PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-09 14:11:29 +00:00
Code Issues Projects Releases Wiki Activity

important update regarding (Bug #209) - probably more will be needed

Browse Source
This commit is contained in:
Miroslav Stampar
2010-10-29 16:11:50 +00:00
parent a921fe0d5d
commit 5a38ac7ea9
21 changed files with 130 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tamper/between.py
View File

@@ -7,10 +7,7 @@ Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.convert import urldecode
from lib.core.convert import urlencode
def tamper(place, value):
def tamper(value):
"""
Replaces '>' with 'NOT BETWEEN 0 AND #'
Example: 'A > B' becomes 'A NOT BETWEEN 0 AND B'
@@ -19,14 +16,12 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
value = urldecode(value)
retVal = ""
quote, doublequote, firstspace = False, False, False
for i in xrange(len(value)):
if not firstspace:
if value[i].isspace():
firstspace = True
retVal += " "
@@ -47,8 +42,5 @@ def tamper(place, value):
retVal += value[i]
if place != "URI":
retVal = urlencode(retVal)
return retVal

23
tamper/charencode.py
View File

@@ -11,7 +11,7 @@ import string
from lib.core.exception import sqlmapUnsupportedFeatureException
def tamper(place, value):
def tamper(value):
"""
Replaces value with urlencode of non-encoded chars in value
Example: 'SELECT%20FIELD%20FROM%20TABLE' becomes '%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45'
@@ -20,18 +20,15 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
retVal = ""
i = 0
retVal = ""
i = 0
while i < len(value):
if value[i] == '%' and (i < len(value) - 2) and value[i+1] in string.hexdigits and value[i+2] in string.hexdigits:
retVal += value[i:i+3]
i += 3
else:
retVal += '%%%X' % ord(value[i])
i += 1
else:
raise sqlmapUnsupportedFeatureException, "can't use tamper script '%s' with 'URI' type injections" % __name__
while i < len(value):
if value[i] == '%' and (i < len(value) - 2) and value[i+1] in string.hexdigits and value[i+2] in string.hexdigits:
retVal += value[i:i+3]
i += 3
else:
retVal += '%%%X' % ord(value[i])
i += 1
return retVal

23
tamper/charunicodeencode.py
View File

@@ -11,7 +11,7 @@ import string
from lib.core.exception import sqlmapUnsupportedFeatureException
def tamper(place, value):
def tamper(value):
"""
Replaces value with unicode-urlencode of non-encoded chars in value
Example: 'SELECT%20FIELD%20FROM%20TABLE' becomes '%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045'
@@ -20,18 +20,15 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
retVal = ""
i = 0
retVal = ""
i = 0
while i < len(value):
if value[i] == '%' and (i < len(value) - 2) and value[i+1] in string.hexdigits and value[i+2] in string.hexdigits:
retVal += "%%u00%s" % value[i+1:i+3]
i += 3
else:
retVal += '%%u00%X' % ord(value[i])
i += 1
else:
raise sqlmapUnsupportedFeatureException, "can't use tamper script '%s' with 'URI' type injections" % __name__
while i < len(value):
if value[i] == '%' and (i < len(value) - 2) and value[i+1] in string.hexdigits and value[i+2] in string.hexdigits:
retVal += "%%u00%s" % value[i+1:i+3]
i += 3
else:
retVal += '%%u00%X' % ord(value[i])
i += 1
return retVal

7
tamper/doubleencode.py
View File

@@ -10,16 +10,13 @@ See the file 'doc/COPYING' for copying permission
from lib.core.convert import urlencode
from lib.core.exception import sqlmapUnsupportedFeatureException
def tamper(place, value):
def tamper(value):
"""
Replaces value with urlencode(value)
Example: 'SELECT%20FIELD%20FROM%20TABLE' becomes 'SELECT%25%20FIELD%25%20FROM%25%20TABLE'
"""
if value:
if place != "URI":
value = urlencode(value, convall=True)
else:
raise sqlmapUnsupportedFeatureException, "can't use tamper script '%s' with 'URI' type injections" % __name__
value = urlencode(value, convall=True)
return value

