def __init__(self): PluginTerminalOutput.__init__(self) self.id = "Sqlmap" self.name = "Sqlmap" self.plugin_version = "0.0.3" self.version = "1.0.8.15#dev" self.framework_version = "1.0.0" self._current_output = None self.url = "" self.protocol = "" self.hostname = "" self.port = "80" self.params = "" self.fullpath = "" self.path = "" self.ignore_parsing = False self.addSetting("Sqlmap path", str, "/root/tools/sqlmap") self.db_port = { "MySQL": 3306, "PostgreSQL": "", "Microsoft SQL Server": 1433, "Oracle": 1521, "Firebird": 3050, "SAP MaxDB": 7210, "Sybase": 5000, "IBM DB2": 50000, "HSQLDB": 9001 } self.ptype = { 1: "Unescaped numeric", 2: "Single quoted string", 3: "LIKE single quoted string", 4: "Double quoted string", 5: "LIKE double quoted string", } self._command_regex = re.compile( r'^(python2 ./sqlmap.py|python2.7 ./sqlmap.py|sudo sqlmap|sqlmap|sudo python sqlmap|python sqlmap|\.\/sqlmap).*?' ) global current_path self._output_path = ''
def __init__(self): PluginTerminalOutput.__init__(self) self.id = "Sqlmap" self.name = "Sqlmap" self.plugin_version = "0.0.3" self.version = "1.2.8" self.framework_version = "1.0.0" self._current_output = None self.url = "" self.protocol = "" self.hostname = "" self.port = "80" self.params = "" self.fullpath = "" self.path = "" self.ignore_parsing = False self.addSetting("Sqlmap path", str, "/root/tools/sqlmap") self.db_port = { "MySQL": 3306, "PostgreSQL": "", "Microsoft SQL Server": 1433, "Oracle": 1521, "Firebird": 3050, "SAP MaxDB": 7210, "Sybase": 5000, "IBM DB2": 50000, "HSQLDB": 9001} self.ptype = { 1: "Unescaped numeric", 2: "Single quoted string", 3: "LIKE single quoted string", 4: "Double quoted string", 5: "LIKE double quoted string", } self._command_regex = re.compile( r'^(python2 ./sqlmap.py|python2.7 ./sqlmap.py|sudo sqlmap|sqlmap|sudo python sqlmap|python sqlmap|\.\/sqlmap).*?') global current_path self._output_path = ''
def __init__(self): PluginTerminalOutput.__init__(self) self.id = "Sqlmap" self.name = "Sqlmap" self.plugin_version = "0.0.2" self.version = "1.0-dev-6bcc95" self.framework_version = "1.0.0" self._current_output = None self.url = "" self.protocol = "" self.hostname = "" self.port = "80" self.params = "" self.fullpath = "" self.path = "" self.addSetting("Sqlmap path", str, "/root/tools/sqlmap") self.db_port = { "MySQL": 3306, "PostgreSQL": "", "Microsoft SQL Server": 1433, "Oracle": 1521, "Firebird": 3050, "SAP MaxDB": 7210, "Sybase": 5000, "IBM DB2": 50000, "HSQLDB": 9001 } self.ptype = { 1: "Unescaped numeric", 2: "Single quoted string", 3: "LIKE single quoted string", 4: "Double quoted string", 5: "LIKE double quoted string", } self._command_regex = re.compile( r'^(python2.7 ./sqlmap.py|sudo sqlmap|sqlmap|sudo python sqlmap|python sqlmap|\.\/sqlmap).*?' ) global current_path self._output_path = "" self._completition = { "-h,": "Show basic help message and exit", "-hh": "Show advanced help message and exit", "--version": "Show program's version number and exit", "-v": "VERBOSE Verbosity level: 0-6 (default 1)", "-d": "DIRECT Direct connection to the database", "-u": "URL, --url=URL Target URL (e.g. \"www.target.com/vuln.php?id=1\")", "-l": "LOGFILE Parse targets from Burp or WebScarab proxy logs", "-m": "BULKFILE Scan multiple targets enlisted in a given textual file", "-r": "REQUESTFILE Load HTTP request from a file", "-g": "GOOGLEDORK Process Google dork results as target URLs", "-c": "CONFIGFILE Load options from a configuration INI file", "--data": "DATA Data string to be sent through POST", "--param-del": "PDEL Character used for splitting parameter values", "--cookie": "COOKIE HTTP Cookie header", "--cookie-del": "CDEL Character used for splitting cookie values", "--load-cookies": "L.. File containing cookies in Netscape/wget format", "--drop-set-cookie": " Ignore Set-Cookie header from response", "--user-agent": "AGENT HTTP User-Agent header", "--random-agent": "Use randomly