mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-12-06 12:41:30 +00:00
Compare commits
27 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
a68848faf7 | ||
|
|
a4f21399e7 | ||
|
|
e03b2df58f | ||
|
|
252eb97198 | ||
|
|
67ae620182 | ||
|
|
13366aeb48 | ||
|
|
e1ce16144a | ||
|
|
3307918389 | ||
|
|
c50849707f | ||
|
|
06296bd251 | ||
|
|
0f6e529fb9 | ||
|
|
242800c085 | ||
|
da5fff7775 | ||
|
|
679f0cf772 | ||
|
8df56ecc72 | ||
|
|
1b5a4651a9 | ||
|
|
05fa7eb7c6 | ||
|
|
336169e181 | ||
|
|
b2bc3d49fd | ||
|
|
71aa7deefe | ||
|
|
cf5ae507c8 | ||
|
|
4898a2c332 | ||
|
|
151dcee32e | ||
|
|
73f1155847 | ||
|
|
fcf9998010 | ||
|
|
26b895dd2e | ||
|
b4bb4c393b |
6
.travis.yml
Normal file
6
.travis.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
language: python
|
||||
python:
|
||||
- "2.6"
|
||||
- "2.7"
|
||||
script:
|
||||
- python -c "import sqlmap; import sqlmapapi"
|
||||
@@ -1,6 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band".
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
Το sqlmap είναι πρόγραμμα ανοιχτού κώδικα, που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου SQL Injection σε βάσεις δεδομένων. Έρχεται με μια δυνατή μηχανή αναγνώρισης ευπαθειών, πολλά εξειδικευμένα χαρακτηριστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εύρος επιλογών αρχίζοντας από την αναγνώριση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχρι και πρόσβαση στο βαθύτερο σύστημα αρχείων και εκτέλεση εντολών στο απευθείας στο λειτουργικό μέσω εκτός ζώνης συνδέσεων.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datotečnom sustavu i izvršavanja komandi na operacijskom sustavu korištenjem tzv. "out-of-band" veza.
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap gelişmiş tespit özelliğinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak veritabınınından, veri indirmek, dosya sistemine erişmek, dosya çalıştırmak gibi - işlevleri de barındırmaktadır.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
sqlmap
|
||||
==
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过外带数据连接的方式执行操作系统命令。
|
||||
|
||||
|
||||
22
extra/shutils/precommit-hook
Normal file
22
extra/shutils/precommit-hook
Normal file
@@ -0,0 +1,22 @@
|
||||
#!/bin/bash
|
||||
|
||||
SETTINGS="../../lib/core/settings.py"
|
||||
|
||||
declare -x SCRIPTPATH="${0}"
|
||||
|
||||
FULLPATH=${SCRIPTPATH%/*}/$SETTINGS
|
||||
|
||||
if [ -f $FULLPATH ]
|
||||
then
|
||||
LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"');
|
||||
declare -a LINE;
|
||||
INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '1' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
|
||||
if [ -n "$INCREMENTED" ]
|
||||
then
|
||||
sed "s/${LINE}/${INCREMENTED}/" $FULLPATH > $FULLPATH.tmp && mv $FULLPATH.tmp $FULLPATH
|
||||
echo "Updated ${INCREMENTED} in ${FULLPATH}";
|
||||
else
|
||||
echo "Something went wrong in VERSION increment"
|
||||
exit 1
|
||||
fi
|
||||
fi;
|
||||
@@ -17,6 +17,7 @@ from lib.core.common import isTechniqueAvailable
|
||||
from lib.core.common import randomInt
|
||||
from lib.core.common import randomStr
|
||||
from lib.core.common import safeSQLIdentificatorNaming
|
||||
from lib.core.common import safeStringFormat
|
||||
from lib.core.common import singleTimeWarnMessage
|
||||
from lib.core.common import splitFields
|
||||
from lib.core.common import unArrayizeValue
|
||||
@@ -923,7 +924,7 @@ class Agent(object):
|
||||
else:
|
||||
limitedQuery = "%s FROM (SELECT %s,%s" % (untilFrom, ','.join(f for f in field), limitStr)
|
||||
|
||||
limitedQuery = limitedQuery % fromFrom
|
||||
limitedQuery = safeStringFormat(limitedQuery, (fromFrom,))
|
||||
limitedQuery += "=%d" % (num + 1)
