PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

Implementing option '--where' (Issue #605)

Browse Source
This commit is contained in:
Miroslav Stampar
2014-02-11 16:20:45 +01:00
parent be6767b3b0
commit d05bfdd7dd
5 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
lib/utils/pivotdumptable.py
View File

@@ -38,6 +38,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
if count is None:
query = dumpNode.count % table
query = whereQuery(query)
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, time=False, expected=EXPECTED.INT)
if isinstance(count, basestring) and count.isdigit():
@@ -83,6 +84,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
logger.info(infoMsg)
query = dumpNode.count2 % (column, table)
query = whereQuery(query)
value = inject.getValue(query, blind=blind, union=not blind, error=not blind, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
if isNumPosStrValue(value):
@@ -122,6 +124,8 @@ def pivotDumpTable(table, colList, count=None, blind=True):
else:
query = dumpNode.query2.replace("'%s'", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, colList[0]), unescaper.escape(pivotValue, False))
query = whereQuery(query)
return unArrayizeValue(inject.getValue(query, blind=blind, time=blind, union=not blind, error=not blind))
value = _(pivotValue)
@@ -163,3 +167,18 @@ def pivotDumpTable(table, colList, count=None, blind=True):
logger.critical(errMsg)
return entries, lengths
def whereQuery(query):
if conf.dumpWhere and query:
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
if "%s)" % conf.tbl.upper() in prefix.upper():
prefix = re.sub(r"(?i)%s\)" % conf.tbl, "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
elif re.search(r"(?i)\bWHERE\b", prefix):
prefix += " AND %s" % conf.dumpWhere
else:
prefix += " WHERE %s" % conf.dumpWhere
query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix
return query