selected HTTP User-Agent header", "--host": "HOST HTTP Host header", "--referer": "REFERER HTTP Referer header", "--headers": "HEADERS Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")", "--auth-type": "AUTH.. HTTP authentication type (Basic, Digest, NTLM or Cert)", "--auth-cred": "AUTH.. HTTP authentication credentials (name:password)", "--auth-cert": "AUTH.. HTTP authentication certificate (key_file,cert_file)", "--proxy": "PROXY Use a proxy to connect to the target URL", "--proxy-cred": "PRO.. Proxy authentication credentials (name:password)", "--proxy-file": "PRO.. Load proxy list from a file", "--ignore-proxy": " Ignore system default proxy settings", "--tor": " Use Tor anonymity network", "--tor-port": "TORPORT Set Tor proxy port other than default", "--tor-type": "TORTYPE Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)", "--check-tor": " Check to see if Tor is used properly", "--delay": "DELAY Delay in seconds between each HTTP request", "--timeout": "TIMEOUT Seconds to wait before timeout connection (default 30)", "--retries": "RETRIES Retries when the connection timeouts (default 3)", "--randomize": "RPARAM Randomly change value for given parameter(s)", "--safe-url": "SAFURL URL address to visit frequently during testing", "--safe-freq": "SAFREQ Test requests between two visits to a given safe URL", "--skip-urlencode": " Skip URL encoding of payload data", "--force-ssl": " Force usage of SSL/HTTPS", "--hpp": " Use HTTP parameter pollution", "--eval": "EVALCODE Evaluate provided Python code before the request (e.g.", "-o": "-o Turn on all optimization switches", "--predict-output": " Predict common queries output", "--keep-alive": " Use persistent HTTP(s) connections", "--null-connection": " Retrieve page length without actual HTTP response body", "--threads": "THREADS Max number of concurrent HTTP(s) requests (default 1)", "-p": "-p TESTPARAMETER Testable parameter(s)", "--skip": "SKIP Skip testing for given parameter(s)", "--dbms": "DBMS Force back-end DBMS to this value", "--dbms-cred": "DBMS.. DBMS authentication credentials (user:password)", "--os": "OS Force back-end DBMS operating system to this value", "--invalid-bignum": " Use big numbers for invalidating values", "--invalid-logical": " Use logical operations for invalidating values", "--no-cast": " Turn off payload casting mechanism", "--no-escape": " Turn off string escaping mechanism", "--prefix": "PREFIX Injection payload prefix string", "--suffix": "SUFFIX Injection payload suffix string", "--tamper": "TAMPER Use given script(s) for tampering injection data", "--level": "LEVEL Level of tests to perform (1-5, default 1)", "--risk": "RISK Risk of tests to perform (0-3, default 1)", "--string": "STRING String to match when query is evaluated to True", "--not-string": "NOT.. String to match when query is evaluated to False", "--regexp": "REGEXP Regexp to match when query is evaluated to True", "--code": "CODE HTTP code to match when query is evaluated to True", "--text-only": " Compare pages based only on the textual content", "--titles": "Compare pages based only on their titles", "--technique": "TECH SQL injection techniques to use (default \"BEUSTQ\")", "--time-sec": "TIMESEC Seconds to delay the DBMS response (default 5)", "--union-cols": "UCOLS Range of columns to test for UNION query SQL injection", "--union-char": "UCHAR Character to use for bruteforcing number of columns", "--union-from": "UFROM Table to use in FROM part of UNION query SQL injection", "--dns-domain": "DNS.. Domain name used for DNS exfiltration attack", "--second-order": "S.. Resulting page URL searched for second-order response", "-f,": "-f, --fingerprint Perform an extensive DBMS version fingerprint", "-a,": "-a, --all Retrieve everything", "-b,": "-b, --banner Retrieve DBMS banner", "--current-user": "******", "--current-db": " Retrieve DBMS current database", "--hostname": " Retrieve DBMS server