Chinese explanation of common parameters of Mysql-sqlmap

#HiRoot ' s Blog
Options (optional):
--version Display the program's version number and exit
-H,--help displays this help message and exits
-V VERBOSE verbose level: 0-6 (default = 1)

Target (destination):
At a minimum, you need to set one of these options to set the destination URL.

-D Direct connects directly to the database.
-u URL,--url=url destination URL.
-l list resolves the target from the log of the burp or WebScarab agent.
-R RequestFile loading HTTP requests from a file.
-G googledork The result of processing Google dork as the destination URL.
-C configfile Load options from the INI configuration file.

Request (requested):
These options can be used to specify how to connect to the destination URL.

--data=data data strings sent via post
--cookie=cookie HTTP Cookie Header
--cookie-urlencode URL encoding generated by cookie injection
--drop-set-cookie Ignore Set-cookie header information for response
--user-agent=agent specifying the HTTP user-agent header
--random-agent using a randomly selected HTTP User-agent header
--referer=referer specifying the HTTP referer header
--headers=headers line break, add other HTTP headers
--auth-type=atype HTTP Authentication type (base, digest, or NTLM) (Basic, Digest or NTLM)
--auth-cred=acred HTTP Authentication credentials (user name: password)
--auth-cert=acert HTTP Authentication certificate (key_file,cert_file)
--proxy=proxy using an HTTP proxy to connect to the destination URL
--proxy-cred=pcred HTTP proxy authentication credentials (user name: password)
--ignore-proxy ignoring the system default HTTP proxy
--delay=delay delay time in seconds between each HTTP request
--timeout=timeout time to wait for the connection to time out (default is 30 seconds)
--retries=retries time the connection is reconnected after timeout (default 3)
--scope=scope regular expression of filter targets from the provided agent log
--safe-url=safurl URL addresses that are frequently accessed during testing
--safe-freq=safreq test requests between two visits, give a secure URL

Optimization (optimized):
These options can be used to optimize the performance of Sqlmap.

-O Turn on all optimization switches
--predict-output prediction of common query output
--keep-alive using a persistent HTTP (S) connection
--null-connection retrieving page lengths from no actual HTTP response body
--threads=threads Maximum http (S) request concurrency (default = 1)

Injection (injection):
These options can be used to specify which parameters are tested, provide custom injection payloads, and optional tamper scripts.

-p testparameter parameters to test (S)
--dbms=dbms the DBMS of the forced backend for this value
--os=os the DBMS operating system for the forced backend is this value
--prefix=prefix Injecting payload String prefix
--suffix=suffix Injecting payload string suffix
--tamper=tamper using the given script (S) to tamper with the injected data

Detection (detection):
These options can be used to specify how the contents of the HTTP response page are parsed and compared when the SQL blinds are made.

--level=level level of test Execution (1-5, default = 1)
--risk=risk risk of performing tests (0-3, default = 1)
--string=string when query is valid when the page matches a string
--regexp=regexp a regular expression on a page when the query is valid
--text-only based on comparing pages in text content only

Techniques (Tips):
These options can be used to adjust specific SQL injection tests.

--technique=tech SQL injection Technology test (default Beust)
Delay time of--time-sec=timesec DBMS response (default is 5 seconds)
--union-cols=ucols set range for test union query injection
--union-char=uchar characters used for brute-force guessing of the number of columns

Fingerprint (fingerprint):
-F,--fingerprint performs check of extensive DBMS version thumbprint

Enumeration (enum):
These options can be used to enumerate the information of the backend database management system, the structure in the table, and the data. In addition, you can also run your own
of SQL statements.
-B,--banner retrieves the identity of the database management system
--current-user Retrieving database management system Current user
--CURRENT-DB Retrieving database management system current database
--IS-DBA detecting whether the DBMS current user is DBA
--users Enumerating Database management system users
--passwords enumeration of database management system user password hashes
--privileges enumerate the permissions of the database management system user
--roles enumerating the roles of database management system users
--dbs Enumeration Database Management System Database
--tables enumeration of tables in the DBMS database
--columns Enumerating DBMS database table columns
--dump the table entries in the database of the DUMP database management system
--dump-all dumps all the entries in the DBMS database table
--search Search column (s), table (s) and/or database name (s)
-D DB name of the database to enumerate
-T TBL database table to be enumerated
-C COL The database column to enumerate
-u user for enumerating database users
--exclude-sysdbs to exclude system databases when enumerating tables
--start=limitstart first query output into search
--stop=limitstop the output of the last query into the search
--first=firstchar character retrieval of the first query output word
--last=lastchar the output character retrieval of the last query
--sql-query=query the SQL statement to execute
--sql-shell tips for Interactive SQL shell

Brute forces (brute force):
These options can be used to run brute force checks.

