Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.

All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!

lib/core/agent.py

@@ -12,7 +12,6 @@ import re
 from xml.etree import ElementTree as ET
 
 from lib.core.common import getCompiledRegex
-from lib.core.common import getInjectionCase
 from lib.core.common import randomInt
 from lib.core.common import randomStr
 from lib.core.convert import urlencode
@@ -23,6 +22,8 @@ from lib.core.datatype import advancedDict
 from lib.core.enums import DBMS
 from lib.core.enums import PLACE
 from lib.core.exception import sqlmapNoneDataException
+from lib.core.settings import ERROR_START_CHAR
+from lib.core.settings import ERROR_END_CHAR
 from lib.core.settings import PAYLOAD_DELIMITER
 
 class Agent:
@@ -70,28 +71,28 @@ class Agent:
             falseValue = " AND %d=%d" % (randInt, randInt + 1)
 
         # After identifing the injectable parameter
-        if kb.injPlace == PLACE.UA:
-            retValue = kb.injParameter.replace(kb.injParameter,
-                                               self.addPayloadDelimiters("%s%s" % (negValue, kb.injParameter + falseValue + newValue)))
-        elif kb.injParameter:
-            paramString = conf.parameters[kb.injPlace]
-            paramDict = conf.paramDict[kb.injPlace]
-            value = paramDict[kb.injParameter]
+        if kb.injection.place == PLACE.UA:
+            retValue = kb.injection.parameter.replace(kb.injection.parameter,
+                                               self.addPayloadDelimiters("%s%s" % (negValue, kb.injection.parameter + falseValue + newValue)))
+        elif kb.injection.parameter:
+            paramString = conf.parameters[kb.injection.place]
+            paramDict = conf.paramDict[kb.injection.place]
+            value = paramDict[kb.injection.parameter]
 
-            if "POSTxml" in conf.paramDict and kb.injPlace == PLACE.POST:
+            if "POSTxml" in conf.paramDict and kb.injection.place == PLACE.POST:
                 root = ET.XML(paramString)
-                iterator = root.getiterator(kb.injParameter)
+                iterator = root.getiterator(kb.injection.parameter)
 
                 for child in iterator:
                     child.text = self.addPayloadDelimiters(negValue + value + falseValue + newValue)
 
                 retValue = ET.tostring(root)
-            elif kb.injPlace == PLACE.URI:
+            elif kb.injection.place == PLACE.URI:
                 retValue = paramString.replace("*",
                                                self.addPayloadDelimiters("%s%s" % (negValue, falseValue + newValue)))
             else:
-                retValue = paramString.replace("%s=%s" % (kb.injParameter, value),
-                                               "%s=%s" % (kb.injParameter, self.addPayloadDelimiters(negValue + value + falseValue + newValue)))
+                retValue = paramString.replace("%s=%s" % (kb.injection.parameter, value),
+                                               "%s=%s" % (kb.injection.parameter, self.addPayloadDelimiters(negValue + value + falseValue + newValue)))
 
         # Before identifing the injectable parameter
         elif parameter == PLACE.UA:
@@ -125,6 +126,20 @@ class Agent:
 
         return payload
 
+    def cleanupPayload(self, payload):
+        randInt = randomInt()
+        randInt1 = randomInt()
+        randStr = randomStr()
+
+        payload = payload.replace("[RANDNUM]", str(randInt))
+        payload = payload.replace("[RANDNUM1]", str(randInt1))
+        payload = payload.replace("[RANDSTR]", randStr)
+        payload = payload.replace("[ERROR_START_CHAR]", ERROR_START_CHAR)
+        payload = payload.replace("[ERROR_END_CHAR]", ERROR_END_CHAR)
+        payload = payload.replace("[SLEEPTIME]", str(conf.timeSec))
+
+        return payload
+
     def prefixQuery(self, string):
         """
         This method defines how the input string has to be escaped
@@ -135,24 +150,9 @@ class Agent:
         if conf.direct:
             return self.payloadDirect(string)
 