hostname", "--is-dba": " Detect if the DBMS current user is DBA", "--users": " Enumerate DBMS users", "--passwords": " Enumerate DBMS users password hashes", "--privileges": "Enumerate DBMS users privileges", "--roles": "Enumerate DBMS users roles", "--dbs": "Enumerate DBMS databases", "--tables": "Enumerate DBMS database tables", "--columns": "Enumerate DBMS database table columns", "--schema": "Enumerate DBMS schema", "--count": "Retrieve number of entries for table(s)", "--dump": "Dump DBMS database table entries", "--dump-all": "Dump all DBMS databases tables entries", "--search": "Search column(s), table(s) and/or database name(s)", "--comments": "Retrieve DBMS comments", "-D": "DB DBMS database to enumerate", "-T": "TBL DBMS database table to enumerate", "-C": "COL DBMS database table column to enumerate", "-U": "USER DBMS user to enumerate", "--exclude-sysdbs": "Exclude DBMS system databases when enumerating tables", "--start": "LIMITSTART First query output entry to retrieve", "--stop": "LIMITSTOP Last query output entry to retrieve", "--first": "FIRSTCHAR First query output word character to retrieve", "--last": "LASTCHAR Last query output word character to retrieve", "--sql-query": "QUERY SQL statement to be executed", "--sql-shell": "Prompt for an interactive SQL shell", "--sql-file": "SQLFILE Execute SQL statements from given file(s)", "--common-tables": "Check existence of common tables", "--common-columns": "Check existence of common columns", "User-defined": "User-defined function injection:", "--udf-inject": "Inject custom user-defined functions", "--shared-lib": "SHLIB Local path of the shared library", "--file-read": "RFILE Read a file from the back-end DBMS file system", "--file-write": "WFILE Write a local file on the back-end DBMS file system", "--file-dest": "DFILE Back-end DBMS absolute filepath to write to", "--os-cmd": "OSCMD Execute an operating system command", "--os-shell": "Prompt for an interactive operating system shell", "--os-pwn": "Prompt for an OOB shell, meterpreter or VNC", "--os-smbrelay": "One click prompt for an OOB shell, meterpreter or VNC", "--os-bof": "Stored procedure buffer overflow exploitation", "--priv-esc": "Database process user privilege escalation", "--msf-path": "MSFPATH Local path where Metasploit Framework is installed", "--tmp-path": "TMPPATH Remote absolute path of temporary files directory", "--reg-read": "Read a Windows registry key value", "--reg-add": "Write a Windows registry key value data", "--reg-del": "Delete a Windows registry key value", "--reg-key": "REGKEY Windows registry key", "--reg-value": "REGVAL Windows registry key value", "--reg-data": "REGDATA Windows registry key value data", "--reg-type": "REGTYPE Windows registry key value type", "-s": "-s SESSIONFILE Load session from a stored (.sqlite) file", "-t": "-t TRAFFICFILE Log all HTTP traffic into a textual file", "--batch": "--batch Never ask for user input, use the default behaviour", "--charset": "CHARSET Force character encoding used for data retrieval", "--crawl": "CRAWLDEPTH Crawl the website starting from the target URL", "--csv-del": "CSVDEL Delimiting character used in CSV output (default \",\")", "--dump-format": "DU.. Format of dumped data (CSV (default), HTML or SQLITE)", "--eta": "Display for each output the estimated time of arrival", "--flush-session": "Flush session files for current target", "--forms": "Parse and test forms on target URL", "--fresh-queries": "Ignore query results stored in session file", "--hex": "Use DBMS hex function(s) for data retrieval", "--output-dir": "ODIR Custom output directory path", "--parse-errors": "Parse and display DBMS error messages from responses", "--pivot-column": "P.. Pivot column name", "--save": "Save options to a configuration INI file", "--scope": "SCOPE Regexp to filter targets from provided proxy log", "--test-filter": "TE.. Select tests by payloads and/or titles (e.g. ROW)", "--update": "Update sqlmap", "-z": "MNEMONICS Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")", "--alert": "ALERT Run shell command(s) when SQL injection is found", "--answers": "ANSWERS Set question answers (e.g. \"quit=N,follow\")", "--beep": "Make a beep sound when SQL injection is found", "--check-waf": "Heuristically check for WAF/IPS/IDS protection", "--cleanup": "Clean up the DBMS from sqlmap specific UDF and tables", "--dependencies": "Check for missing (non-core) sqlmap dependencies", "--disable-coloring": "Disable console output coloring", "--gpage": "GOOGLEPAGE Use Google dork results from specified page number", "--identify-waf": "Make a through testing for a WAF/IPS/IDS protection", "--mobile": "Imitate smartphone through HTTP User-Agent header", "--page-rank": "Display page rank (PR) for Google dork results", "--purge-output": "Safely remove all content from output directory", "--smart": "Conduct through tests only if positive heuristic(s)", "--wizard": "Simple wizard interface for beginner users", }
def __init__(self): PluginTerminalOutput.__init__(self) self.id = "Sqlmap" self.name = "Sqlmap" self.plugin_version = "0.0.2" self.version = "1.0-dev-6bcc95" self.framework_version = "1.0.0" self._current_output = None self.url = "" self.protocol="" self.hostname="" self.port="80" self.params="" self.fullpath="" self.path="" self.addSetting("Sqlmap path", str, "/root/tools/sqlmap") self.db_port = { "MySQL" : 3306, "PostgreSQL":"", "Microsoft SQL Server" : 1433, "Oracle" : 1521, "Firebird" : 3050,"SAP MaxDB":7210, "Sybase" : 5000, "IBM DB2" : 50000, "HSQLDB" :9001} self.ptype = { 1: "Unescaped numeric", 2: "Single quoted string", 3: "LIKE single quoted string", 4: "Double quoted string", 5: "LIKE double quoted string", } self._command_regex = re.compile(r'^(python2.7 ./sqlmap.py|sudo sqlmap|sqlmap|sudo python sqlmap|python sqlmap|\.\/sqlmap).*?') global current_path self._output_path = "" self._completition = { "-h,":"Show basic help message and exit", "-hh":"Show advanced help message and exit", "--version":"Show program's version number and exit", "-v":"VERBOSE Verbosity level: 0-6 (default 1)", "-d":"DIRECT Direct connection to the database", "-u":"URL, --url=URL Target URL (e.g. \"www.target.com/vuln.php?id=1\")", "-l":"LOGFILE Parse targets from Burp or WebScarab proxy logs", "-m":"BULKFILE Scan multiple targets enlisted in a given textual file", "-r":"REQUESTFILE Load HTTP request from a file", "-g":"GOOGLEDORK Process Google dork results as target URLs", "-c":"CONFIGFILE Load options from a configuration INI file", "--data":"DATA Data string to be sent through POST", "--param-del":"PDEL Character used for splitting parameter values", "--cookie":"COOKIE HTTP Cookie header", "--cookie-del":"CDEL Character used for splitting cookie values", "--load-cookies":"L.. File containing cookies in Netscape/wget format", "--drop-set-cookie":" Ignore Set-Cookie header from response", "--user-agent":"AGENT HTTP User-Agent header", "--random-agent":"Use randomly selected HTTP User-Agent header", "--host":"HOST HTTP Host header", "--referer":"REFERER HTTP Referer header", "--headers":"HEADERS Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")", "--auth-type":"AUTH.. HTTP authentication type (Basic, Digest, NTLM or Cert)", "--auth-cred":"AUTH.. HTTP authentication credentials (name:password)", "--auth-cert":"AUTH.. HTTP authentication certificate (key_file,cert_file)", "--proxy":"PROXY Use a proxy to connect to the target URL", "--proxy-cred":"PRO.. Proxy authentication credentials (name:password)", "--proxy-file":"PRO.. Load proxy list from a file", "--ignore-proxy":" Ignore system default proxy settings", "--tor":" Use Tor anonymity network", "--tor-port":"TORPORT Set Tor proxy port other than default", "--tor-type":"TORTYPE Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)", "--check-tor":" Check to see if Tor is used properly", "--delay":"DELAY