diff --git a/lib/request/inject.py b/lib/request/inject.py index bf5660b1b..8568636f5 100644 --- a/lib/request/inject.py +++ b/lib/request/inject.py @@ -155,7 +155,10 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, r # forge the SQL limiting the query output one entry per time # NOTE: I assume that only queries that get data from a table # can return multiple entries - if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_TABLE) or (Backend.getIdentifiedDbms() in FROM_TABLE and not expression.upper().endswith(FROM_TABLE[Backend.getIdentifiedDbms()]))): + if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \ + not in FROM_TABLE) or (Backend.getIdentifiedDbms() in FROM_TABLE and not \ + expression.upper().endswith(FROM_TABLE[Backend.getIdentifiedDbms()]))): + limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) diff --git a/lib/techniques/inband/union/use.py b/lib/techniques/inband/union/use.py index 5e546eb49..d2cd2a926 100644 --- a/lib/techniques/inband/union/use.py +++ b/lib/techniques/inband/union/use.py @@ -102,7 +102,7 @@ def configUnion(char=None, columns=None): elif isinstance(columns, basestring): __configUnionCols(columns) -def unionUse(expression, direct=False, unescape=True, unpack=True, dump=False): +def unionUse(expression, unescape=True, unpack=True, dump=False): """ This function tests for an inband SQL injection on the target url then call its subsidiary function to effectively perform an diff --git a/plugins/dbms/mysql/filesystem.py b/plugins/dbms/mysql/filesystem.py index eb2215ea5..53aa786b4 100644 --- a/plugins/dbms/mysql/filesystem.py +++ b/plugins/dbms/mysql/filesystem.py @@ -92,7 +92,7 @@ class Filesystem(GenericFilesystem): logger.debug(debugMsg) sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, dFile) - unionUse(sqlQuery, direct=True, unescape=False) + unionUse(sqlQuery, unescape=False) if confirm: self.askCheckWrittenFile(wFile, dFile, fileType)