Skip to content

Commit a19790f

Browse files
vizzdoomvizzdoom
committed
New options in the Exploitation module.
Input layout adjustments.
1 parent 1bc4d11 commit a19790f

File tree

4 files changed

+94
-19
lines changed

4 files changed

+94
-19
lines changed

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
![SQLMAP COMMAND BUILDER](logo-white.png)
1+
<picture>
2+
<source media="(prefers-color-scheme: dark)" srcset="./logo.png">
3+
<img alt="SQLMAP COMMAND BUILDER" src="./logo-white.png">
4+
</picture>
25

36
**Take control of SQLMap with a single page app.** This interactive builder lets you craft advanced [SQLMap](https://github.com/sqlmapproject/sqlmap) commands without memorising dozens of CLI switches.
47

‎app.js‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -509,7 +509,31 @@ class SQLMapGenerator {
509509
if (table) config['-T'] = table;
510510

511511
const column = document.getElementById('column').value.trim();
512-
if (column) config['-C'] = column;
512+
if (column) config['-C'] = column;
513+
514+
const exclude = document.getElementById('exclude').value.trim();
515+
if (exclude) config['-X'] = exclude;
516+
517+
const user = document.getElementById('user').value.trim();
518+
if (user) config['-U'] = user;
519+
520+
const pivotColumn = document.getElementById('pivotColumn').value.trim();
521+
if (pivotColumn) config['--pivot-column'] = pivotColumn;
522+
523+
const where = document.getElementById('where').value.trim();
524+
if (where) config['--where'] = where;
525+
526+
const start = document.getElementById('start').value.trim();
527+
if (start) config['--start'] = start;
528+
529+
const stop = document.getElementById('stop').value.trim();
530+
if (stop) config['--stop'] = stop;
531+
532+
const first = document.getElementById('first').value.trim();
533+
if (first) config['--first'] = first;
534+
535+
const last = document.getElementById('last').value.trim();
536+
if (last) config['--last'] = last;
513537

514538
return config;
515539
}
@@ -536,7 +560,7 @@ class SQLMapGenerator {
536560
'--batch', '-v', '-t', '--parse-errors', '--test-filter',
537561
'--all', '--banner', '--columns', '--comments', '--count', '--current-user', '--current-db', '--dbs', '--dump', '--dump-all',
538562
'--hostname', '--is-dba', '--passwords', '--privileges', '--roles', '--schema', '--search', '--statements', '--tables', '--users',
539-
'-D', '-T', '-C', '-o',
563+
'-D', '-T', '-C', '-X', '-U', '--pivot-column', '--where', '--start', '--stop', '--first', '--last',
540564
'--tamper', '--prefix', '--suffix', '--csrf-token', '--csrf-url', '--second-url'
541565
];
542566

@@ -867,8 +891,15 @@ class SQLMapGenerator {
867891
'-D': 'database',
868892
'-T': 'table',
869893
'-C': 'column',
894+
'-X': 'exclude',
895+
'-U': 'user',
896+
'--where': 'where',
897+
'--start': 'start',
898+
'--stop': 'stop',
899+
'--first': 'first',
900+
'--last': 'last',
901+
'--pivot-column': 'pivotColumn',
870902
'--null-connection': 'nullConnection',
871-
'-o': 'optimize',
872903
'--tamper': 'tamper',
873904
'--second-url': 'secondUrl'
874905
};

