Skip to content

Commit 5a08367

Browse files
vizzdoomvizzdoom
committed
v.20250620b
- layout changes - better tabs - color adjustments - added --text-only option - added --titles option
1 parent 1b90567 commit 5a08367

File tree

3 files changed

+218
-229
lines changed

3 files changed

+218
-229
lines changed

‎app.js

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,12 @@ class SQLMapGenerator {
322322

323323
const code = document.getElementById('code').value.trim();
324324
if (code && code >= 100 && code <= 599) config['--code'] = code;
325+
326+
const textOnly = document.getElementById('textOnly').checked
327+
if (textOnly) config['--text-only'] = textOnly;
328+
329+
const titles = document.getElementById('titles').checked
330+
if (titles) config['--titles'] = titles;
325331

326332
// Request options
327333
const host = document.getElementById('host').value.trim();
@@ -507,7 +513,7 @@ class SQLMapGenerator {
507513
'--tor', '--check-tor', '--tor-port', '--tor-type',
508514
'--force-ssl', '--keep-alive', '--null-connection', '--http2',
509515
'--method', '--data', '--param-del',
510-
'--string', '--not-string', '--regexp', '--code',
516+
'--string', '--not-string', '--regexp', '--code', '--text-only', '--titles',
511517
'--host', '-A', '--mobile', '--random-agent', "--referer", "-H",
512518
'--cookie', '--cookie-del', '--live-cookies', '--load-cookies', '--drop-set-cookie',
513519
'--auth-type', '--auth-cred', '--auth-file',
@@ -785,6 +791,8 @@ class SQLMapGenerator {
785791
'--not-string': 'notString',
786792
'--regexp': 'regexp',
787793
'--code': 'code',
794+
'--titles': 'titles',
795+
'--text-only': 'textOnly',
788796
'--mobile': 'mobileUserAgent',
789797
'--random-agent': 'userAgent',
790798
'--referer': 'referer',

‎index.html

Lines changed: 56 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ <h1><a href="?">SQLMap Command Builder</a></h1>
1616
</p>
1717

1818
<p>
19-
<a href="https://github.com/vizzdoom/sqlmap-command-builder" target="_blank">Github Repository v.20250620</a> for <a target="_blank" href="https://github.com/sqlmapproject/sqlmap/releases">SQLMap 1.9.4</a><br />
19+
<a href="https://github.com/vizzdoom/sqlmap-command-builder" target="_blank">Github Repository v.20250620b</a> for <a target="_blank" href="https://github.com/sqlmapproject/sqlmap/releases">SQLMap 1.9.4</a><br />
2020
vizzdoom/at/gmail/dot/com
2121
</p>
2222
</header>
@@ -469,44 +469,72 @@ <h3>Parameters</h3>
469469
<div class="form-group" title="The --param-filter parameter restrict scans to specific components of HTTP requests, improving efficiency and reducing noise. Accepted comma-separated values include GET (URL parameters), POST (request body), COOKIE, HOST, USER-AGENT, and REFERER.
470470
This switch can isolate high-risk areas like API endpoints (test only POST body parameters) or speed-up headers injection testing (specifying COOKIE,HOST,USER-AGENT,REFERER filter with --level=5 focuses scans on headers, ignoring GET/POST parameters).
471471
The filter reduces scan times by 30-40% in header-rich environments and minimizes false positives from unnecessary parameters.">
472-
<label class="form-label" title="Skip testing for given parameter(s)" for="paramFilter">PARAMETERS SCAN CATEGORY ALLOWLIST<br/><span>--param-filter</span></label>
472+
<label class="form-label" for="paramFilter">PARAMETERS SCAN CATEGORY ALLOWLIST<br/><span>--param-filter</span></label>
473473
<input type="text" id="paramFilter" class="form-control" placeholder="GET,POST,COOKIE,USER-AGENT...">
474474
</div>
475475
<!-- --prefix -->
476476
<div class="form-group" title="The --prefix parameter allows you to prepend a custom string to every SQL injection payload before it is sent to the target application.
477477
This parameter is essential when applications require specific SQL syntax or characters before the actual injection payload to construct a valid query.
478478
It is particularly useful when dealing with applications that embed parameters within complex SQL queries requiring specific opening syntax, such as closing quotes or parentheses before the injection point.">
479-
<label class="form-label" title="Injection payload prefix string" for="prefix">Prefix<br/><span>--prefix</span></label>
479+
<label class="form-label" for="prefix">Prefix<br/><span>--prefix</span></label>
480480
<input type="text" id="prefix" class="form-control" placeholder="')">
481481
</div>
482482
<!-- --suffix -->
483483
<div class="form-group" title="The --suffix parameter enables you to append a custom string to every SQL injection payload after the main injection code.
484484
It is crucial when applications require specific closing characters or comments to prevent SQL syntax errors, such as SQL comments (--) or closing parentheses to maintain query validity.">
485-
<label class="form-label" title="Injection payload suffix string" for="suffix">Suffix<br/><span>--suffix</span></label>
485+
<label class="form-label" for="suffix">Suffix<br/><span>--suffix</span></label>
486486
<input type="text" id="suffix" class="form-control" placeholder="-- -">
487487
</div>
488488

