sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool
http://sqlmap.org
Other
31.96k stars 5.67k forks source link

--Search option request #5450

Closed fantasy04 closed 1 year ago

fantasy04 commented 1 year ago

Hi,

I would like to request a new feature for --search function where we can just command to dump only multiple columns like this:

--search -C mail,pass,pwd,salt,hash

Result: will dump output format like this:

mail:pass mail:pass:salt mail:pwd mail:hash

New feature where we can make column "mail" as main columns and it will not dump single column like:

mail pass salt hash ...ect

This will be a great option,

Thanks and appreciate your continuing support for this amazing project,

stamparm commented 1 year ago

this is false statement:

...we can make column "mail" as main columns and it will not dump single column like:

mail
pass
salt
hash
...ect

this is the proper way how sqlmap works:

$ python sqlmap.py -u "http://testphp.vulnweb.com/artists.php?artist=1" --dump -T artists -D acuart -C artist_id,aname
...
+-----------+---------+
| artist_id | aname   |
+-----------+---------+
| 1         | r4w8173 |
| 2         | Blad3   |
| 3         | lyzae   |
+-----------+---------+

i.e. there is no dumping of single column (values) as you are stating (NOTE: if there is is some obscure case, that would be because sqlmap was not able to combine multiple column values because of some limitation)


furthermore, any kind of mish-mesh of column values to the way you are proposing (i.e. convenient for you to have inside a report - like username:<password_alike_column>) won't be done. you can do that stuff manually, based on sqlmap results