Added new switch --union-char to be able to provide the character used in union-test and exploit (default is still NULL, but can be any)

lib/core/agent.py

@@ -425,7 +425,7 @@ class Agent:
 
         return concatenatedQuery
 
-    def forgeInbandQuery(self, query, exprPosition=None, nullChar="NULL", count=None, comment=None):
+    def forgeInbandQuery(self, query, exprPosition=None, nullChar=None, count=None, comment=None):
         """
         Take in input an query (pseudo query) string and return its
         processed UNION ALL SELECT query.
@@ -456,6 +456,9 @@ class Agent:
         @rtype: C{str}
         """
 
+        if nullChar is None:
+            nullChar = conf.uChar
+
         if count is None:
             count = kb.unionCount
 

lib/core/option.py

@@ -487,7 +487,14 @@ def __setWriteFile():
 
     conf.wFileType = getFileType(conf.wFile)
 
-def __setUnionTech():
+def __setUnion():
+    if isinstance(conf.uChar, basestring) and conf.uChar != "NULL" and not conf.uChar.isdigit():
+        if not conf.uChar.startswith("'") or not conf.uChar.endswith("'"):
+            debugMsg = "setting the UNION query SQL injection character to '%s'" % conf.uChar
+            logger.debug(debugMsg)
+
+            conf.uChar = "'%s'" % conf.uChar
+
     if conf.uTech is None:
         conf.uTech = "NULL"
 
@@ -1341,7 +1348,7 @@ def init(inputOptions=advancedDict()):
         __setHTTPAuthentication()
         __setHTTPProxy()
         __setSafeUrl()
-        __setUnionTech()
+        __setUnion()
         __setGoogleDorking()
         __urllib2Opener()
         __findPageForms()

lib/core/optiondict.py

@@ -79,7 +79,8 @@ optDict = {
                                "timeSec":           "integer",
                                "unionTest":         "boolean",
                                "uTech":             "string",
-                               "uCols":             "integer"
+                               "uCols":             "integer",
+                               "uChar":             "string"
                              },
 
             "Fingerprint":   {