-        logic = conf.logic
-        query = str()
-        case = getInjectionCase(kb.injType)
-
-        if kb.parenthesis is not None:
-            parenthesis = kb.parenthesis
-        else:
-            raise sqlmapNoneDataException, "unable to get the number of parenthesis"
-
-        if case is None:
-            raise sqlmapNoneDataException, "unsupported injection type"
-
-        if conf.prefix:
-            query = "%s " % conf.prefix.strip()
-        else:
-            query = case.usage.prefix.format % eval(case.usage.prefix.params)
-
+        query = "%s " % kb.injection.prefix
         query += string
+        query = self.cleanupPayload(query)
 
         return query
 
@@ -165,27 +165,11 @@ class Agent:
         if conf.direct:
             return self.payloadDirect(string)
 
-        logic = conf.logic
-        case = getInjectionCase(kb.injType)
-
-        if case is None:
-            raise sqlmapNoneDataException, "unsupported injection type"
-
-        randInt = randomInt()
-        randStr = randomStr()
-
-        if kb.parenthesis is not None:
-            parenthesis = kb.parenthesis
-        else:
-            raise sqlmapNoneDataException, "unable to get the number of parenthesis"
-
-        if comment:
+        if comment is not None:
             string += comment
 
-        if conf.suffix:
-            string += " %s" % conf.suffix
-        else:
-            string += case.usage.suffix.format % eval(case.usage.suffix.params)
+        string += " %s" % kb.injection.suffix
+        string = self.cleanupPayload(string)
 
         return string
 

lib/core/common.py

@@ -667,6 +667,7 @@ def setPaths():
     paths.WORDLIST               = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.txt")
     paths.PHPIDS_RULES_XML       = os.path.join(paths.SQLMAP_XML_PATH, "phpids_rules.xml")
     paths.ERRORS_XML             = os.path.join(paths.SQLMAP_XML_PATH, "errors.xml")
+    paths.PAYLOADS_XML           = os.path.join(paths.SQLMAP_XML_PATH, "payloads.xml")
     paths.INJECTIONS_XML         = os.path.join(paths.SQLMAP_XML_PATH, "injections.xml")
     paths.LIVE_TESTS_XML         = os.path.join(paths.SQLMAP_XML_PATH, "livetests.xml")
     paths.QUERIES_XML            = os.path.join(paths.SQLMAP_XML_PATH, "queries.xml")
@@ -894,7 +895,7 @@ def parseUnionPage(output, expression, partial=False, condition=None, sort=True)
 
         if partial or not condition:
             logOutput = "".join(["%s%s%s" % (DUMP_START_MARKER, replaceNewlineTabs(value), DUMP_STOP_MARKER) for value in output])
-            dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, logOutput))
+            dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injection.place, conf.parameters[kb.injection.place], expression, logOutput))
 
         if sort:
             output = set(output)
@@ -1296,17 +1297,6 @@ def calculateDeltaSeconds(start, epsilon=0.05):
     """
     return int(time.time() - start + epsilon)
 
-def getInjectionCase(name):
-    retVal = None
-
-    for case in kb.injections.root.case:
-        if case.name == name:
-            retVal = case
-
-            break
-
-    return retVal
-
 def initCommonOutputs():
     kb.commonOutputs = {}
     key = None

lib/core/datatype.py

@@ -56,3 +56,21 @@ class advancedDict(dict):
         else:
             self.__setitem__(item, value)
 
+def injectionDict():
+    injection = advancedDict()
+
+    injection.place = None
+    injection.parameter = None
+    injection.ptype = None
+    injection.prefix = None
+    injection.suffix = None
+
+    # data is a dict with stype as key and a tuple as value with
+    # title, where, comment and reqPayload
+    injection.data = {}
+
+    injection.dbms = None
+    injection.dbms_version = None
+    injection.os = None
+
+    return injection

