PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-01-22 06:09:02 +00:00
Code Issues Projects Releases Wiki Activity

Major bug fix to --union-test

Browse Source
This commit is contained in:
Bernardo Damele
2010-10-25 23:39:55 +00:00
parent 7effd0c301
commit f5904d0bc0
9 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/controller/action.py
View File

@@ -64,7 +64,7 @@ def action():
if conf.timeTest:
conf.dumper.technic("time based blind sql injection payload", timeTest())
if conf.unionTest and not kb.unionPosition:
if conf.unionTest and kb.unionPosition is None:
conf.dumper.technic("valid union", unionTest())
# Enumeration options

2
lib/core/agent.py
View File

@@ -453,7 +453,7 @@ class Agent:
query = query[len("TOP %s " % topNum):]
inbandQuery += "TOP %s " % topNum
if not exprPosition:
if not isinstance(exprPosition, int):
exprPosition = kb.unionPosition
intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I)

2
lib/core/session.py
View File

@@ -232,7 +232,7 @@ def setUnion(comment=None, count=None, position=None, negative=False, falseCond=
kb.unionComment = comment
kb.unionCount = count
if position:
if position is not None:
condition = (
not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
( not kb.resumedQueries[conf.url].has_key("Union position")

4
lib/request/inject.py
View File

@@ -358,10 +358,10 @@ def getValue(expression, blind=True, inband=True, error=True, fromUser=False, ex
if not value:
warnMsg = "for some reason(s) it was not possible to retrieve "
warnMsg += "the query output through error SQL injection "
warnMsg += "technique, sqlmap is going %s" % ("inband" if inband and kb.unionPosition else "blind")
warnMsg += "technique, sqlmap is going %s" % ("inband" if inband and kb.unionPosition is not None else "blind")
logger.warn(warnMsg)
if inband and kb.unionPosition and not value:
if inband and kb.unionPosition is not None and not value:
value = __goInband(expression, expected, sort, resumeValue, unpack, dump)
if not value:

16
lib/techniques/inband/union/test.py
View File

@@ -108,23 +108,23 @@ def __unionConfirm():
# Assure that the above function found the exploitable full inband
# SQL injection position
if not isinstance(kb.unionPosition, int):
value = __unionPosition(falseCond=True)
value = __unionPosition(negative=True)
# Assure that the above function found the exploitable partial
# (single entry) inband SQL injection position by appending
# a false condition after the parameter value
# (single entry) inband SQL injection position with negative
# parameter value
if not isinstance(kb.unionPosition, int):
value = __unionPosition(negative=True)
value = __unionPosition(falseCond=True)
# Assure that the above function found the exploitable partial
# (single entry) inband SQL injection position with negative
# parameter value
# (single entry) inband SQL injection position by appending
# a false condition after the parameter value
if not isinstance(kb.unionPosition, int):
return
else:
setUnion(negative=True)
setUnion(falseCond=True)
else:
setUnion(falseCond=True)
setUnion(negative=True)
return value