Minor enhancemet to support also --regexp, --excl-str and --excl-reg

options rather than only --string when comparing HTTP responses page
content

lib/request/comparison.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2006-2008 Bernardo Damele A. G. <bernardo.damele@gmail.com>
+                        and Daniele Bellucci <daniele.bellucci@gmail.com>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+
+
+import md5
+import re
+
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+
+
+def comparison(page, headers=None, content=False):
+    regExpResults = None
+
+    if conf.eString and conf.eString in page:
+        index              = page.index(conf.eString)
+        length             = len(conf.eString)
+        pageWithoutString  = page[:index]
+        pageWithoutString += page[index+length:]
+        page               = pageWithoutString
+
+    if conf.eRegexp:
+        regExpResults = re.findall(conf.eRegexp, page, re.I | re.M)
+
+    if conf.eRegexp and regExpResults:
+        for regExpResult in regExpResults:
+            index              = page.index(regExpResult)
+            length             = len(regExpResult)
+            pageWithoutRegExp  = page[:index]
+            pageWithoutRegExp += page[index+length:]
+            page               = pageWithoutRegExp
+
+    if conf.string:
+        if conf.string in page:
+            return True
+        else:
+            return False
+
+    elif conf.regexp:
+        if re.search(conf.regexp, page, re.I | re.M):
+            return True
+        else:
+            return False
+
+    else:
+        return md5.new(page).hexdigest()

lib/request/connect.py

@@ -42,7 +42,7 @@ from lib.core.exception import sqlmapConnectionException
 from lib.core.settings import RETRIES
 from lib.request.basic import forgeHeaders
 from lib.request.basic import parseResponse
-
+from lib.request.comparison import comparison
 
 
 class Connect:
@@ -190,15 +190,15 @@ class Connect:
                 warnMsg += "status code, try to force the HTTP User-Agent "
                 warnMsg += "header with option --user-agent or -a"
 
+            if "BadStatusLine" not in tbMsg:
+                warnMsg += " or proxy"
+
             if conf.multipleTargets:
                 warnMsg += ", skipping to next url"
                 logger.warn(warnMsg)
 
                 return None
 
-            if "BadStatusLine" not in tbMsg:
-                warnMsg += " or proxy"
-
             if conf.retries < RETRIES:
                 conf.retries += 1
 
@@ -207,6 +207,7 @@ class Connect:
 
                 time.sleep(1)
                 return Connect.__getPageProxy(get=get, post=post, cookie=cookie, ua=ua, direct=direct, multipart=multipart)
+
             else:
                 raise sqlmapConnectionException, warnMsg
 
@@ -220,7 +221,7 @@ class Connect:
 
         logger.log(8, responseMsg)
 
-        return page
+        return page, responseHeaders
 
 
     @staticmethod
@@ -263,15 +264,9 @@ class Connect:
             else:
                 ua = conf.parameters["User-Agent"]
 
-        page = Connect.getPage(get=get, post=post, cookie=cookie, ua=ua)
+        page, headers = Connect.getPage(get=get, post=post, cookie=cookie, ua=ua)
 
-        # TODO: create a comparison library and move these checks there
         if content:
             return page
-        elif conf.string:
-            if conf.string in page:
-                return True
-            else:
-                return False
         else:
-            return md5.new(page).hexdigest()
+            return comparison(page, headers, content)