489489
<h3>Detection</h3>
490490
<!-- --string -->
491-
<div class="form-group" title="">
492-
<label class="form-label" title="" for="string">String when query evaluated<br/><span>--string</span></label>
491+
<div class="form-group" title="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content. Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
492+
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
493+
Instead of --string, the user can use a --regexp.
494+
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">
495+
<label class="form-label" for="string">String when query evaluated<br/><span>--string</span></label>
493496
<input type="text" id="string" class="form-control" placeholder="">
494497
</div>
495-
<!-- --not-string -->
496-
<div class="form-group" title="">
497-
<label class="form-label" title="" for="notString">String when query not evaluated<br/><span>--not-string</span></label>
498-
<input type="text" id="notString" class="form-control" placeholder="">
499-
</div>
500498
<!-- --regexp-->
501-
<div class="form-group" title="">
502-
<label class="form-label" title="" for="regexp">Regexp to match<br/><span>--regexp</span></label>
499+
<div class="form-group" title="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content. Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
500+
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
501+
Instead of --string, the user can use a --regexp.
502+
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">
503+
<label class="form-label" for="regexp">Regexp to match<br/><span>--regexp</span></label>
503504
<input type="text" id="regexp" class="form-control" placeholder="">
504505
</div>
506+
<!-- --not-string -->
507+
<div class="form-group" title="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content. Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
508+
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
509+
Instead of --string, the user can use a --regexp.
510+
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">
511+
<label class="form-label" for="notString">String when query not evaluated<br/><span>--not-string</span></label>
512+
<input type="text" id="notString" class="form-control" placeholder="">
513+
</div>
505514
<!-- --code -->
506-
<div class="form-group" title="">
507-
<label class="form-label" title="" for="code">HTTP code to match<br/><span>--code</span></label>
515+
<div class="form-group" title="Use this in cases when you know that the distinction of a True query from a False one can be done using HTTP code.">
516+
<label class="form-label" for="code">HTTP code to match<br/><span>--code</span></label>
508517
<input type="number" id="code" class="form-control" min="100", max="599", step="1" placeholder="201">
509518
</div>
519+
<!-- --titles -->
520+
<div class="form-group" title="Turn on when you knows that the distinction of a True query from a False one can be done using HTML title (e.g. Welcome for True and Forbidden for False).">
521+
<label class="form-label">DETECT COMPARING TITLES</label>
522+
<label class="checkbox-label">
523+
<input type="checkbox" id="titles">
524+
<span class="checkmark"></span>
525+
<span class="checkbox-label__text">--titles</span>
526+
</label>
527+
</div>
528+
<!-- --text-only -->
529+
<div class="form-group" title="In cases with lot of active content (e.g. scripts, embeds, etc.) in the HTTP responses' body, you can filter pages (switch --text-only) just for their textual content.
530+
This way, in a good number of cases, you can automatically tune the detection engine.">
531+
<label class="form-label">FILTER ACTIVE CONTENT</label>
532+
<label class="checkbox-label">
533+
<input type="checkbox" id="textOnly">
534+
<span class="checkmark"></span>
535+
<span class="checkbox-label__text">--text-only</span>
536+
</label>
537+
</div>
510538

