Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module).

Minor layout adjustments.

plugins/dbms/access/connector.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: 
+    User guide: 
+    API: 
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)

plugins/dbms/firebird/connector.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: 
+    User guide: 
+    API: 
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)

plugins/dbms/mssqlserver/connector.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+try:
+    import pymssql
+except ImportError, _:
+    pass
+
+from lib.core.data import logger
+from lib.core.exception import sqlmapConnectionException
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: http://pymssql.sourceforge.net/
+    User guide: http://pymssql.sourceforge.net/examples_pymssql.php
+    API: http://pymssql.sourceforge.net/ref_pymssql.php
+    Debian package: python-pymssql
+    License: LGPL
+
+    Possible connectors: http://wiki.python.org/moin/SQL%20Server
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)

plugins/dbms/mysql/connector.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+try:
+    import MySQLdb
+except ImportError, _:
+    pass
+
+from lib.core.data import conf
+from lib.core.data import logger
+from lib.core.exception import sqlmapConnectionException
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: http://mysql-python.sourceforge.net/
+    User guide: http://mysql-python.sourceforge.net/MySQLdb.html
+    API: http://mysql-python.sourceforge.net/MySQLdb-1.2.2/
+    Debian package: python-mysqldb
+    License: GPL
+
+    Possible connectors: http://wiki.python.org/moin/MySQL
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)
+
+    def connect(self):
+        self.initConnection()
+
+        try:
+            self.connector = MySQLdb.connect(host=self.hostname, user=self.user, passwd=self.password, db=self.db, port=self.port, connect_timeout=conf.timeout)
+        except MySQLdb.OperationalError, msg:
+            raise sqlmapConnectionException, msg[1]
+
+        self.setCursor()
+        self.connected()
+
+    def fetchall(self):
+        try:
+            return self.cursor.fetchall()
+        except MySQLdb.ProgrammingError, msg:
+            logger.log(8, msg[1])
+            return None
+
+    def execute(self, query):
+        logger.debug(query)
+
+        try:
+            self.cursor.execute(query)
+        except (MySQLdb.OperationalError, MySQLdb.ProgrammingError), msg:
+            logger.log(8, msg[1])
+        except MySQLdb.InternalError, msg:
+            raise sqlmapConnectionException, msg[1]
+
+        self.connector.commit()
+
+    def select(self, query):
+        self.execute(query)
+        return self.fetchall()
+
+    def setCursor(self):
+        self.cursor = self.connector.cursor()
+
+    def close(self):
+        self.cursor.close()
+        self.connector.close()

plugins/dbms/mysql/fingerprint.py

@@ -154,6 +154,12 @@ class Fingerprint(GenericFingerprint):
         * http://dev.mysql.com/doc/refman/6.0/en/news-6-0-x.html (manual has been withdrawn)
         """
 
+        infoMsg = "testing MySQL"
+        logger.info(infoMsg)
+
+        if conf.direct:
+            conf.dbmsConnector.connect()
+
         if conf.dbms in MYSQL_ALIASES and kb.dbmsVersion and kb.dbmsVersion[0].isdigit():
             setDbms("MySQL %s" % kb.dbmsVersion[0])
 
@@ -165,11 +171,7 @@ class Fingerprint(GenericFingerprint):
             if not conf.extensiveFp:
                 return True
 
-        infoMsg = "testing MySQL"
-        logger.info(infoMsg)
-
         randInt = str(randomInt(1))
-
         payload = agent.fullPayload(" AND CONNECTION_ID()=CONNECTION_ID()")
         result  = Request.queryPage(payload)
 
@@ -203,7 +205,7 @@ class Fingerprint(GenericFingerprint):
                     kb.dbmsVersion = [">= 5.5.0"]
 
                 # Check if it is MySQL >= 5.1.2 and < 5.5.0
-                elif inject.getValue("MID(@@table_open_cache, 1, 1)", unpack=False):
+                elif inject.getValue("SELECT MID(@@table_open_cache, 1, 1)", unpack=False):
                     if inject.getValue("SELECT %s FROM information_schema.GLOBAL_STATUS LIMIT 0, 1" % randInt, unpack=False, charsetType=2) == randInt:
                         kb.dbmsVersion = [">= 5.1.12", "< 5.5.0"]
                     elif inject.getValue("SELECT %s FROM information_schema.PROCESSLIST LIMIT 0, 1" % randInt, unpack=False, charsetType=2) == randInt:
@@ -216,11 +218,11 @@ class Fingerprint(GenericFingerprint):
                         kb.dbmsVersion = [">= 5.1.2", "< 5.1.5"]
 
                 # Check if it is MySQL >= 5.0.0 and < 5.1.2
-                elif inject.getValue("MID(@@hostname, 1, 1)", unpack=False):
+                elif inject.getValue("SELECT MID(@@hostname, 1, 1)", unpack=False):
                     kb.dbmsVersion = [">= 5.0.38", "< 5.1.2"]
                 elif inject.getValue("SELECT 1 FROM DUAL", charsetType=1) == "1":
                     kb.dbmsVersion = [">= 5.0.11", "< 5.0.38"]
-                elif inject.getValue("DATABASE() LIKE SCHEMA()"):
+                elif inject.getValue("SELECT DATABASE() LIKE SCHEMA()"):
                     kb.dbmsVersion = [">= 5.0.2", "< 5.0.11"]
                 else:
                     kb.dbmsVersion = [">= 5.0.0", "<= 5.0.1"]
@@ -237,24 +239,24 @@ class Fingerprint(GenericFingerprint):
                     return True
 
                 # Check which version of MySQL < 5.0.0 it is
-                coercibility = inject.getValue("COERCIBILITY(USER())")
+                coercibility = inject.getValue("SELECT COERCIBILITY(USER())")
 
                 if coercibility == "3":
                     kb.dbmsVersion = [">= 4.1.11", "< 5.0.0"]
                 elif coercibility == "2":
                     kb.dbmsVersion = [">= 4.1.1", "< 4.1.11"]
-                elif inject.getValue("CURRENT_USER()"):
+                elif inject.getValue("SELECT CURRENT_USER()"):
                     kb.dbmsVersion = [">= 4.0.6", "< 4.1.1"]
 
-                    if inject.getValue("CHARSET(CURRENT_USER())") == "utf8":
+                    if inject.getValue("SELECT CHARSET(CURRENT_USER())") == "utf8":
                         kb.dbmsVersion = ["= 4.1.0"]
                     else:
                         kb.dbmsVersion = [">= 4.0.6", "< 4.1.0"]
-                elif inject.getValue("FOUND_ROWS()", charsetType=1) == "0":
+                elif inject.getValue("SELECT FOUND_ROWS()", charsetType=1) == "0":
                     kb.dbmsVersion = [">= 4.0.0", "< 4.0.6"]
-                elif inject.getValue("CONNECTION_ID()"):
+                elif inject.getValue("SELECT CONNECTION_ID()"):
                     kb.dbmsVersion = [">= 3.23.14", "< 4.0.0"]
-                elif re.search("@[\w\.\-\_]+", inject.getValue("USER()")):
+                elif re.search("@[\w\.\-\_]+", inject.getValue("SELECT USER()")):
                     kb.dbmsVersion = [">= 3.22.11", "< 3.23.14"]
                 else:
                     kb.dbmsVersion = ["< 3.22.11"]

plugins/dbms/oracle/connector.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: 
+    User guide: 
+    API: 
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)

plugins/dbms/postgresql/connector.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+try:
+    import psycopg2
+except ImportError, _:
+    pass
+
+from lib.core.data import logger
+from lib.core.exception import sqlmapConnectionException
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: http://initd.org/psycopg/
+    User guide: http://initd.org/psycopg/docs/
+    API: http://initd.org/psycopg/docs/genindex.html
+    Debian package: python-psycopg2
+    License: GPL
+
+    Possible connectors: http://wiki.python.org/moin/PostgreSQL
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)
+
+    def connect(self):
+        self.initConnection()
+
+        try:
+            self.connector = psycopg2.connect(host=self.hostname, user=self.user, password=self.password, database=self.db, port=self.port)
+        except psycopg2.OperationalError, msg:
+            raise sqlmapConnectionException, msg
+
+        self.setCursor()
+        self.connected()
+
+    def fetchall(self):
+        try:
+            return self.cursor.fetchall()
+        except psycopg2.ProgrammingError, msg:
+            logger.log(8, msg)
+            return None
+
+    def execute(self, query):
+        logger.debug(query)
+
+        try:
+            self.cursor.execute(query)
+        except (psycopg2.OperationalError, psycopg2.ProgrammingError), msg:
+            logger.log(8, msg)
+        except psycopg2.InternalError, msg:
+            raise sqlmapConnectionException, msg
+
+        self.connector.commit()
+
+    def select(self, query):
+        self.execute(query)
+        return self.fetchall()
+
+    def setCursor(self):
+        self.cursor = self.connector.cursor()
+
+    def close(self):
+        self.cursor.close()
+        self.connector.close()