lib/core/enums.py

@@ -17,14 +17,14 @@ class PRIORITY:
     HIGHEST = 100
 
 class DBMS:
-    MYSQL       = "MySQL"
-    ORACLE      = "Oracle"
-    POSTGRESQL  = "PostgreSQL"
-    MSSQL       = "Microsoft SQL Server"
-    SQLITE      = "SQLite"
     ACCESS      = "Microsoft Access"
     FIREBIRD    = "Firebird"
     MAXDB       = "SAP MaxDB"
+    MSSQL       = "Microsoft SQL Server"
+    MYSQL       = "MySQL"
+    ORACLE      = "Oracle"
+    POSTGRESQL  = "PostgreSQL"
+    SQLITE      = "SQLite"
     SYBASE      = "Sybase"
 
 class PLACE:
@@ -53,3 +53,39 @@ class HASH:
     ORACLE_OLD   = r'(?i)\A[01-9a-f]{16}\Z'
     MD5_GENERIC  = r'(?i)\A[0-9a-f]{32}\Z'
     SHA1_GENERIC = r'(?i)\A[0-9a-f]{40}\Z'
+
+class PAYLOAD:
+    SQLINJECTION = {
+                     1: "boolean-based blind",
+                     2: "error-based",
+                     3: "UNION query",
+                     4: "stacked queries",
+                     5: "AND/OR time-based blind"
+                   }
+
+    PARAMETER = {
+                  1: "Unescaped numeric",
+                  2: "Single quoted string",
+                  3: "LIKE single quoted string",
+                  4: "Double quoted string",
+                  5: "LIKE double quoted string"
+                }
+
+    RISK = {
+             0: "No risk",
+             1: "Low risk",
+             2: "Medium risk",
+             3: "High risk"
+           }
+
+    CLAUSE = {
+               0: "Always",
+               1: "WHERE",
+               2: "GROUP BY",
+               3: "ORDER BY",
+               4: "LIMIT",
+               5: "OFFSET",
+               6: "TOP",
+               7: "Table name",
+               8: "Column name"
+             }

lib/core/option.py

@@ -64,6 +64,7 @@ from lib.core.settings import SUPPORTED_OS
 from lib.core.settings import VERSION_STRING
 from lib.core.update import update
 from lib.parse.configfile import configFileParser
+from lib.parse.payloads import loadPayloads
 from lib.request.connect import Connect as Request
 from lib.request.proxy import ProxyHTTPSHandler
 from lib.request.certhandler import HTTPSCertAuthHandler
@@ -1069,6 +1070,7 @@ def __setConfAttributes():
     debugMsg = "initializing the configuration"
     logger.debug(debugMsg)
 
+    conf.boundaries       = []
     conf.cj               = None
     conf.dataEncoding     = "utf-8"
     conf.dbmsConnector    = None
@@ -1094,6 +1096,7 @@ def __setConfAttributes():
     conf.seqMatcher       = difflib.SequenceMatcher(None)
     conf.sessionFP        = None
     conf.start            = True
+    conf.tests            = []
     conf.threadContinue   = True
     conf.threadException  = False
     conf.trafficFP        = None
@@ -1121,6 +1124,12 @@ def __setKnowledgeBaseAttributes():
 
     kb.data            = advancedDict()
 
+    # Injection types
+    kb.booleanTest     = None
+    kb.errorTest       = None
+    kb.stackedTest     = None
+    kb.timeTest        = None
+
     # Basic back-end DBMS fingerprint
     kb.dbms            = None
     kb.dbmsDetected    = False
@@ -1131,16 +1140,15 @@ def __setKnowledgeBaseAttributes():
     kb.dep             = None
     kb.docRoot         = None
     kb.dynamicMarkings = []
-    kb.errorTest       = None
     kb.formNames       = advancedDict()
     kb.headersCount    = 0
     kb.headersFp       = {}
     kb.hintValue       = None
     kb.htmlFp          = []
-    kb.injParameter    = None
-    kb.injPlace        = None
-    kb.injType         = None
-    kb.injections      = xmlobject.XMLFile(path=paths.INJECTIONS_XML)
+    kb.injection       = advancedDict()
+    kb.injection.parameter = None
+    kb.injection.place = None
+    kb.injections      = []
     kb.keywords        = set(getFileItems(paths.SQL_KEYWORDS))
     kb.lastErrorPage   = None
     kb.lastRequestUID  = 0
@@ -1160,16 +1168,13 @@ def __setKnowledgeBaseAttributes():
 
