PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

Minor refactoring

Browse Source
This commit is contained in:
Miroslav Stampar
2017-01-02 15:14:59 +01:00
parent e0eeed0a96
commit c29db43bfa
5 changed files with 26 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
lib/utils/pivotdumptable.py
View File

@@ -41,7 +41,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
if count is None:
query = dumpNode.count % table
query = whereQuery(query)
query = agent.whereQuery(query)
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, time=False, expected=EXPECTED.INT)
if isinstance(count, basestring) and count.isdigit():
@@ -91,7 +91,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
logger.info(infoMsg)
query = dumpNode.count2 % (column, table)
query = whereQuery(query)
query = agent.whereQuery(query)
value = inject.getValue(query, blind=blind, union=not blind, error=not blind, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
if isNumPosStrValue(value):
@@ -125,7 +125,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
else:
query = dumpNode.query2.replace("'%s'", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, colList[0]), unescaper.escape(pivotValue, False))
query = whereQuery(query)
query = agent.whereQuery(query)
return unArrayizeValue(inject.getValue(query, blind=blind, time=blind, union=not blind, error=not blind))
try:
@@ -179,18 +179,3 @@ def pivotDumpTable(table, colList, count=None, blind=True):
logger.critical(errMsg)
return entries, lengths
def whereQuery(query):
if conf.dumpWhere and query:
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
if "%s)" % conf.tbl.upper() in prefix.upper():
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
elif re.search(r"(?i)\bWHERE\b", prefix):
prefix += " AND %s" % conf.dumpWhere
else:
prefix += " WHERE %s" % conf.dumpWhere
query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix
return query