plugins/dbms/postgresql/filesystem.py

@@ -125,4 +125,4 @@ class Filesystem(GenericFilesystem):
         if confirm:
             self.askCheckWrittenFile(wFile, dFile, fileType)
 
-        inject.goStacked("SELECT lo_unlink(%d)" % self.oid)
+        inject.goStacked("SELECT lo_unlink(%d)" % self.oid)

plugins/dbms/postgresql/fingerprint.py

@@ -86,6 +86,12 @@ class Fingerprint(GenericFingerprint):
         * http://www.postgresql.org/docs/8.4/interactive/release.html (up to 8.4.2)
         """
 
+        infoMsg = "testing PostgreSQL"
+        logger.info(infoMsg)
+
+        if conf.direct:
+            conf.dbmsConnector.connect()
+
         if conf.dbms in PGSQL_ALIASES:
             setDbms("PostgreSQL")
 
@@ -94,9 +100,6 @@ class Fingerprint(GenericFingerprint):
             if not conf.extensiveFp:
                 return True
 
-        infoMsg = "testing PostgreSQL"
-        logger.info(infoMsg)
-
         randInt = str(randomInt(1))
 
         payload = agent.fullPayload(" AND %s::int=%s" % (randInt, randInt))
@@ -122,33 +125,33 @@ class Fingerprint(GenericFingerprint):
             if not conf.extensiveFp:
                 return True
 
