ºÑ
nÃ;åå"‚X½~ÝT°Ø/‚Å‹‹�!<ƒE¸H£Eš~˜ç‹ÍñâÝ_Ábý¿._äÙâÆÎ:.D’Á³\\^¼¹xzuñãó(\ä~žDÉâjG{Ä~ËÅÕvñ΋üå*Ë…÷|™'žV¦u³üëêן‡r°L$±D°¯]”ጋ€ \¬DœùacÃ"§Iªlªå*N2o«ß±8i|K=E�µÞ·¥ªWúöG6Eu¢áµjô–¦4›ê¼\E™Ç+ÍA)z¶<Æø¬b«OKXbŠÝõÜŠ
öèµZ†ÞŽšæ ©qVu·‘Ún‘Í'À¾pW¸ç*Œý$ÊènF7Æ1ø%üZa…¾Ì™!ïƒ0�®ò˜–0‹¯–YìÁ)@p×;×Þá®·%ñŒ¤šd~¤ní‹gW3"Œ2?ë÷‡+«£6ºnžÌì'¥ŸˆÄÍýã÷˹
c釳ûD"¼ÿ^]ý1³s–ÁÎÒú¥yÕ‡BÏ gÝZmuMì¸^J
-ÖêOœ–CÓÿ³ÑõÊ
-s%BéçiÆ2eñü´ÍbÌ%0/H¦”Äb@ ½ªÓ–¹Ÿ¦�!½Õ;]ÃV3ø©Ÿq¢U|qOñEÞÓ&VV…¡—Ë7¯xÁéo½1dw¸m[žt˜Ca&ü0ŠÆZea
-Ý€ËBx/qÇ8&cŒÐ¦íЫh€Œ·ã^ã�¦i†G¶í
=Š›êxT«F£Jk–ÐY
Wíh·vÞè`6ÔOš½IÁFý>�¾4ÐiGÅ··äßÏÌä ¡Sƒ”hO»»©õE3ú+ü¼·€£º-ލ¢íÉÈ;ñü®!Y�Ë#‰¬S?9_h¬ËâÄc¤›Ð7ÔMœ«Áƒ§ÞáTÀM>¢$[ÒÂ8'-Ä%
=9ìÀnÄcP?\€+×¥¦‘)m,†žªÌ³¶¬…ß5Mªi†e-Lh40wˇN¢³àP•¬½¼…Áín––'ÒVPííhêT6ÐŲùj:Ö®¡šV4ô|‰äQï¯{W=Ú*~gw5ãG_Ä�mL
J¬üÑ´g–Wmž IDÜwm‰Ã1qdN´²]È4½¦u>—ÅF‘Ê`ò¬@,c©Öœ{ìg 6€ÿ[vzAêGI2bË^̪¢‹"*�
õ�›…ÆTµø"¼ƒÂ·ë%£nÚ†ÀÛVEª¦gáN@šÜ†o(½¿[ë ¡eHÑm¨‡ôYZgF�Ûµ£®ð†&dž&ñ–3z< ´±‹E ½‹ŠÃþ�°Å’ŒŽ\�ر“MN�6ùý>"¨’®†?wTþ|ûj¥OÌõ!ÖJa⇈0ÝgåúÛºóŸZSªQYÞ!UÀ`ré`ó$Ü\�ä§lL2ëlìR›ÕƒvÀLDâsì,êílWWG¢”Œ'C{y‚,”`0+ÐÞ¸9�U¦kq:¯ƒ ÍPÝÚK¥ æ&~¿Ø‘õZUƒ'èÚ¡õÖ¢ƒµ4FÊI“X9á…‚e„‡ZK€f�÷xs~²×ÈÐkhÞ˰…ò‰ÿ+6Ý&è0êFYÿ’
ÌIW‘&ÒUh�
¹¥†»Šý©ªõœ��=ÞÍH7Ûãä©tGbCØFcé>®Í Óâ,ûu¶*Ih®™Ó¦*gT/
ü<ïTï©jŠ
2äùK±‘òËoW¯^S‹¤› ïg]0Li 騗}2"îÂÆ@°_eçU§¹4Jr?î¡óPô�ó(–�ƒœ¾,6b²$n!é·w3”f‰/ÃYB1Y!ì‰IËY!6ÁÖš”ǶᴒÙîj2lT½×†:GáÏÚT‡¬Kê¼
©7N¹)Ì�ì˜ée¸xåËüp(ÿĘƮ'¿=Ž®²ŸkÊ ÿ–>¤`ëæ{€nŒþ‚Âc$o§>p<¶½³ˆ*’ɧ¶³9Üå¾?ÃYC2ÚÙ…T¢Ù²ûare"‹ÿ
¹6
Æ\×̇—0ÿ=ÅàœÁp;¢ï¥fšVœ…à¯&Ë)?j`¾šÓ<~ÖÀ�êXv
-T^qF�Íj¥ËænMy¨}ÁƒËoŒ.GƇ
-ðb§
dMÀ‚¤ mထ6…£T®j ÂÓ&óÒ+5�âÝ€Ã6�îª5çÖPßb³Ú#šsŸaŠ•ÃŽðÿ€ˆl ¬fõ-¦Øó�#ît¢a:N²æŽL?‘�´$cج¹8P?ŒÇE% K )¿š° GqÞ6½pä‹4¶Pˆ"ÚÎëWÔhpœerûA*ÇÀKD’½6žè¼6t¶¥NkäØûîyâ$æàè ࢽ*N�qûW�æ,&e<¶±³Ú[ì4©|Là4^‹}wWÎcﳨŸJET²úömSÓਡêÞ(z„aM]‚þZŠh|F6˜£öa¹896 (G•¥5H
-oä“~à)
D=J†;9
-oÇÕóÇy
-á'©ün