Initial implementation of support for stacked queries.

Added method to test for Time based blind SQL injection query stacking
on the affected parameter a SLEEP() or similar DBMS specific function.
Adapted libraries, plugins and XML with the above changes.
Minor layout adjustments.

lib/core/agent.py

@@ -95,7 +95,7 @@ class Agent:
         else:
             raise sqlmapNoneDataException, "unsupported injection type"
 
-        if kb.parenthesis != None:
+        if kb.parenthesis not in ( None, 0 ):
             query += "%s " % (")" * kb.parenthesis)
 
         query += string
@@ -343,7 +343,7 @@ class Agent:
         @rtype: C{str}
         """
 
-        inbandQuery = self.prefixQuery("UNION ALL SELECT ")
+        inbandQuery = self.prefixQuery(" UNION ALL SELECT ")
 
         if not exprPosition:
             exprPosition = kb.unionPosition

lib/core/optiondict.py

@@ -48,6 +48,12 @@ optDict = {
                                "dbms":              "string",
                              },
 
+            "Techniques": {
+                               "timeTest":          "boolean",
+                               "unionTest":         "boolean",
+                               "unionUse":          "boolean",
+                          },
+
             "Fingerprint":   {
                                "extensiveFp":       "boolean",
                              },
@@ -85,8 +91,6 @@ optDict = {
                              },
 
             "Miscellaneous": {
-                               "unionTest":         "boolean",
-                               "unionUse":          "boolean",
                                "eta":               "boolean",
                                "verbose":           "integer",
                                "updateAll":         "boolean",

lib/core/settings.py

@@ -64,3 +64,5 @@ PGSQL_ALIASES     = [ "postgresql", "postgres", "pgsql", "psql", "pg" ]
 ORACLE_ALIASES    = [ "oracle", "orcl", "ora", "or" ]
 
 SUPPORTED_DBMS    = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES
+
+TIME_SECONDS      = 5