‎index.html‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -714,19 +714,64 @@ <h3>Attack Optimalization</h3>
714714
<div class="card">
715715
<div class="card__body">
716716
<div class="form-grid">
717+
<!-- -D -->
717718
<div class="form-group">
718719
<label class="form-label" title="DBMS database to enumerate" for="database">DATABASE(S) NAME FOR ENUMERATION<br/><span>-D</span></label>
719720
<input type="text" id="database" class="form-control" placeholder="database_name1,database_name2">
720721
</div>
722+
<!-- -T -->
721723
<div class="form-group">
722724
<label class="form-label" title="DBMS database table(s) to enumerate" for="table">TABLE(S) NAME FOR ENUMERATION<br/><span>-T</span></label>
723725
<input type="text" id="table" class="form-control" placeholder="table_name1,table_name2">
724726
</div>
727+
<!-- -C -->
725728
<div class="form-group">
726729
<label class="form-label" title="DBMS database table column(s) to enumerate" for="column">COLUMN(S) NAME FOR ENUMERATION<br/><span>-C</span></label>
727730
<input type="text" id="column" class="form-control" placeholder="column_name1,column_name2">
731+
</div>
732+
<!-- -X -->
733+
<div class="form-group">
734+
<label class="form-label" title="DBMS database identifier(s) to not enumerate" for="exclude">DBMS(S) TO NOT ENUMARATE<br/><span>-X</span></label>
735+
<input type="text" id="exclude" class="form-control" placeholder="dbname">
736+
</div>
737+
<!-- -U -->
738+
<div class="form-group">
739+
<label class="form-label" title="DBMS user to enumerate (can be used with --roles and --passwords)" for="user">USER NAME FOR ENUMERATION<br/><span>-U</span></label>
740+
<input type="text" id="user" class="form-control" placeholder="username">
741+
</div>
742+
<!-- --pivot-column -->
743+
<div class="form-group">
744+
<label class="form-label" title="Sometimes (e.g. for Microsoft SQL Server) it is not possible to dump the table rows straightforward by using OFFSET m, n mechanism because of lack of similar. In such cases sqlmap dumps the content by determining the most suitable pivot column (the one with most unique values) whose values are used later on for retrieval of other column values.
745+
If it is necessary to enforce the usage of particular pivot column because the automatically chosen one is not suitable (e.g. because of lack of table dump results) you can use option --pivot-column (e.g. --pivot-column=id)." for="pivotColumn">PIVOT COLUMN NAME<br/><span>--pivot-column</span></label>
746+
<input type="text" id="pivotColumn" class="form-control" placeholder="column_name">
747+
</div>
748+
<!-- --where -->
749+
<div class="form-group">
750+
<label class="form-label" title='In case that you want to constraint the --dump to specific column values (or ranges) you can use option --where. Provided logical operation will be automatically used inside the WHERE clause. For example, if you use --where="id>3" only table rows having value of column id greater than 3 will be retrieved (by appending WHERE id>3 to used dumping queries).' for="where">DUMP FILTER CONDITION<br/><span>--where</span></label>
751+
<input type="text" id="where" class="form-control" placeholder="SQL CONDITION">
752+
</div>
753+
<!-- --start -->
754+
<div class="form-group">
755+
<label class="form-label" title='If you want to dump only a range of entries, then you can provide options --start and/or --stop to respectively start to dump from a certain entry and stop the dump at a certain entry. For instance, if you want to dump only the first entry, provide --stop 1 in your command line. Vice versa if, for instance, you want to dump only the second and third entry, provide --start 1 --stop 3.' for="start">FIRST DUMP TABLE ENTRY<br/><span>--start</span></label>
756+
<input type="number" id="start" class="form-control" placeholder="1">
757+
</div>
758+
<!-- --stop -->
759+
<div class="form-group">
760+
<label class="form-label" title='If you want to dump only a range of entries, then you can provide options --start and/or --stop to respectively start to dump from a certain entry and stop the dump at a certain entry. For instance, if you want to dump only the first entry, provide --stop 1 in your command line. Vice versa if, for instance, you want to dump only the second and third entry, provide --start 1 --stop 3.' for="stop">LAST DUMP TABLE ENTRY<br/><span>--stop</span></label>
761+
<input type="number" id="stop" class="form-control" placeholder="3">
762+
</div>
763+
<!-- --first -->
764+
<div class="form-group">
765+
<label class="form-label" title="It is possible to specify which single character or range of characters to dump with options --first and --last. For instance, if you want to dump columns' entries from the third to the fifth character, provide --first 3 --last 5. This feature only applies to the blind SQL injection techniques because for error-based and UNION query SQL injection techniques the number of requests is exactly the same, regardless of the length of the column's entry output to dump." for="first">FIRST DUMP TABLE ENTRY<br/><span>--first</span></label>
766+
<input type="number" id="first" class="form-control" placeholder="3">
767+
</div>
768+
<!-- --last -->
769+
<div class="form-group">
770+
<label class="form-label" title="It is possible to specify which single character or range of characters to dump with options --first and --last. For instance, if you want to dump columns' entries from the third to the fifth character, provide --first 3 --last 5. This feature only applies to the blind SQL injection techniques because for error-based and UNION query SQL injection techniques the number of requests is exactly the same, regardless of the length of the column's entry output to dump." for="last">LAST DUMP TABLE ENTRY<br/><span>--last</span></label>
771+
<input type="number" id="last" class="form-control" placeholder="5">
728772
</div>
729-
<div class="checkbox-grid" title="These options can be used to enumerate the back-end database management system information, structure and data contained in the tables">
773+
<!-- ENUMERATION -->
774+
<div class="checkbox-grid" style="grid-row-start: 1; grid-row-end: 6;" title="These options can be used to enumerate the back-end database management system information, structure and data contained in the tables">
730775
<label class="form-label">ENUMERATION AND DATA EXFILTRATION</label>
731776
<label class="checkbox-label" title="Retrieve everything">
732777
<input type="checkbox" id="all">