     kb.pageStable      = None
     kb.paramMatchRatio = {}
-    kb.parenthesis     = None
     kb.partRun         = None
     kb.proxyAuthHeader = None
     kb.queryCounter    = 0
     kb.resumedQueries  = {}
-    kb.stackedTest     = None
     kb.tamperFunctions = []
     kb.targetUrls      = set()
     kb.testedParams    = set()
-    kb.timeTest        = None
     kb.unionComment    = ""
     kb.unionCount      = None
     kb.unionPosition   = None
@@ -1378,5 +1383,6 @@ def init(inputOptions=advancedDict()):
     __setWriteFile()
     __setMetasploit()
 
+    loadPayloads()
     update()
     __loadQueries()

lib/core/optiondict.py

@@ -63,6 +63,8 @@ optDict = {
                              },
 
             "Detection":     {
+                               "level":             "integer",
+                               "risk":              "integer",
                                "string":            "string",
                                "regexp":            "string",
                                "eString":           "string",

lib/core/session.py

@@ -15,6 +15,7 @@ from lib.core.common import readInput
 from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
+from lib.core.enums import PAYLOAD
 from lib.core.enums import PLACE
 from lib.core.settings import MSSQL_ALIASES
 from lib.core.settings import MYSQL_ALIASES
@@ -68,47 +69,33 @@ def setMatchRatio():
                 )
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][Match ratio][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), conf.matchRatio))
+        dataToSessionFile("[%s][%s][%s][Match ratio][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), conf.matchRatio))
 
-def setInjection():
+def setInjection(inj):
     """
     Save information retrieved about injection place and parameter in the
     session file.
     """
 
-    if kb.injPlace == PLACE.UA:
-        kb.injParameter = conf.agent
+    if inj.place == PLACE.UA:
+        inj.parameter = conf.agent
 
     condition = (
-                  kb.injPlace and kb.injParameter and ( not kb.resumedQueries
+                  ( not kb.resumedQueries
                   or ( kb.resumedQueries.has_key(conf.url) and
                   ( not kb.resumedQueries[conf.url].has_key("Injection point") 
                   or not kb.resumedQueries[conf.url].has_key("Injection parameter")
-                  or not kb.resumedQueries[conf.url].has_key("Injection type")
                   ) ) )
                 )
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][Injection point][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), kb.injPlace))
-        dataToSessionFile("[%s][%s][%s][Injection parameter][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), kb.injParameter))
-        dataToSessionFile("[%s][%s][%s][Injection type][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), kb.injType))
-
-def setParenthesis(parenthesisCount):
-    """
-    @param parenthesisCount: number of parenthesis to be set into the
-    knowledge base as fingerprint.
-    @type parenthesisCount: C{int}
-    """
-
-    condition = (
-                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
-                  not kb.resumedQueries[conf.url].has_key("Parenthesis") )
-                )
-
-    if condition:
-        dataToSessionFile("[%s][%s][%s][Parenthesis][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), parenthesisCount))
-
-    kb.parenthesis = parenthesisCount
+        for stype in inj.data.keys():
+            dataToSessionFile("[%s][%s][%s][Injection type][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), PAYLOAD.SQLINJECTION[stype]))
+        dataToSessionFile("[%s][%s][%s][Injection point][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), inj.place))
+        dataToSessionFile("[%s][%s][%s][Injection parameter][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), inj.parameter))
+        dataToSessionFile("[%s][%s][%s][Injection parameter type][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), PAYLOAD.PARAMETER[inj.ptype]))
+        dataToSessionFile("[%s][%s][%s][Injection prefix][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), inj.prefix))
+        dataToSessionFile("[%s][%s][%s][Injection suffix][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), inj.suffix))
 
 def setDbms(dbms):
     """
@@ -124,7 +111,7 @@ def setDbms(dbms):
                 )
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][DBMS][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), safeFormatString(dbms)))
+        dataToSessionFile("[%s][%s][%s][DBMS][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), safeFormatString(dbms)))
 
     firstRegExp = "(%s|%s|%s|%s)" % ("|".join([alias for alias in MSSQL_ALIASES]),
                                      "|".join([alias for alias in MYSQL_ALIASES]),
@@ -184,28 +171,43 @@ def setOs():
         logger.info(infoMsg)
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][OS][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), safeFormatString(kb.os)))
+        dataToSessionFile("[%s][%s][%s][OS][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), safeFormatString(kb.os)))
 
