OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND)

lib/controller/checks.py

@@ -263,14 +263,12 @@ def checkSqlInjection(place, parameter, value):
                 # test's <where> tag
                 if where == 1:
                     origValue = value
+                    kb.pageTemplate = kb.originalPage
                 elif where == 2:
                     origValue = "-%s" % randomInt()
-
-                    # Save original page template and replace with current one
+                    # Use different page template than the original one
                     # as we are changing parameters value, which will result
-                    # most definitely with a different "page template" used by the
-                    # comparison engine
-                    pushValue(kb.pageTemplate)
+                    # most definitely with a different content
                     kb.pageTemplate, _ = Request.queryPage(agent.payload(place, parameter, value, origValue), place, content=True)
                 elif where == 3:
                     origValue = ""
@@ -362,10 +360,6 @@ def checkSqlInjection(place, parameter, value):
                         # Restore old value of socket timeout
                         socket.setdefaulttimeout(popValue())
 
-                # Restore page template
-                if where == 2:
-                    kb.pageTemplate = popValue()
-
                 # If the injection test was successful feed the injection
                 # object with the test's details
                 if injectable is True:
@@ -395,6 +389,7 @@ def checkSqlInjection(place, parameter, value):
                     injection.data[stype].where = where
                     injection.data[stype].vector = vector
                     injection.data[stype].comment = comment
+                    injection.data[stype].pageTemplate = kb.pageTemplate
 
                     if "details" in test:
                         for detailKey, detailValue in test.details.items():
@@ -562,7 +557,7 @@ def checkStability():
     infoMsg = "testing if the url is stable, wait a few seconds"
     logger.info(infoMsg)
 
-    firstPage = kb.pageTemplate # set inside checkConnection()
+    firstPage = kb.originalPage # set inside checkConnection()
     time.sleep(1)
     secondPage, _ = Request.queryPage(content=True)
 
@@ -758,7 +753,7 @@ def checkConnection(suppressOutput=False):
         start = time.time()
         page, _ = Request.queryPage(content=True)
         kb.responseTime = time.time() - start
-        kb.pageTemplate = page
+        kb.originalPage = kb.pageTemplate = page
     except sqlmapConnectionException, errMsg:
         errMsg = getUnicode(errMsg)
         raise sqlmapConnectionException, errMsg

lib/core/agent.py

@@ -209,13 +209,17 @@ class Agent:
 
             payload = payload.replace("[ORIGVALUE]", origvalue)
 
-        if kb.dbms is not None:
-            inferenceQuery = queries[kb.dbms].inference.query
-            payload = payload.replace("[INFERENCE]", inferenceQuery)
-        elif "[INFERENCE]" in payload:
-            errMsg = "invalid usage of inference payload without knowledge "
-            errMsg += "of underlying DBMS"
-            raise sqlmapNoneDataException, errMsg
+        if "[INFERENCE]" in payload:
+            if kb.dbms is not None:
+                inferenceQuery = queries[kb.dbms].inference.query
+                payload = payload.replace("[INFERENCE]", inferenceQuery)
+            elif kb.misc.testedDbms is not None:
+                inferenceQuery = queries[kb.misc.testedDbms].inference.query
+                payload = payload.replace("[INFERENCE]", inferenceQuery)
+            else:
+                errMsg = "invalid usage of inference payload without knowledge "
+                errMsg += "of underlying DBMS"
+                raise sqlmapNoneDataException, errMsg
 
         return payload
 
@@ -659,7 +663,7 @@ class Agent:
         @rtype: C{str}
         """
 
-        return queries[kb.dbms].case.query % expression
+        return queries[kb.dbms if kb.dbms else kb.misc.testedDbms].case.query % expression
 
     def addPayloadDelimiters(self, inpStr):
         """

lib/core/option.py

@@ -1159,6 +1159,7 @@ def __setKnowledgeBaseAttributes():
 
     kb.nullConnection  = None
     kb.pageTemplate    = None
+    kb.originalPage    = None
 
     # Back-end DBMS underlying operating system fingerprint via banner (-b)
     # parsing

lib/request/inject.py

@@ -100,8 +100,10 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, r
 
     if kb.injection.data[1].vector is not None:
         vector = agent.cleanupPayload(kb.injection.data[1].vector)
+        kb.pageTemplate = kb.injection.data[1].pageTemplate
     else:
         vector = queries[kb.misc.testedDbms].inference.query
+        kb.pageTemplate = kb.originalPage
 
     query          = agent.prefixQuery(vector)
     query          = agent.suffixQuery(query)
@@ -441,3 +443,6 @@ def goStacked(expression, silent=False):
     page, _ = Request.queryPage(payload, content=True, silent=silent)
 
     return payload, page
+
+def checkBooleanExpression(expression):
+    return getValue(agent.forgeCaseStatement(expression), expected="int", charsetType=1) == "1"