511539
<h3>Attack Optimalization</h3>
512540
<!-- --level -->
@@ -584,6 +612,7 @@ <h3>Attack Optimalization</h3>
584612
<label class="form-label" for="secondUrl">SECOND ORDER REQUEST FILE<br/><span>--second-req</span></label>
585613
<input type="text" id="secondReq" class="form-control" placeholder="second-order-request.txt">
586614
</div>
615+
587616
<!-- Attack techniques -->
588617
<div class="form-group">
589618
<label class="form-label" title="">ATTACK TECHNIQUES<br/><span>--technique</span></label>
@@ -673,18 +702,6 @@ <h3>Attack Optimalization</h3>
673702
<span class="checkmark"></span>
674703
<span>--predict-output</span>
675704
</label>
676-
<!-- --text-only -->
677-
<label class="checkbox-label" title="Compare pages based only on the textual content.">
678-
<input type="checkbox" id="predictOutput">
679-
<span class="checkmark"></span>
680-
<span>--text-only</span>
681-
</label>
682-
<!-- --titles -->
683-
<label class="checkbox-label" title="Compare pages based only on their titles.">
684-
<input type="checkbox" id="titles">
685-
<span class="checkmark"></span>
686-
<span>--titles</span>
687-
</label>
688705
</div>
689706
</div>
690707
</div>
@@ -697,6 +714,18 @@ <h3>Attack Optimalization</h3>
697714
<div class="card">
698715
<div class="card__body">
699716
<div class="form-grid">
717+
<div class="form-group">
718+
<label class="form-label" title="DBMS database to enumerate" for="database">DATABASE(S) NAME FOR ENUMERATION<br/><span>-D</span></label>
719+
<input type="text" id="database" class="form-control" placeholder="database_name1,database_name2">
720+
</div>
721+
<div class="form-group">
722+
<label class="form-label" title="DBMS database table(s) to enumerate" for="table">TABLE(S) NAME FOR ENUMERATION<br/><span>-T</span></label>
723+
<input type="text" id="table" class="form-control" placeholder="table_name1,table_name2">
724+
</div>
725+
<div class="form-group">
726+
<label class="form-label" title="DBMS database table column(s) to enumerate" for="column">COLUMN(S) NAME FOR ENUMERATION<br/><span>-C</span></label>
727+
<input type="text" id="column" class="form-control" placeholder="column_name1,column_name2">
728+
</div>
700729
<div class="checkbox-grid" title="These options can be used to enumerate the back-end database management system information, structure and data contained in the tables">
701730
<label class="form-label">ENUMERATION AND DATA EXFILTRATION</label>
702731
<label class="checkbox-label" title="Retrieve DBMS current user">
@@ -735,18 +764,6 @@ <h3>Attack Optimalization</h3>
735764
<span>--dump-all</span>
736765
</label>
737766
</div>
738-
<div class="form-group">
739-
<label class="form-label" title="DBMS database to enumerate" for="database">DATABASE(S) NAME FOR ENUMERATION<br/><span>-D</span></label>
740-
<input type="text" id="database" class="form-control" placeholder="database_name1,database_name2">
741-
</div>
742-
<div class="form-group">
743-
<label class="form-label" title="DBMS database table(s) to enumerate" for="table">TABLE(S) NAME FOR ENUMERATION<br/><span>-T</span></label>
744-
<input type="text" id="table" class="form-control" placeholder="table_name1,table_name2">
745-
</div>
746-
<div class="form-group">
747-
<label class="form-label" title="DBMS database table column(s) to enumerate" for="column">COLUMN(S) NAME FOR ENUMERATION<br/><span>-C</span></label>
748-
<input type="text" id="column" class="form-control" placeholder="column_name1,column_name2">
749-
</div>
750767
</div>
751768
</div>
752769
</div>

0 commit comments

Comments
 (0)