-def setStacked():
+def setBooleanBased(place, parameter, payload):
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Boolean-based blind injection") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Boolean-based blind injection][%s]\n" % (conf.url, place, safeFormatString(conf.parameters[place]), payload))
+
+def setStacked(place, parameter, payload):
     condition = (
                   not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
                   not kb.resumedQueries[conf.url].has_key("Stacked queries") )
                 )
 
-    if not isinstance(kb.stackedTest, basestring):
-        return
-
     if condition:
-        dataToSessionFile("[%s][%s][%s][Stacked queries][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), kb.stackedTest))
+        dataToSessionFile("[%s][%s][%s][Stacked queries][%s]\n" % (conf.url, place, safeFormatString(conf.parameters[place]), payload))
 
-def setError():
+def setError(place, parameter, payload):
     condition = (
                   not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
-                  not kb.resumedQueries[conf.url].has_key("Error based injection") )
+                  not kb.resumedQueries[conf.url].has_key("Error-based injection") )
                 )
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][Error based injection][Yes]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace])))
+        dataToSessionFile("[%s][%s][%s][Error-based injection][%s]\n" % (conf.url, place, safeFormatString(conf.parameters[place]), payload))
+
+def setTimeBased(place, parameter, payload):
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Time-based blind injection") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Time-based blind injection][%s]\n" % (conf.url, place, safeFormatString(conf.parameters[place]), payload))
 
 def setUnion(comment=None, count=None, position=None, negative=False, falseCond=False, payload=None):
     """
@@ -226,7 +228,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union comment][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), safeFormatString(comment)))
+            dataToSessionFile("[%s][%s][%s][Union comment][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), safeFormatString(comment)))
 
         kb.unionComment = comment
 
@@ -237,7 +239,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union count][%d]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), count))
+            dataToSessionFile("[%s][%s][%s][Union count][%d]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), count))
 
         kb.unionCount = count
 
@@ -248,7 +250,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union position][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), position))
+            dataToSessionFile("[%s][%s][%s][Union position][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), position))
 
         kb.unionPosition = position
 
@@ -260,7 +262,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union negative][Yes]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace])))
+            dataToSessionFile("[%s][%s][%s][Union negative][Yes]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place])))
 
         kb.unionNegative = True
 
@@ -272,7 +274,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union false condition][Yes]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace])))
+            dataToSessionFile("[%s][%s][%s][Union false condition][Yes]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place])))
 
         kb.unionFalseCond = True
 
@@ -284,7 +286,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
                     )
 
         if condition:
-            dataToSessionFile("[%s][%s][%s][Union payload][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), payload))
+            dataToSessionFile("[%s][%s][%s][Union payload][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), payload))
 
         kb.unionTest = payload
 
@@ -295,7 +297,7 @@ def setRemoteTempPath():
                 )
 
     if condition:
-        dataToSessionFile("[%s][%s][%s][Remote temp path][%s]\n" % (conf.url, kb.injPlace, safeFormatString(conf.parameters[kb.injPlace]), safeFormatString(conf.tmpPath)))
+        dataToSessionFile("[%s][%s][%s][Remote temp path][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), safeFormatString(conf.tmpPath)))
 
 def resumeConfKb(expression, url, value):
     if expression == "String" and url == conf.url:
@@ -352,6 +354,12 @@ def resumeConfKb(expression, url, value):
         except ValueError:
             pass
 
+    elif expression == "Injection type" and url == conf.url:
+        kb.injection.stype = unSafeFormatString(value[:-1])
+
+        logMsg  = "resuming injection type '%s' from session file" % kb.injection.stype
+        logger.info(logMsg)
+
     elif expression == "Injection point" and url == conf.url:
         injPlace = value[:-1]
 