-            if inject.getValue("DIV(6, 3)", unpack=False, charsetType=2) == "2":
+            if inject.getValue("SELECT DIV(6, 3)", unpack=False, charsetType=2) == "2":
                 kb.dbmsVersion = [">= 8.4.0"]
-            elif inject.getValue("SUBSTR(TRANSACTION_TIMESTAMP()::text, 1, 1)", unpack=False, charsetType=2) in ( "1", "2" ) and not inject.getValue("SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)", unpack=False, charsetType=2) in ( "1", "2" ):
+            elif inject.getValue("SELECT SUBSTR(TRANSACTION_TIMESTAMP()::text, 1, 1)", unpack=False, charsetType=2) in ( "1", "2" ) and not inject.getValue("SELECT SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)", unpack=False, charsetType=2) in ( "1", "2" ):
                 kb.dbmsVersion = [">= 8.3.0", "< 8.4"]
-            elif inject.getValue("SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)", unpack=False, charsetType=2):
+            elif inject.getValue("SELECT SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)", unpack=False, charsetType=2):
                 kb.dbmsVersion = [">= 8.2.0", "< 8.3.0"]
-            elif inject.getValue("GREATEST(5, 9, 1)", unpack=False, charsetType=2) == "9":
+            elif inject.getValue("SELECT GREATEST(5, 9, 1)", unpack=False, charsetType=2) == "9":
                 kb.dbmsVersion = [">= 8.1.0", "< 8.2.0"]
-            elif inject.getValue("WIDTH_BUCKET(5.35, 0.024, 10.06, 5)", unpack=False, charsetType=2) == "3":
+            elif inject.getValue("SELECT WIDTH_BUCKET(5.35, 0.024, 10.06, 5)", unpack=False, charsetType=2) == "3":
                 kb.dbmsVersion = [">= 8.0.0", "< 8.1.0"]
-            elif inject.getValue("SUBSTR(MD5('sqlmap'), 1, 1)", unpack=False):
+            elif inject.getValue("SELECT SUBSTR(MD5('sqlmap'), 1, 1)", unpack=False):
                 kb.dbmsVersion = [">= 7.4.0", "< 8.0.0"]
-            elif inject.getValue("SUBSTR(CURRENT_SCHEMA(), 1, 1)", unpack=False) == "p":
+            elif inject.getValue("SELECT SUBSTR(CURRENT_SCHEMA(), 1, 1)", unpack=False) == "p":
                 kb.dbmsVersion = [">= 7.3.0", "< 7.4.0"]
-            elif inject.getValue("BIT_LENGTH(1)") == "8":
+            elif inject.getValue("SELECT BIT_LENGTH(1)") == "8":
                 kb.dbmsVersion = [">= 7.2.0", "< 7.3.0"]
-            elif inject.getValue("SUBSTR(QUOTE_LITERAL('a'), 2, 1)", unpack=False) == "a":
+            elif inject.getValue("SELECT SUBSTR(QUOTE_LITERAL('a'), 2, 1)", unpack=False) == "a":
                 kb.dbmsVersion = [">= 7.1.0", "< 7.2.0"]
-            elif inject.getValue("POW(2, 3)", unpack=False, charsetType=2) == "8":
+            elif inject.getValue("SELECT POW(2, 3)", unpack=False, charsetType=2) == "8":
                 kb.dbmsVersion = [">= 7.0.0", "< 7.1.0"]
-            elif inject.getValue("MAX('a')") == "a":
+            elif inject.getValue("SELECT MAX('a')") == "a":
                 kb.dbmsVersion = [">= 6.5.0", "< 6.5.3"]
-            elif re.search("([\d\.]+)", inject.getValue("SUBSTR(VERSION(), 12, 5)", unpack=False)):
+            elif re.search("([\d\.]+)", inject.getValue("SELECT SUBSTR(VERSION(), 12, 5)", unpack=False)):
                 kb.dbmsVersion = [">= 6.4.0", "< 6.5.0"]
-            elif inject.getValue("SUBSTR(CURRENT_DATE, 1, 1)", unpack=False, charsetType=2) == "2":
+            elif inject.getValue("SELECT SUBSTR(CURRENT_DATE, 1, 1)", unpack=False, charsetType=2) == "2":
                 kb.dbmsVersion = [">= 6.3.0", "< 6.4.0"]
-            elif inject.getValue("SUBSTRING('sqlmap', 1, 1)", unpack=False) == "s":
+            elif inject.getValue("SELECT SUBSTRING('sqlmap', 1, 1)", unpack=False) == "s":
                 kb.dbmsVersion = [">= 6.2.0", "< 6.3.0"]
             else:
                 kb.dbmsVersion = ["< 6.2.0"]
@@ -167,7 +170,7 @@ class Fingerprint(GenericFingerprint):
         infoMsg = "fingerprinting the back-end DBMS operating system"
         logger.info(infoMsg)
 
-        self.createSupportTbl(self.fileTblName, self.tblField, "character(1000)")
+        self.createSupportTbl(self.fileTblName, self.tblField, "character(10000)")
         inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "VERSION()"))
 
         # Windows executables should always have ' Visual C++' or ' mingw'

plugins/dbms/sqlite/connector.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from plugins.generic.connector import Connector as GenericConnector
+
+class Connector(GenericConnector):
+    """
+    Homepage: 
+    User guide: 
+    API: 
+    """
+
+    def __init__(self):
+        GenericConnector.__init__(self)

plugins/generic/connector.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  021101301  USA
+"""
+
+from lib.core.data import conf
+from lib.core.data import logger
+from lib.core.exception import sqlmapUndefinedMethod
+
+class Connector:
+    """
+    This class defines generic dbms protocol functionalities for plugins.
+    """
+
+    def __init__(self):
+        self.connector = None
+        self.cursor = None
+
+    def initConnection(self):
+        self.user = conf.dbmsUser
+        self.password = conf.dbmsPass
+        self.hostname = conf.hostname
+        self.port = conf.port
+        self.db = conf.dbmsDb
+
+    def connected(self):
+        infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname)
+        infoMsg += ":%d established" % self.port
+        logger.info(infoMsg)
+
+    def connect(self):
+        errMsg  = "'connect' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg
+
+    def fetchall(self):
+        errMsg  = "'fetchall' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg
+
+    def execute(self, query):
+        errMsg  = "'execute' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg
+
+    def select(self, query):
+        errMsg  = "'select' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg
+
+    def setCursor(self):
+        errMsg  = "'setCursor' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg
+
+    def getCursor(self):
+        return self.cursor
+
+    def close(self):
+        errMsg  = "'close' method must be defined "
+        errMsg += "into the specific DBMS plugin"
+        raise sqlmapUndefinedMethod, errMsg

plugins/generic/enumeration.py

@@ -139,7 +139,7 @@ class Enumeration:
         condition  = ( kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ) )
         condition |= ( kb.dbms == "MySQL" and not kb.data.has_information_schema )
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if condition:
                 query = rootQuery["inband"]["query2"]
             else:
@@ -196,7 +196,7 @@ class Enumeration:
 
         logger.info(infoMsg)
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
                 query = rootQuery["inband"]["query2"]
             else:
@@ -393,7 +393,7 @@ class Enumeration:
                          "E": "EXECUTE"
                      }
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if kb.dbms == "MySQL" and not kb.data.has_information_schema:
                 query     = rootQuery["inband"]["query2"]
                 condition = rootQuery["inband"]["condition2"]
@@ -439,7 +439,7 @@ class Enumeration:
 
                             # In PostgreSQL we get 1 if the privilege is
                             # True, 0 otherwise
-                            if kb.dbms == "PostgreSQL" and privilege.isdigit():
+                            if kb.dbms == "PostgreSQL" and str(privilege).isdigit():
                                 for position, pgsqlPriv in pgsqlPrivs:
                                     if count == position and int(privilege) == 1:
                                         privileges.add(pgsqlPriv)
@@ -639,7 +639,7 @@ class Enumeration:
 
         rootQuery = queries[kb.dbms].dbs
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if kb.dbms == "MySQL" and not kb.data.has_information_schema:
                 query = rootQuery["inband"]["query2"]
             else:
@@ -696,7 +696,7 @@ class Enumeration:
 
         rootQuery = queries[kb.dbms].tables
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             query = rootQuery["inband"]["query"]
             condition = rootQuery["inband"]["condition"]
 
@@ -855,7 +855,7 @@ class Enumeration:
         infoMsg += "on database '%s'" % conf.db
         logger.info(infoMsg)
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if kb.dbms in ( "MySQL", "PostgreSQL" ):
                 query = rootQuery["inband"]["query"] % (conf.tbl, conf.db)
                 query += condQuery
@@ -1039,7 +1039,7 @@ class Enumeration:
             colQuery = "%s%s" % (colCond, colCondParam)
             colQuery = colQuery % column
 
-            if kb.unionPosition:
+            if kb.unionPosition or conf.direct:
                 query = rootQuery["inband"]["query"]
                 query += colQuery
                 query += dbsQuery
@@ -1095,7 +1095,7 @@ class Enumeration:
                 infoMsg += " '%s' in database '%s'" % (column, db)
                 logger.info(infoMsg)
 
-                if kb.unionPosition:
+                if kb.unionPosition or conf.direct:
                     query = rootQuery["inband"]["query2"]
 
                     if kb.dbms in ( "MySQL", "PostgreSQL" ):
@@ -1321,7 +1321,7 @@ class Enumeration:
 
         entriesCount = 0
 
-        if kb.unionPosition:
+        if kb.unionPosition or conf.direct:
             if kb.dbms == "Oracle":
                 query = rootQuery["inband"]["query"] % (colString, conf.tbl.upper())
             elif kb.dbms == "SQLite":
@@ -1349,7 +1349,7 @@ class Enumeration:
                         else:
                             colEntry = entry[index]
 
-                        colEntryLen = len(colEntry)
+                        colEntryLen = len(str(colEntry))
                         maxLen = max(colLen, colEntryLen)
 
                         if maxLen > kb.data.dumpedTable[column]["length"]:

plugins/generic/filesystem.py

@@ -29,13 +29,13 @@ from lib.core.agent import agent
 from lib.core.common import dataToOutFile
 from lib.core.common import randomStr
 from lib.core.common import readInput
+from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
 from lib.core.exception import sqlmapUndefinedMethod
 from lib.request import inject
 from lib.techniques.outband.stacked import stackedTest
 
-
 class Filesystem:
     """
     This class defines generic OS file system functionalities for plugins.
@@ -278,18 +278,19 @@ class Filesystem:
 
         self.checkDbmsOs()
 
-        if not kb.stackedTest:
+        if conf.direct or kb.stackedTest:
+            if kb.stackedTest:
+                debugMsg  = "going to read the file with stacked query SQL "
+                debugMsg += "injection technique"
+                logger.debug(debugMsg)
+
+            fileContent = self.stackedReadFile(rFile)
+        else:
             debugMsg  = "going to read the file with UNION query SQL "
             debugMsg += "injection technique"
             logger.debug(debugMsg)
 
             fileContent = self.unionReadFile(rFile)
-        else:
-            debugMsg  = "going to read the file with stacked query SQL "
-            debugMsg += "injection technique"
-            logger.debug(debugMsg)
-
-            fileContent = self.stackedReadFile(rFile)
 
         if fileContent in ( None, "" ) and kb.dbms != "PostgreSQL":
             self.cleanup(onlyFileTbl=True)
@@ -319,16 +320,17 @@ class Filesystem:
 
         self.checkDbmsOs()
 
-        if not kb.stackedTest:
+        if conf.direct or kb.stackedTest:
+            if kb.stackedTest:
+                debugMsg  = "going to upload the %s file with " % fileType
+                debugMsg += "stacked query SQL injection technique"
+                logger.debug(debugMsg)
+
+            self.stackedWriteFile(wFile, dFile, fileType, confirm)
+            self.cleanup(onlyFileTbl=True)
+        else:
             debugMsg  = "going to upload the %s file with " % fileType
             debugMsg += "UNION query SQL injection technique"
             logger.debug(debugMsg)
 
             self.unionWriteFile(wFile, dFile, fileType, confirm)
-        else:
-            debugMsg  = "going to upload the %s file with " % fileType
-            debugMsg += "stacked query SQL injection technique"
-            logger.debug(debugMsg)
-
-            self.stackedWriteFile(wFile, dFile, fileType, confirm)
-            self.cleanup(onlyFileTbl=True)

plugins/generic/misc.py

@@ -98,6 +98,9 @@ class Miscellaneous:
 
         query = queries[kb.dbms].substring % (queries[kb.dbms].banner, first, last)
 
+        if conf.direct:
+            query = "SELECT %s" % query
+
         kb.bannerFp["dbmsVersion"] = inject.getValue(query, unpack=False)
         kb.bannerFp["dbmsVersion"] = kb.bannerFp["dbmsVersion"].replace(",", "").replace("-", "").replace(" ", "")
 
@@ -127,7 +130,7 @@ class Miscellaneous:
 
         stackedTest()
 
-        if not kb.stackedTest:
+        if not kb.stackedTest and not conf.direct:
             return
 
         if kb.os == "Windows":

plugins/generic/takeover.py

@@ -51,7 +51,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
     def osCmd(self):
         stackedTest()
 
-        if kb.stackedTest:
+        if kb.stackedTest or conf.direct:
             web = False
         elif not kb.stackedTest and kb.dbms == "MySQL":
             infoMsg = "going to use a web backdoor for command execution"
@@ -74,7 +74,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
     def osShell(self):
         stackedTest()
 
-        if kb.stackedTest:
+        if kb.stackedTest or conf.direct:
             web = False
         elif not kb.stackedTest and kb.dbms == "MySQL":
             infoMsg = "going to use a web backdoor for command prompt"
@@ -99,7 +99,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
 
         stackedTest()
 
-        if kb.stackedTest:
+        if kb.stackedTest or conf.direct:
             web = False
 
             self.initEnv(web=web)
@@ -195,7 +195,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
             errMsg += "relay attack"
             raise sqlmapUnsupportedDBMSException(errMsg)
 
-        if not kb.stackedTest:
+        if not kb.stackedTest and not conf.direct:
             if kb.dbms in ( "PostgreSQL", "Microsoft SQL Server" ):
                 errMsg  = "on this back-end DBMS it is only possible to "
                 errMsg += "perform the SMB relay attack if stacked "
@@ -239,7 +239,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
     def osBof(self):
         stackedTest()
 
-        if not kb.stackedTest:
+        if not kb.stackedTest and not conf.direct:
             return
 
         if not kb.dbms == "Microsoft SQL Server" or kb.dbmsVersion[0] not in ( "2000", "2005" ):
@@ -267,7 +267,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
     def __regInit(self):
         stackedTest()
 
-        if not kb.stackedTest:
+        if not kb.stackedTest and not conf.direct:
             return
 
         self.checkDbmsOs()