Delay in seconds between each HTTP request", "--timeout":"TIMEOUT Seconds to wait before timeout connection (default 30)", "--retries":"RETRIES Retries when the connection timeouts (default 3)", "--randomize":"RPARAM Randomly change value for given parameter(s)", "--safe-url":"SAFURL URL address to visit frequently during testing", "--safe-freq":"SAFREQ Test requests between two visits to a given safe URL", "--skip-urlencode":" Skip URL encoding of payload data", "--force-ssl":" Force usage of SSL/HTTPS", "--hpp":" Use HTTP parameter pollution", "--eval":"EVALCODE Evaluate provided Python code before the request (e.g.", "-o":"-o Turn on all optimization switches", "--predict-output":" Predict common queries output", "--keep-alive":" Use persistent HTTP(s) connections", "--null-connection":" Retrieve page length without actual HTTP response body", "--threads":"THREADS Max number of concurrent HTTP(s) requests (default 1)", "-p":"-p TESTPARAMETER Testable parameter(s)", "--skip":"SKIP Skip testing for given parameter(s)", "--dbms":"DBMS Force back-end DBMS to this value", "--dbms-cred":"DBMS.. DBMS authentication credentials (user:password)", "--os":"OS Force back-end DBMS operating system to this value", "--invalid-bignum":" Use big numbers for invalidating values", "--invalid-logical":" Use logical operations for invalidating values", "--no-cast":" Turn off payload casting mechanism", "--no-escape":" Turn off string escaping mechanism", "--prefix":"PREFIX Injection payload prefix string", "--suffix":"SUFFIX Injection payload suffix string", "--tamper":"TAMPER Use given script(s) for tampering injection data", "--level":"LEVEL Level of tests to perform (1-5, default 1)", "--risk":"RISK Risk of tests to perform (0-3, default 1)", "--string":"STRING String to match when query is evaluated to True", "--not-string":"NOT.. String to match when query is evaluated to False", "--regexp":"REGEXP Regexp to match when query is evaluated to True", "--code":"CODE HTTP code to match when query is evaluated to True", "--text-only":" Compare pages based only on the textual content", "--titles":"Compare pages based only on their titles", "--technique":"TECH SQL injection techniques to use (default \"BEUSTQ\")", "--time-sec":"TIMESEC Seconds to delay the DBMS response (default 5)", "--union-cols":"UCOLS Range of columns to test for UNION query SQL injection", "--union-char":"UCHAR Character to use for bruteforcing number of columns", "--union-from":"UFROM Table to use in FROM part of UNION query SQL injection", "--dns-domain":"DNS.. Domain name used for DNS exfiltration attack", "--second-order":"S.. Resulting page URL searched for second-order response", "-f,":"-f, --fingerprint Perform an extensive DBMS version fingerprint", "-a,":"-a, --all Retrieve everything", "-b,":"-b, --banner Retrieve DBMS banner", "--current-user":"******", "--current-db":" Retrieve DBMS current database", "--hostname":" Retrieve DBMS server hostname", "--is-dba":" Detect if the DBMS current user is DBA", "--users":" Enumerate DBMS users", "--passwords":" Enumerate DBMS users password hashes", "--privileges":"Enumerate DBMS users privileges", "--roles":"Enumerate DBMS users roles", "--dbs":"Enumerate DBMS databases", "--tables":"Enumerate DBMS database tables", "--columns":"Enumerate DBMS database table columns", "--schema":"Enumerate DBMS schema", "--count":"Retrieve number of entries for table(s)", "--dump":"Dump DBMS database table entries", "--dump-all":"Dump all DBMS databases tables entries", "--search":"Search column(s), table(s) and/or database name(s)", "--comments":"Retrieve DBMS comments", "-D":"DB DBMS database to enumerate", "-T":"TBL DBMS database table to enumerate", "-C":"COL DBMS database table column to enumerate", "-U":"USER DBMS user to enumerate", "--exclude-sysdbs":"Exclude DBMS system databases when enumerating tables", "--start":"LIMITSTART First query output