@@ -365,7 +373,7 @@ def resumeConfKb(expression, url, value):
             warnMsg += "injectable point"
             logger.warn(warnMsg)
         else:
-            kb.injPlace = injPlace
+            kb.injection.place = injPlace
 
     elif expression == "Injection parameter" and url == conf.url:
         injParameter = unSafeFormatString(value[:-1])
@@ -374,8 +382,8 @@ def resumeConfKb(expression, url, value):
         logger.info(logMsg)
 
         condition = (
-                      not conf.paramDict.has_key(kb.injPlace) or
-                      not conf.paramDict[kb.injPlace].has_key(injParameter)
+                      not conf.paramDict.has_key(kb.injection.place) or
+                      not conf.paramDict[kb.injection.place].has_key(injParameter)
                     )
 
         if condition:
@@ -385,19 +393,24 @@ def resumeConfKb(expression, url, value):
             warnMsg += "injectable point"
             logger.warn(warnMsg)
         else:
-            kb.injParameter = injParameter
+            kb.injection.parameter = injParameter
 
-    elif expression == "Injection type" and url == conf.url:
-        kb.injType = unSafeFormatString(value[:-1])
+    elif expression == "Injection parameter type" and url == conf.url:
+        kb.injection.ptype = unSafeFormatString(value[:-1])
 
-        logMsg  = "resuming injection type '%s' from session file" % kb.injType
+        logMsg  = "resuming injection parameter type '%s' from session file" % kb.injection.ptype
         logger.info(logMsg)
 
-    elif expression == "Parenthesis" and url == conf.url:
-        kb.parenthesis = int(value[:-1])
+    elif expression == "Injection prefix" and url == conf.url:
+        kb.injection.prefix = unSafeFormatString(value[:-1])
 
-        logMsg  = "resuming %d number of " % kb.parenthesis
-        logMsg += "parenthesis from session file"
+        logMsg  = "resuming injection prefix '%s' from session file" % kb.injection.prefix
+        logger.info(logMsg)
+
+    elif expression == "Injection suffix" and url == conf.url:
+        kb.injection.suffix = unSafeFormatString(value[:-1])
+
+        logMsg  = "resuming injection suffix '%s' from session file" % kb.injection.suffix
         logger.info(logMsg)
 
     elif expression == "DBMS" and url == conf.url:
@@ -455,6 +468,20 @@ def resumeConfKb(expression, url, value):
         else:
             conf.os = os
 
+    elif expression == "Boolean-based blind injection" and url == conf.url:
+        kb.booleanTest = unSafeFormatString(value[:-1])
+
+        logMsg  = "resuming boolean-based blind injection "
+        logMsg += "'%s' from session file" % kb.booleanTest
+        logger.info(logMsg)
+
+    elif expression == "Error-based injection" and url == conf.url:
+        kb.errorTest = unSafeFormatString(value[:-1])
+
+        logMsg  = "resuming error-based injection "
+        logMsg += "'%s' from session file" % kb.errorTest
+        logger.info(logMsg)
+
     elif expression == "Stacked queries" and url == conf.url:
         kb.stackedTest = unSafeFormatString(value[:-1])
 
@@ -462,11 +489,11 @@ def resumeConfKb(expression, url, value):
         logMsg += "'%s' from session file" % kb.stackedTest
         logger.info(logMsg)
 
-    elif expression == "Error based injection" and url == conf.url:
-        kb.errorTest = unSafeFormatString(value[:-1]) == 'Yes'
+    elif expression == "Time-based blind injection" and url == conf.url:
+        kb.timeTest = unSafeFormatString(value[:-1])
 
-        logMsg  = "resuming error based injection "
-        logMsg += "'%s' from session file" % kb.errorTest
+        logMsg  = "resuming time-based blind injection "
+        logMsg += "'%s' from session file" % kb.timeTest
         logger.info(logMsg)
 
     elif expression == "Union comment" and url == conf.url: