SQLIer v0.8.2b Documentation
--------------------------------------------------------------------------------

   Table of Contents
 ---------------------

 Introduction

 I: Syntax
  I.a:  Argument Descriptions
  I.b:  Guessing Field Names

 II: General Usage

--------------------------------------------------------------------------------

  Introduction
----------------

SQLIer is a script that brute forces passwords through 'true/false' SQL
Injection vulnerabilities. With 'true/false' SQL Injection vulnerabilities, you
cannot actually query data out of the database, only ask a statement that is
returned 'true' or 'false'. SQLIer takes each character's ASCII code and asks
a 'higher/lower' question to the database, eventually reaching the actual
character code. This script also does not use quotes in the exploit to operate,
meaning it will work for a wider range of sites.

An 8 character password (containing any character from decimal ASCII code 1-127)
takes approximately 1 minute to crack.



  I. Syntax
-------------

sqlier [OPTIONS] [URL]

   I.a: Options
 ----------------

   -c [host]              Clear all exploit information stored for [host].
   -o [file]              Output cracked passwords to [file].
   -s [seconds]           Wait [seconds] between page requests.
   -u [usernames]         Usernames that will be brute forced from the database,
                          comma separated (Username1,Username2,Username3).
   -w [options]           Pass [options] to wget.


   I.b: Guessing Field Names
 -----------------------------

   --table-names [table_names]   Comma separated list of table names to guess.
   --user-fields [user_fields]   Comma separated list of username fields to
                                 guess.
   --pass-fields [pass_fields]   Comma separated list of password fields to
                                 guess.


  II. General Usage
---------------------

Given there is an SQL Injection vulnerability at: 
 http://example.com/sqlihole.php?id=1

Running "sqlier -s 10 http://example.com/sqlihole.php?id=1" will try to get
enough information to exploit passwords out of the database, waiting 10 seconds
in between each request.

If the table, username field, and password field names have been guessed
correctly, then the exploit is ready to brute force passwords out of the
database by passing usernames to query, like so:

 sqlier -s 10 example.com -u BCable,administrator,root,user4

However, in the instance that the built in field/table names do not guess the
correct fields, you can pass guesses like so:

 sqlier -s 10 example.com --table-names [table_names] --user-fields [user_fields] --pass-fields [pass_fields]

Until the correct table, username field, and password field names are known,
SQLIer cannot brute force passwords from the database.

Note: If "-s" is not passed, each request is done immediately after the last
      request.  This can raise red flags, however.