|
||||
|
||||
elif Backend.isDbms(DBMS.MSSQL):
|
||||
|
||||
@@ -128,6 +128,7 @@ from lib.core.settings import PARTIAL_VALUE_MARKER
|
||||
from lib.core.settings import PAYLOAD_DELIMITER
|
||||
from lib.core.settings import PLATFORM
|
||||
from lib.core.settings import PRINTABLE_CHAR_REGEX
|
||||
from lib.core.settings import PUSH_VALUE_EXCEPTION_RETRY_COUNT
|
||||
from lib.core.settings import PYVERSION
|
||||
from lib.core.settings import REFERER_ALIASES
|
||||
from lib.core.settings import REFLECTED_BORDER_REGEX
|
||||
@@ -2183,7 +2184,22 @@ def pushValue(value):
|
||||
Push value to the stack (thread dependent)
|
||||
"""
|
||||
|
||||
getCurrentThreadData().valueStack.append(copy.deepcopy(value))
|
||||
_ = None
|
||||
success = False
|
||||
|
||||
for i in xrange(PUSH_VALUE_EXCEPTION_RETRY_COUNT):
|
||||
try:
|
||||
getCurrentThreadData().valueStack.append(copy.deepcopy(value))
|
||||
success = True
|
||||
break
|
||||
except Exception, ex:
|
||||
_ = ex
|
||||
|
||||
if not success:
|
||||
getCurrentThreadData().valueStack.append(None)
|
||||
|
||||
if _:
|
||||
raise _
|
||||
|
||||
def popValue():
|
||||
"""
|
||||
@@ -2917,7 +2933,7 @@ def showHttpErrorCodes():
|
||||
msg += "could mean that some kind of protection is involved (e.g. WAF)"
|
||||
logger.debug(msg)
|
||||
|
||||
def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="replace", buffering=1):
|
||||
def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="replace", buffering=1): # "buffering=1" means line buffered (Reference: http://stackoverflow.com/a/3168436)
|
||||
"""
|
||||
Returns file handle of a given filename
|
||||
"""
|
||||
@@ -3142,59 +3158,65 @@ def removeReflectiveValues(content, payload, suppressWarning=False):
|
||||
|
||||
retVal = content
|
||||
|
||||
if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism and not kb.heuristicMode:
|
||||
def _(value):
|
||||
while 2 * REFLECTED_REPLACEMENT_REGEX in value:
|
||||
value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
|
||||
return value
|
||||
try:
|
||||
if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism and not kb.heuristicMode:
|
||||
def _(value):
|
||||
while 2 * REFLECTED_REPLACEMENT_REGEX in value:
|
||||
value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
|
||||
return value
|
||||
|
||||
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''), convall=True))
|
||||
regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
|
||||
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''), convall=True))
|
||||
regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
|
||||
|
||||
if regex != payload:
|
||||
if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check
|
||||
parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
|
||||
retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach
|
||||
if regex != payload:
|
||||
if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check
|
||||
parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
|
||||
retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach
|
||||
|
||||
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
|
||||
regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:])))
|
||||
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
|
||||
regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:])))
|
||||
|
||||
parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))
|
||||
parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))
|
||||
|
||||
if regex.startswith(REFLECTED_REPLACEMENT_REGEX):
|
||||
regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):])
|
||||
else:
|
||||
regex = r"\b%s" % regex
|
||||
if regex.startswith(REFLECTED_REPLACEMENT_REGEX):
|
||||
regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):])
|
||||
else:
|
||||
regex = r"\b%s" % regex
|
||||
|
||||
if regex.endswith(REFLECTED_REPLACEMENT_REGEX):
|
||||
regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX)
|
||||
else:
|
||||
regex = r"%s\b" % regex
|
||||
if regex.endswith(REFLECTED_REPLACEMENT_REGEX):
|
||||
regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX)
|
||||
else:
|
||||
regex = r"%s\b" % regex
|
||||
|
||||
retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal)
|
||||
retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal)
|
||||
|
||||
if len(parts) > 2:
|
||||
regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:])
|
||||
retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal)
|
||||
if len(parts) > 2:
|
||||
regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:])
|
||||
retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal)
|
||||
|
||||
if retVal != content:
|
||||
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1
|
||||
if not suppressWarning:
|
||||
warnMsg = "reflective value(s) found and filtering out"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I):
|
||||
warnMsg = "frames detected containing attacked parameter values. Please be sure to "
|
||||
warnMsg += "test those separately in case that attack on this page fails"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]:
|
||||
kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1
|
||||
if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD:
|
||||
kb.reflectiveMechanism = False
|
||||
if retVal != content:
|
||||
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1
|
||||
if not suppressWarning:
|
||||
debugMsg = "turning off reflection removal mechanism (for optimization purposes)"
|
||||
logger.debug(debugMsg)
|
||||
warnMsg = "reflective value(s) found and filtering out"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I):
|
||||
warnMsg = "frames detected containing attacked parameter values. Please be sure to "
|
||||
warnMsg += "test those separately in case that attack on this page fails"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]:
|
||||
kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1
|
||||
if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD:
|
||||
kb.reflectiveMechanism = False
|
||||
if not suppressWarning:
|
||||
debugMsg = "turning off reflection removal mechanism (for optimization purposes)"
|
||||
logger.debug(debugMsg)
|
||||
except MemoryError:
|
||||
kb.reflectiveMechanism = False
|
||||
if not suppressWarning:
|
||||
debugMsg = "turning off reflection removal mechanism (because of low memory issues)"
|
||||
logger.debug(debugMsg)
|
||||
|
||||
return retVal
|
||||
|
||||
|
||||
@@ -37,6 +37,7 @@ from lib.core.exception import SqlmapGenericException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.replication import Replication
|
||||
from lib.core.settings import DUMP_FILE_BUFFER_SIZE
|
||||
from lib.core.settings import HTML_DUMP_CSS_STYLE
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import METADB_SUFFIX
|
||||
@@ -449,7 +450,7 @@ class Dump(object):
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower()))
|
||||
|
||||
appendToFile = os.path.isfile(dumpFileName) and any((conf.limitStart, conf.limitStop))
|
||||
dumpFP = openFile(dumpFileName, "wb" if not appendToFile else "ab")
|
||||
dumpFP = openFile(dumpFileName, "wb" if not appendToFile else "ab", buffering=DUMP_FILE_BUFFER_SIZE)
|
||||
|
||||
count = int(tableValues["__infos__"]["count"])
|
||||
separator = str()
|
||||
|
||||
@@ -26,7 +26,7 @@ def setDbms(dbms):
|
||||
hashDBWrite(HASHDB_KEYS.DBMS, dbms)
|
||||
|
||||
_ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS]))
|
||||
_ = re.search("^%s" % _, dbms, re.I)
|
||||
_ = re.search(r"\A%s( |\Z)" % _, dbms, re.I)
|
||||
|
||||
if _:
|
||||
dbms = _.group(1)
|
||||
|
||||
@@ -20,9 +20,10 @@ from lib.core.enums import OS
|
||||
from lib.core.revision import getRevisionNumber
|
||||
|
||||
# sqlmap version and site
|
||||
VERSION = "1.0-stable"
|
||||
VERSION = "1.0.3.1"
|
||||
REVISION = getRevisionNumber()
|
||||
VERSION_STRING = "sqlmap/%s" % VERSION
|
||||
STABLE = VERSION.count('.') <= 2
|
||||
VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")
|
||||
DESCRIPTION = "automatic SQL injection and database takeover tool"
|
||||
SITE = "http://sqlmap.org"
|
||||
ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new"
|
||||
@@ -35,7 +36,7 @@ BANNER = """\033[01;33m _
|
||||
|_ -| . | | | .'| . |
|
||||
|___|_ |_|_|_|_|__,| _|
|
||||
|_| |_| \033[0m\033[4;37m%s\033[0m\n
|
||||
""" % ((31 + hash(REVISION) % 6) if REVISION else 30, VERSION_STRING.split('/')[-1], SITE)
|
||||
""" % ((31 + hash(VERSION) % 6) if not STABLE else 30, VERSION_STRING.split('/')[-1], SITE)
|
||||
|
||||
# Minimum distance of ratio from kb.matchRatio to result in True
|
||||
DIFF_TOLERANCE = 0.05
|
||||
@@ -138,6 +139,9 @@ MAX_BUFFERED_PARTIAL_UNION_LENGTH = 1024
|
||||
# Suffix used for naming meta databases in DBMS(es) without explicit database name
|
||||
METADB_SUFFIX = "_masterdb"
|
||||
|
||||
# Number of times to retry the pushValue during the exceptions (e.g. KeyboardInterrupt)
|
||||
PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3
|
||||
|
||||
# Minimum time response set needed for time-comparison based on standard deviation
|
||||
MIN_TIME_RESPONSES = 30
|
||||
|
||||
@@ -482,6 +486,10 @@ SOCKET_PRE_CONNECT_QUEUE_SIZE = 3
|
||||
# Only console display last n table rows
|
||||
TRIM_STDOUT_DUMP_SIZE = 256
|
||||
|
||||
# Reference: http://stackoverflow.com/a/3168436
|
||||
# Reference: https://support.microsoft.com/en-us/kb/899149
|
||||
DUMP_FILE_BUFFER_SIZE = 1024
|
||||
|
||||
# Parse response headers only first couple of times
|
||||
PARSE_HEADERS_LIMIT = 3
|
||||
|
||||
|
||||
@@ -451,7 +451,7 @@ def _resumeDBMS():
|
||||
dbms = value.lower()
|
||||
dbmsVersion = [UNKNOWN_DBMS_VERSION]
|
||||
_ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS]))
|
||||
_ = re.search("%s ([\d\.]+)" % _, dbms, re.I)
|
||||
_ = re.search(r"\A%s (.*)" % _, dbms, re.I)
|
||||
|
||||
if _:
|
||||
dbms = _.group(1).lower()
|
||||
|
||||
@@ -204,7 +204,7 @@ def checkCharEncoding(encoding, warn=True):
|
||||
# Reference: http://docs.python.org/library/codecs.html
|
||||
try:
|
||||
codecs.lookup(encoding.encode(UNICODE_ENCODING) if isinstance(encoding, unicode) else encoding)
|
||||
except LookupError:
|
||||
except (LookupError, ValueError):
|
||||
if warn:
|
||||
warnMsg = "unknown web page charset '%s'. " % encoding
|
||||
warnMsg += "Please report by e-mail to 'dev@sqlmap.org'"
|
||||
|
||||
@@ -391,9 +391,10 @@ class Connect(object):
|
||||
|
||||
for key, value in headers.items():
|
||||
del headers[key]
|
||||
headers[unicodeencode(key, kb.pageEncoding)] = unicodeencode(value, kb.pageEncoding)
|
||||
value = unicodeencode(value, kb.pageEncoding)
|
||||
for char in (r"\r", r"\n"):
|
||||
value = re.sub(r"(%s)([^ \t])" % char, r"\g<1>\t\g<2>", value)
|
||||
headers[unicodeencode(key, kb.pageEncoding)] = value.strip("\r\n")
|
||||
|
||||
url = unicodeencode(url)
|
||||
post = unicodeencode(post)
|
||||
|
||||
@@ -61,6 +61,10 @@ def dnsUse(payload, expression):
|
||||