‎style.css‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,8 @@
4646
/* Typography */
4747
--font-family-base: "Geist", "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
4848
--font-family-mono: 'Courier New', monospace;
49-
--font-size-xs: 11px;
50-
--font-size-s: 12px;
51-
--font-size-base: 13px;
49+
--font-size-xs: 10px;
50+
--font-size-s: 11px;
5251
--font-size-m: 13px;
5352
--font-size-l: 16px;
5453
--font-size-xl: 18px;
@@ -90,7 +89,7 @@
9089
inset 0 -1px 0 rgba(0, 0, 0, 0.03);
9190

9291
/* Animation */
93-
--duration-fast: 250ms;
92+
--duration-fast: 200ms;
9493
--duration-normal: 500ms;
9594
--ease-standard: cubic-bezier(0.16, 1, 0.3, 1);
9695

@@ -152,7 +151,7 @@
152151
align-items: center;
153152
justify-content: center;
154153
padding: var(--space-s) var(--space-s);
155-
font-size: var(--font-size-xs);
154+
font-size: var(--font-size-s);
156155
width: 135px;
157156
max-width: 135px;
158157
height: 55px;
@@ -168,6 +167,7 @@
168167
@media (min-width: 600px) {
169168
.btn {
170169
padding: var(--space-m) var(--space-l);
170+
font-size: var(--font-size-s);
171171
width: 240px;
172172
max-width: 240px;
173173
height: 40px;
@@ -202,10 +202,6 @@
202202
gap: var(--space-m);
203203
}
204204

205-
.form-grid-tamper label.checkbox-label-tamper {
206-
font-size: var(--font-size-sm) !important;
207-
}
208-
209205

210206
/* @media (min-width: 625px) {
211207
#tampering .form-grid {
@@ -246,7 +242,7 @@ label span.checkbox-label-tamper__title {
246242

247243
/* Base styles */
248244
html {
249-
font-size: var(--font-size-base);
245+
font-size: var(--font-size-m);
250246
font-family: var(--font-family-base);
251247
line-height: var(--line-height-normal);
252248
color: var(--color-text);
@@ -316,7 +312,7 @@ a:hover {
316312
code,
317313
pre {
318314
font-family: var(--font-family-mono);
319-
font-size: calc(var(--font-size-base) * 0.95);
315+
font-size: calc(var(--font-size-m) * 0.95);
320316
background-color: var(--color-secondary);
321317
border-radius: var(--radius-s);
322318
}
@@ -416,7 +412,7 @@ pre code {
416412
display: block;
417413
width: 100%;
418414
padding: var(--space-s) var(--space-m);
419-
font-size: var(--font-size-m);
415+
font-size: var(--font-size-s);
420416
line-height: 1.5;
421417
color: var(--color-text);
422418
background-color: var(--color-surface);
@@ -437,7 +433,7 @@ pre code {
437433
color: var(--hacker-primary);
438434
font-weight: bold;
439435
margin-bottom: var(--space-s);
440-
font-size: var(--font-size-xs);
436+
font-size: var(--font-size-s);
441437
letter-spacing: 0.7px;
442438
}
443439

@@ -466,7 +462,7 @@ pre code {
466462

467463
textarea.form-control {
468464
font-family: var(--font-family-mono);
469-
font-size: var(--font-size-base);
465+
font-size: var(--font-size-s);
470466
resize: vertical;
471467
min-height: 39px;
472468
}

0 commit comments

Comments
 (0)