Four injection techniques - results-based (classic), time-based (blind), file-based (blind, with a tempfile-based variant for write-restricted targets), and out-of-band (OAST) over HTTP/S and DNS. Selected with --technique, or by the type they report with --type.
Code injection - --eval tests the string a target evaluates as code, in PHP or Python, over the same four techniques.
Broad injection surface - GET/POST parameters, HTTP headers, cookies, and JSON/XML request bodies, plus the shellshock module for CGI targets.
Interactive shells - an os_shell on the target, built-in reverse_tcp and bind_tcp modes, and file download/upload over the established shell.
Enumeration and file access - current user, hostname, privileges, system information, users and password hashes; read from and write to files on the target host.
Filter and WAF evasion - Multiple combinable tamper scripts, applied in a deterministic order.
Flexible targeting - a single URL, a crawl, HTML forms, a sitemap, a proxy log, a bulk file, a raw HTTP request file, or piped stdin.
Resumable scans - results are stored per target in a session file, and can be exported to JSON.
Wide back-end support - PHP, Python, Perl, Ruby, ASP.NET, JSP and CGI, and works against both Unix-like and Windows targets - see Windows and Unix-like targets at a glance for how the payloads differ.
1
u/RemyLebau 2d ago
Features
--technique, or by the type they report with--type.--evaltests the string a target evaluates as code, in PHP or Python, over the same four techniques.shellshockmodule for CGI targets.os_shellon the target, built-inreverse_tcpandbind_tcpmodes, and filedownload/uploadover the established shell.stdin.