--common-tables Check Existence common table
--common-columns Check existence Common column

user-defined function Injection (user-defined functions injection):
These options can be used to create user-defined functions.

--udf-inject injecting user-defined functions
--shared-lib=shlib local path to shared library

File system access (Access FileSystem):
These options can be used to access the underlying file system of the backend database management system.

--file-read=rfile reading files from the backend database management System file system
--file-write=wfile editing a local file on the backend database management System file system
The absolute path to the file written by the database management system on the--file-dest=dfile backend

Operating system access (operating system accesses):
These options can be used to access the underlying operating system of the back-end database management system.

--os-cmd=oscmd executing operating system commands
--os-shell the shell of an interactive operating system
--os-pwn get an OOB shell,meterpreter or VNC
--os-smbrelay One-click to get an OOB shell,meterpreter or VNC
--os-bof stored Procedure Buffer Overflow utilization
--PRIV-ESC Database Process User privilege elevation
--msf-path=msfpath Metasploit Framework Local installation path
--tmp-path=tmppath absolute path to remote temp file directory

Windows Registry access:
These options can be used to access the Windows registry of the back-end database management system.

--reg-read read a Windows registry key value
--reg-add write a Windows registry key value data
--reg-del deleting Windows registry key values
--reg-key=regkey Windows registry key
--reg-value=regval Windows registry key values
--reg-data=regdata Windows registry key value data
--reg-type=regtype Windows registry key value types

General (Normal):

These options can be used to set some general working parameters.
-T trafficfile log all HTTP traffic to a text file
-S Sessionfile save and restore all data for retrieving session files
--flush-session Refresh the current target session file
--fresh-queries ignores query results stored in the session file
--eta shows the estimated time of arrival for each output
--update Update Sqlmap
--save file save option to INI profile
--batch never asks for user input, and uses all default configurations.

Miscellaneous (Miscellaneous):
--BEEP alert when SQL injection is found
Detection and testing of--check-payload IDs for injection payloads
--cleanup Sqlmap specific UDF and table cleanup DBMS
--forms parsing and testing of target URLs
--gpage=googlepage using Google dork results from the specified page number
--page-rank Google dork Results Display page rank (PR)
--parse-errors parsing the database management system error message from the response page
--replicate copy dump data to a sqlite3 database
--tor using the default Tor (VIDALIA/PRIVOXY/POLIPO) proxy address
--wizard Simple Wizard Interface for novice users

A more detailed explanation of the reference:

http://drops.wooyun.org/tips/143

http://drops.wooyun.org/tips/401

Http://www.waitalone.cn/sqlmap-users-manual.html

Options:
-H,--help Show basic Help message and exit
-HH Show advanced help message and exit
--version Show Program ' s version number and exit
-V VERBOSE verbosity level:0-6 (default 1)

Target:
At least one of these options have to is provided to define the
Target (s)

-D Direct Connection string for DIRECT database Connection
-u URL,--url=url Target url (e.g. "http://www.site.com/vuln.php?id=1")
-L LOGFILE Parse Target (s) from burp or WebScarab proxy log file
-X Sitemapurl Parse target (s) from remote sitemap (. xml) file
-M Bulkfile Scan multiple targets given in a textual file
-R requestfile Load HTTP request from a file
-G googledork Process Google dork results as Target URLs
-C configfile Load options from a configuration INI file