entry to retrieve", "--stop":"LIMITSTOP Last query output entry to retrieve", "--first":"FIRSTCHAR First query output word character to retrieve", "--last":"LASTCHAR Last query output word character to retrieve", "--sql-query":"QUERY SQL statement to be executed", "--sql-shell":"Prompt for an interactive SQL shell", "--sql-file":"SQLFILE Execute SQL statements from given file(s)", "--common-tables":"Check existence of common tables", "--common-columns":"Check existence of common columns", "User-defined":"User-defined function injection:", "--udf-inject":"Inject custom user-defined functions", "--shared-lib":"SHLIB Local path of the shared library", "--file-read":"RFILE Read a file from the back-end DBMS file system", "--file-write":"WFILE Write a local file on the back-end DBMS file system", "--file-dest":"DFILE Back-end DBMS absolute filepath to write to", "--os-cmd":"OSCMD Execute an operating system command", "--os-shell":"Prompt for an interactive operating system shell", "--os-pwn":"Prompt for an OOB shell, meterpreter or VNC", "--os-smbrelay":"One click prompt for an OOB shell, meterpreter or VNC", "--os-bof":"Stored procedure buffer overflow exploitation", "--priv-esc":"Database process user privilege escalation", "--msf-path":"MSFPATH Local path where Metasploit Framework is installed", "--tmp-path":"TMPPATH Remote absolute path of temporary files directory", "--reg-read":"Read a Windows registry key value", "--reg-add":"Write a Windows registry key value data", "--reg-del":"Delete a Windows registry key value", "--reg-key":"REGKEY Windows registry key", "--reg-value":"REGVAL Windows registry key value", "--reg-data":"REGDATA Windows registry key value data", "--reg-type":"REGTYPE Windows registry key value type", "-s":"-s SESSIONFILE Load session from a stored (.sqlite) file", "-t":"-t TRAFFICFILE Log all HTTP traffic into a textual file", "--batch":"--batch Never ask for user input, use the default behaviour", "--charset":"CHARSET Force character encoding used for data retrieval", "--crawl":"CRAWLDEPTH Crawl the website starting from the target URL", "--csv-del":"CSVDEL Delimiting character used in CSV output (default \",\")", "--dump-format":"DU.. Format of dumped data (CSV (default), HTML or SQLITE)", "--eta":"Display for each output the estimated time of arrival", "--flush-session":"Flush session files for current target", "--forms":"Parse and test forms on target URL", "--fresh-queries":"Ignore query results stored in session file", "--hex":"Use DBMS hex function(s) for data retrieval", "--output-dir":"ODIR Custom output directory path", "--parse-errors":"Parse and display DBMS error messages from responses", "--pivot-column":"P.. Pivot column name", "--save":"Save options to a configuration INI file", "--scope":"SCOPE Regexp to filter targets from provided proxy log", "--test-filter":"TE.. Select tests by payloads and/or titles (e.g. ROW)", "--update":"Update sqlmap", "-z":"MNEMONICS Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")", "--alert":"ALERT Run shell command(s) when SQL injection is found", "--answers":"ANSWERS Set question answers (e.g. \"quit=N,follow\")", "--beep":"Make a beep sound when SQL injection is found", "--check-waf":"Heuristically check for WAF/IPS/IDS protection", "--cleanup":"Clean up the DBMS from sqlmap specific UDF and tables", "--dependencies":"Check for missing (non-core) sqlmap dependencies", "--disable-coloring":"Disable console output coloring", "--gpage":"GOOGLEPAGE Use Google dork results from specified page number", "--identify-waf":"Make a through testing for a WAF/IPS/IDS protection", "--mobile":"Imitate smartphone through HTTP User-Agent header", "--page-rank":"Display page rank (PR) for Google dork results", "--purge-output":"Safely remove all content from output directory", "--smart":"Conduct through tests only if positive heuristic(s)", "--wizard":"Simple wizard interface for beginner users", }