PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

improvement for limited queries (more stable to have TOP/LIMIT/OFFSET mechanisms as part of a subquery)

Browse Source
This commit is contained in:
Miroslav Stampar
2011-07-31 23:40:09 +00:00
parent 0627bb02cb
commit 018d7ed646
2 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
lib/core/agent.py
View File

@@ -522,7 +522,7 @@ class Agent:
return concatenatedQuery
def forgeInbandQuery(self, query, position, count, comment, prefix, suffix, char, multipleUnions=None):
def forgeInbandQuery(self, query, position, count, comment, prefix, suffix, char, multipleUnions=None, limited=False):
"""
Take in input an query (pseudo query) string and return its
processed UNION ALL SELECT query.
@@ -558,17 +558,16 @@ class Agent:
inbandQuery = self.prefixQuery("UNION ALL SELECT ", prefix=prefix)
if query.startswith("TOP"):
# TOP enumeration on DBMS.MSSQL is too specific and it has to go
# into its own brackets because those NULLs cause problems with
# ORDER BY clause
if Backend.isDbms(DBMS.MSSQL):
inbandQuery += ",".join(map(lambda x: char if x != position else '(SELECT %s)' % query, range(0, count)))
inbandQuery = self.suffixQuery(inbandQuery, comment, suffix)
if limited:
inbandQuery += ",".join(map(lambda x: char if x != position else '(SELECT %s)' % query, range(0, count)))
inbandQuery = self.suffixQuery(inbandQuery, comment, suffix)
inbandQuery += FROM_TABLE.get(Backend.getIdentifiedDbms(), "")
return inbandQuery
return inbandQuery
topNum = re.search("\ATOP\s+([\d]+)\s+", query, re.I).group(1)
topNumRegex = re.search("\ATOP\s+([\d]+)\s+", query, re.I)
if topNumRegex:
topNum = topNumRegex.group(1)
query = query[len("TOP %s " % topNum):]
inbandQuery += "TOP %s " % topNum