PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-02-01 02:59:01 +00:00
Code Issues Projects Releases Wiki Activity

adding switch --eval

Browse Source
This commit is contained in:
Miroslav Stampar
2011-11-21 16:41:02 +00:00
parent 0ce885e6e6
commit 65b2b0ad87
7 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
lib/request/connect.py
View File

@@ -22,6 +22,7 @@ from lib.core.common import average
from lib.core.common import calculateDeltaSeconds
from lib.core.common import clearConsoleLine
from lib.core.common import cpuThrottle
from lib.core.common import executeCode
from lib.core.common import extractRegexResult
from lib.core.common import getCurrentThreadData
from lib.core.common import getFilteredPageContent
@@ -603,6 +604,31 @@ class Connect:
elif item == PLACE.COOKIE and cookie:
cookie = _randomizeParameter(cookie, randomParameter)
if conf.evalCode:
variables = {}
originals = {}
if get:
executeCode(get.replace("&", ";"), variables)
if post:
executeCode(post.replace("&", ";"), variables)
originals.update(variables)
executeCode(conf.evalCode, variables)
for name, value in variables.items():
if name != "__builtins__" and originals.get(name, "") != value:
if isinstance(value, (basestring, int)):
value = unicode(value)
if '%s=' % name in (get or ""):
get = re.sub("(%s=)([^&]+)" % name, "\g<1>%s" % value, get)
elif '%s=' % name in (post or ""):
post = re.sub("(%s=)([^&]+)" % name, "\g<1>%s" % value, post)
elif post:
post += "&%s=%s" % (name, value)
else:
get += "&%s=%s" % (name, value)
get = urlencode(get, limit=True)
if post and place != PLACE.POST and hasattr(post, UNENCODED_ORIGINAL_VALUE):
post = getattr(post, UNENCODED_ORIGINAL_VALUE)

2
lib/request/inject.py
View File

@@ -63,7 +63,9 @@ def __goInference(payload, expression, charsetType=None, firstChar=None, lastCha
dataToSessionFile("[%s][%s][%s][%s][" % (conf.url, kb.injection.place, conf.parameters[kb.injection.place], expression))
kb.inferenceMode = True
count, value = bisection(payload, expression, length, charsetType, firstChar, lastChar, dump)
kb.inferenceMode = False
if not kb.bruteMode:
debugMsg = "performed %d queries in %d seconds" % (count, calculateDeltaSeconds(start))