Request:
These options can used to specify what to connect to the target URL

--method=method force usage of given HTTP method (e.g. PUT)
--data=data data string to be sent through POST
--param-del=para. Character used for splitting parameter values
--cookie=cookie HTTP Cookie Header value
--cookie-del=coo. Character used for splitting cookie values
--load-cookies=l. File containing cookies in netscape/wget format
--drop-set-cookie Ignore Set-cookie Header from response
--user-agent=agent HTTP user-agent Header value
--random-agent use randomly selected HTTP user-agent header value
--host=host HTTP Host Header value
--referer=referer HTTP Referer Header value
--headers=headers Extra headers (e.g. "accept-language:fr\netag:123")
--auth-type=auth. HTTP Authentication Type (Basic, Digest, NTLM, or PKI)
--auth-cred=auth. HTTP authentication Credentials (Name:password)
--auth-private=a. HTTP Authentication PEM Private Key file
--ignore-401 Ignore HTTP Error 401 (Unauthorized)
--proxy=proxy use a proxy to connect to the target URL
--proxy-cred=pro. Proxy authentication Credentials (Name:password)
--proxy-file=pro. Load proxy list from a file
--ignore-proxy Ignore system default proxy settings
--tor use Tor anonymity network
--tor-port=torport Set Tor proxy port other than default
--tor-type=tortype Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)
--check-tor Check to see if Tor is used properly
--delay=delay delay in seconds between each HTTP request
--timeout=timeout Seconds to wait before timeout connection (default 30)
--retries=retries retries When the connection timeouts (default 3)
--randomize=rparam randomly change value for given parameter (s)
--safe-url=safurl URL address to visit frequently during testing
--safe-freq=safreq Test requests between, visits to a given safe URL
--skip-urlencode Skip URL encoding of payload data
--CSRF-TOKEN=CSR. Parameter used to hold ANTI-CSRF token
--csrf-url=csrfurl URL address to visit to extract ANTI-CSRF token
--force-ssl force usage of Ssl/https
--HPP use HTTP parameter pollution method
--eval=evalcode Evaluate provided Python code before the request (e.g.
"Import hashlib;id2=hashlib.md5 (ID). Hexdigest ()")

Optimization:
These options can used to optimize the performance of Sqlmap

-O Turn on all optimization switches
--predict-output predict common queries output
--keep-alive Use persistent HTTP (s) connections
--null-connection Retrieve page length without actual HTTP response body
--threads=threads Max Number of concurrent HTTP (s) requests (default 1)

Injection:
These options can used to specify which parameters to test for,
Provide custom injection payloads and optional tampering scripts

-P testparameter testable parameter (s)
--skip=skip skip testing for given parameter (s)
--dbms=dbms Force Back-end DBMS to this value
--dbms-cred=dbms. DBMS authentication Credentials (User:password)
--os=os Force Back-end DBMS operating system to this value
--invalid-bignum use big numbers for invalidating values
--invalid-logical use logical operations for invalidating values
--invalid-string use the random strings for invalidating values
--no-cast Turn off payload casting mechanism
--no-escape Turn off string escaping mechanism
--prefix=prefix Injection Payload Prefix string
--suffix=suffix Injection Payload Suffix string
--tamper=tamper use given script (s) for tampering injection data

Detection:
These options can used to customize the detection phase

--level=level level of tests to perform (1-5, default 1)
--risk=risk risk of tests to perform (0-3, default 1)
--string=string string to match when query was evaluated to True
--not-string=not. String to match when query was evaluated to False
--regexp=regexp regexp to match when query was evaluated to True
--code=code HTTP code to match when query was evaluated to True
--text-only Compare pages based only on the textual content
--titles Compare pages based only on their titles

Techniques:
These options can used to tweak testing of specific SQL injection
Techniques

--technique=tech SQL Injection techniques to use (default "BEUSTQ")
--time-sec=timesec Seconds to delay the DBMS response (default 5)
--union-cols=ucols Range of columns to test for union query SQL injection
--union-char=uchar Character to use for bruteforcing number of columns
--union-from=ufrom Table to use with from part of union query SQL injection
--dns-domain=dns. Domain name used for DNS exfiltration attack
--second-order=s. resulting page URL searched for second-order Response

Fingerprint:
-F,--fingerprint Perform an extensive DBMS version fingerprint

Enumeration:
These options can used to enumerate the Back-end database
Management system information, structure and data contained in the
Tables. Moreover you can run your own SQL statements

