Advertisement
Kyfx

sqlmap what may be purpose inside commands?

Mar 27th, 2015
373
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.27 KB | None | 0 0
  1. Today I want to sharing about what does --string means.
  2. Many people ask me to help when they can't inject a site and an error ask them to use --string and about it's brother --regexp
  3. I always use --string or --regexp when --level doesn't work. I use them together. Because it says "you can try to rerun by providing either a valid value for option '--string' (or '--regexp')" in error.
  4. What exactly are those?
  5. The --string and --regexp options are to do with identifying valid responses from the server that contain result data, and extracting that data. This is called bisection, and it is described in the documentation: for each HTTP response, by making a comparison between the HTTP response headers/body with the original request, the tool inference the output of the injected statement character by character. Alternatively, the user can provide a string or regular expression to match on True pages. The bisection algorithm implemented in sqlmap to perform this technique is able to fetch each character of the output with a maximum of seven HTTP requests. Where the output is not within the clear-text plain charset, sqlmap will adapt the algorithm with bigger ranges to detect the output.
  6. If it doesn't work just by using --level and --string , then you need to use a proper --tamper
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement