PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-01-21 13:49:04 +00:00
Code Issues Projects Releases Wiki Activity

I am back on stage and here to stay!!! to start.. a removal of confirm switch which masked cases where file write operations failed when set to False automatically, now at least it asks the user and defaults to Yes

Browse Source
This commit is contained in:
Bernardo Damele
2012-07-01 23:25:05 +01:00
parent d7cd55fb28
commit ab412da27f
14 changed files with 25 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/dbms/mysql/filesystem.py
View File

@@ -59,7 +59,7 @@ class Filesystem(GenericFilesystem):
warnMsg += "file '%s'" % rFile
if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
warnMsg += ", going to fall-back to simpler technique"
warnMsg += ", going to fall-back to simpler UNION technique"
logger.warn(warnMsg)
result = self.unionReadFile(rFile)
else:
@@ -80,7 +80,7 @@ class Filesystem(GenericFilesystem):
return result
def unionWriteFile(self, wFile, dFile, fileType, confirm=True):
def unionWriteFile(self, wFile, dFile, fileType):
logger.debug("encoding file to its hexadecimal string value")
fcEncodedList = self.fileEncode(wFile, "hex", True)
@@ -100,14 +100,13 @@ class Filesystem(GenericFilesystem):
sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, dFile)
unionUse(sqlQuery, unpack=False)
if confirm:
self.askCheckWrittenFile(wFile, dFile, fileType)
self.askCheckWrittenFile(wFile, dFile, fileType)
warnMsg = "expect junk characters inside the "
warnMsg += "file as a leftover from UNION query"
singleTimeWarnMessage(warnMsg)
def stackedWriteFile(self, wFile, dFile, fileType, confirm=True):
def stackedWriteFile(self, wFile, dFile, fileType):
debugMsg = "creating a support table to write the hexadecimal "
debugMsg += "encoded file to"
logger.debug(debugMsg)
@@ -134,5 +133,4 @@ class Filesystem(GenericFilesystem):
# Reference: http://dev.mysql.com/doc/refman/5.1/en/select.html
inject.goStacked("SELECT %s FROM %s INTO DUMPFILE '%s'" % (self.tblField, self.fileTblName, dFile), silent=True)
if confirm:
self.askCheckWrittenFile(wFile, dFile, fileType)
self.askCheckWrittenFile(wFile, dFile, fileType)