From ab64bc79a448fc419938a27cdb477acce488acb4 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Tue, 30 Jun 2026 20:47:17 +0200 Subject: [PATCH] Updated Usage (markdown) --- Usage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Usage.md b/Usage.md index e05e0d9..661cb29 100644 --- a/Usage.md +++ b/Usage.md @@ -1114,7 +1114,7 @@ Besides classic SQL injection, sqlmap can also detect and exploit several other * `--xpath`: XPath injection * `--ssti`: server-side template injection -Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, `--ssti-query` evaluates a single expression and `--ssti-shell` opens an interactive expression shell, while `--os-cmd` and `--os-shell` run operating system commands through the template engine where it allows it. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`). +Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, where the engine allows it, `--os-cmd` and `--os-shell` run operating system commands through the template engine. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`). ### Seconds to delay the DBMS response for time-based blind SQL injection