13
tamper/ifnull2ifisnull.py
View File

@@ -7,18 +7,13 @@ Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.convert import urldecode
from lib.core.convert import urlencode
def tamper(place, value):
def tamper(value):
"""
Replaces 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'
Example: 'IFNULL(1, 2)' becomes 'IF(ISNULL(1), 2, 1)'
"""
if value and value.find("IFNULL") > -1:
if place != "URI":
value = urldecode(value)
while value.find("IFNULL(") > -1:
index = value.find("IFNULL(")
@@ -28,11 +23,14 @@ def tamper(place, value):
for i in xrange(index + len("IFNULL("), len(value)):
if deepness == 1 and value[i] == ',':
comma = i
elif deepness == 1 and value[i] == ')':
end = i
break
elif value[i] == '(':
deepness += 1
elif value[i] == ')':
deepness -= 1
@@ -44,7 +42,4 @@ def tamper(place, value):
else:
break
if place != "URI":
value = urlencode(value)
return value

8
tamper/randomcase.py
View File

@@ -10,8 +10,6 @@ See the file 'doc/COPYING' for copying permission
import re
from lib.core.common import randomRange
from lib.core.convert import urldecode
from lib.core.convert import urlencode
from lib.core.data import kb
def tamper(place, value):
@@ -23,9 +21,6 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
retVal = urldecode(retVal)
for match in re.finditer(r"[A-Za-z_]+", retVal):
word = match.group()
@@ -37,7 +32,4 @@ def tamper(place, value):
retVal = retVal.replace(word, newWord)
if place != "URI":
retVal = urlencode(retVal)
return retVal

10
tamper/randomcomments.py
View File

@@ -10,11 +10,9 @@ See the file 'doc/COPYING' for copying permission
import re
from lib.core.common import randomRange
from lib.core.convert import urldecode
from lib.core.convert import urlencode
from lib.core.data import kb
def tamper(place, value):
def tamper(value):
"""
Add random comments to value
Example: 'INSERT' becomes 'IN/**/S/**/ERT'
@@ -23,9 +21,6 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
retVal = urldecode(retVal)
for match in re.finditer(r"[A-Za-z_]+", retVal):
word = match.group()
@@ -41,7 +36,4 @@ def tamper(place, value):
newWord += word[-1]
retVal = retVal.replace(word, newWord)
if place != "URI":
retVal = urlencode(retVal)
return retVal

11
tamper/space2comment.py
View File

@@ -7,10 +7,7 @@ Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.convert import urldecode
from lib.core.convert import urlencode
def tamper(place, value):
def tamper(value):
"""
Replaces ' ' with '/**/'
Example: 'SELECT id FROM users' becomes 'SELECT/**/id/**/FROM users'
@@ -19,9 +16,6 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
value = urldecode(value)
retVal = ""
quote, doublequote, firstspace = False, False, False
@@ -44,8 +38,5 @@ def tamper(place, value):
retVal += value[i]
if place != "URI":
retVal = urlencode(retVal)
return retVal

11
tamper/space2plus.py
View File

@@ -7,10 +7,7 @@ Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.convert import urldecode
from lib.core.convert import urlencode
def tamper(place, value):
def tamper(value):
"""
Replaces ' ' with '/**/'
Example: 'SELECT id FROM users' becomes 'SELECT+id+FROM+users'
@@ -19,9 +16,6 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
value = urldecode(value)
retVal = ""
quote, doublequote, firstspace = False, False, False
@@ -44,8 +38,5 @@ def tamper(place, value):
retVal += value[i]
if place != "URI":
retVal = urlencode(retVal)
return retVal

11
tamper/space2randomblank.py
View File

@@ -9,10 +9,7 @@ See the file 'doc/COPYING' for copying permission
import random
from lib.core.convert import urldecode
from lib.core.convert import urlencode
def tamper(place, value):
def tamper(value):
"""
Replaces ' ' with a random blank char from a set ('\r', '\n', '\t')
Example: 'SELECT id FROM users' becomes 'SELECT\rid\tFROM\nusers'
@@ -22,9 +19,6 @@ def tamper(place, value):
retVal = value
if value:
if place != "URI":
value = urldecode(value)
retVal = ""
quote, doublequote, firstspace = False, False, False
@@ -47,8 +41,5 @@ def tamper(place, value):
retVal += value[i]
if place != "URI":
retVal = urlencode(retVal)
return retVal