-A,--all Retrieve everything
-B,--banner Retrieve DBMS Banner
--current-user Retrieve DBMS Current User
--CURRENT-DB Retrieve DBMS Current Database
--hostname Retrieve DBMS Server hostname
--IS-DBA Detect If the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes
--privileges Enumerate DBMS users Privileges
--roles Enumerate DBMS users roles
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS Schema
--count Retrieve number of entries for table (s)
--dump Dump DBMS database table entries
--dump-all dump all DBMS databases tables entries
--search Search column (s), table (s) and/or database name (s)
--comments Retrieve DBMS Comments
-D DB DBMS database to enumerate
-T TBL DBMS database table (s) to enumerate
-C COL DBMS database table column (s) to enumerate
-X Excludecol DBMS database table column (s) to not enumerate
-u user DBMS user to enumerate
--exclude-sysdbs exclude DBMS system databases when enumerating tables
--where=dumpwhere use where condition while table dumping
--start=limitstart first query output entry to retrieve
--stop=limitstop last query output entry to retrieve
--first=firstchar first query output word character to retrieve
--last=lastchar last query output word character to retrieve
--sql-query=query SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
--sql-file=sqlfile Execute SQL statements from given file (s)

Brute Force:
These options can used to run brute force checks

--common-tables Check existence of common tables
--common-columns Check existence of common columns

user-defined function Injection:
These options can used to create custom user-defined functions

--udf-inject Inject Custom user-defined functions
--shared-lib=shlib Local Path of the shared library

File system access:
These options can used to access the Back-end database management
System underlying file system

--file-read=rfile read a file from the Back-end DBMS file system
--file-write=wfile write a local file on the Back-end DBMS file system
--file-dest=dfile back-end DBMS Absolute filepath to write to

Operating system access:
These options can used to access the Back-end database management
System underlying operating system

--os-cmd=oscmd Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an OOB shell, Meterpreter or VNC
--os-smbrelay One click Prompt for an OOB shell, Meterpreter or VNC
--os-bof Stored procedure Buffer Overflow exploitation
--priv-esc Database Process User Privilege escalation
--msf-path=msfpath Local path where Metasploit Framework is installed
--tmp-path=tmppath Remote Absolute path of temporary files directory

Windows Registry access:
These options can used to access the Back-end database management
System Windows Registry

--reg-read read a Windows registry key value
--reg-add Write a Windows registry key value data
--reg-del Delete a Windows registry key value
--reg-key=regkey Windows Registry key
--reg-value=regval Windows Registry key value
--reg-data=regdata Windows registry key value data
--reg-type=regtype Windows registry key value type

General:
These options can used to set some general working parameters

-S Sessionfile Load session from a stored (. sqlite) file
-T Trafficfile Log all HTTP traffic into a textual file
--batch never ask for user input, use the default behaviour
--charset=charset force character encoding used for data retrieval
--crawl=crawldepth Crawl the website starting from the target URL
--csv-del=csvdel delimiting character used in CSV output (default ",")
--dump-format=du. Format of dumped data (CSV (default), HTML or SQLITE)
--eta Display for each output the estimated time of arrival
--flush-session Flush session files for current target
--forms Parse and test forms on target URL
--fresh-queries Ignore query results stored in session file
--hex Use DBMS hex function (s) for data retrieval
--output-dir=out. Custom Output Directory path
--parse-errors Parse and display DBMS error messages from responses
--pivot-column=p. Pivot Column Name
--save save options to a configuration INI file
--scope=scope Regexp to filter targets from provided proxy log
--test-filter=te. Select tests by payloads and/or titles (e.g. ROW)
--update Update Sqlmap

Miscellaneous:
-Z mnemonics use short mnemonics (e.g. "Flu,bat,ban,tec=eu")
--alert=alert Run host OS command (s) when the SQL injection is found
--answers=answers Set question answers (e.g. "quit=n,follow=n")
--beep make a beep sound when SQL injection is found
--cleanup clean up the DBMS from Sqlmap specific UDF and tables
--dependencies Check for Missing (non-core) Sqlmap dependencies
--disable-coloring Disable console output coloring
--gpage=googlepage use Google dork results from specified page number
--identify-waf make a through testing for a waf/ips/ids protection
--mobile imitate smartphone through HTTP user-agent header
--page-rank Display page Rank (PR) for Google dork results
--purge-output Safely remove all content from output directory
--smart Conduct through tests only if positive heuristic (s)
--sqlmap-shell Prompt for an interactive sqlmap shell
--wizard Simple Wizard Interface for beginner users

Chinese explanation of common parameters of Mysql-sqlmap