chunk_length = MAX_DNS_LABEL / 2 if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL) else MAX_DNS_LABEL / 4 - 2
|
||||
_, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression)
|
||||
nulledCastedField = agent.nullAndCastField(fieldToCastStr)
|
||||
extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(fieldToCastStr), expression).group(0)
|
||||
if extendedField != fieldToCastStr: # e.g. MIN(surname)
|
||||
nulledCastedField = extendedField.replace(fieldToCastStr, nulledCastedField)
|
||||
fieldToCastStr = extendedField
|
||||
nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, chunk_length)
|
||||
nulledCastedField = agent.hexConvertField(nulledCastedField)
|
||||
expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1)
|
||||
|
||||
@@ -622,14 +622,13 @@ def download(taskid, target, filename):
|
||||
logger.warning("[%s] Invalid task ID provided to download()" % taskid)
|
||||
return jsonize({"success": False, "message": "Invalid task ID"})
|
||||
|
||||
# Prevent file path traversal - the lame way
|
||||
if ".." in target:
|
||||
path = os.path.abspath(os.path.join(paths.SQLMAP_OUTPUT_PATH, target, filename))
|
||||
# Prevent file path traversal
|
||||
if not path.startswith(paths.SQLMAP_OUTPUT_PATH):
|
||||
logger.warning("[%s] Forbidden path (%s)" % (taskid, target))
|
||||
return jsonize({"success": False, "message": "Forbidden path"})
|
||||
|
||||
path = os.path.join(paths.SQLMAP_OUTPUT_PATH, target)
|
||||
|
||||
if os.path.exists(path):
|
||||
if os.path.isfile(path):
|
||||
logger.debug("[%s] Retrieved content of file %s" % (taskid, target))
|
||||
with open(path, 'rb') as inf:
|
||||
file_content = inf.read()
|
||||
|
||||
15
sqlmap.py
15
sqlmap.py
@@ -5,6 +5,12 @@ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import sys
|
||||
|
||||
sys.dont_write_bytecode = True
|
||||
|
||||
from lib.utils import versioncheck # this has to be the first non-standard import
|
||||
|
||||
import bdb
|
||||
import inspect
|
||||
import logging
|
||||
@@ -17,13 +23,9 @@ import time
|
||||
import traceback
|
||||
import warnings
|
||||
|
||||
sys.dont_write_bytecode = True
|
||||
|
||||
warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning)
|
||||
warnings.filterwarnings(action="ignore", category=DeprecationWarning)
|
||||
|
||||
from lib.utils import versioncheck # this has to be the first non-standard import
|
||||
|
||||
from lib.controller.controller import start
|
||||
from lib.core.common import banner
|
||||
from lib.core.common import createGithubIssue
|
||||
@@ -173,6 +175,11 @@ def main():
|
||||
logger.error(errMsg)
|
||||
raise SystemExit
|
||||
|
||||
elif "_mkstemp_inner" in excMsg:
|
||||
errMsg = "there has been a problem while accessing temporary files"
|
||||
logger.error(errMsg)
|
||||
raise SystemExit
|
||||
|
||||
elif all(_ in excMsg for _ in ("pymysql", "configparser")):
|
||||
errMsg = "wrong initialization of pymsql detected (using Python3 dependencies)"
|
||||
logger.error(errMsg)
|
||||
|
||||
9
thirdparty/pagerank/pagerank.py
vendored
9
thirdparty/pagerank/pagerank.py
vendored
@@ -14,14 +14,15 @@
|
||||
|
||||
import sys
|
||||
import urllib
|
||||
import urllib2
|
||||
|
||||
def get_pagerank(url):
|
||||
def get_pagerank(url, timeout=10):
|
||||
url = url.encode('utf8') if isinstance(url, unicode) else url
|
||||
_ = 'http://toolbarqueries.google.com/tbr?client=navclient-auto&features=Rank&ch=%s&q=info:%s' % (check_hash(hash_url(url)), urllib.quote(url))
|
||||
try:
|
||||
f = urllib.urlopen(_)
|
||||
rank = f.read().strip()[9:]
|
||||
except Exception:
|
||||
req = urllib2.Request(_)
|
||||
rank = urllib2.urlopen(req, timeout=timeout).read().strip()[9:]
|
||||
except:
|
||||
rank = 'N/A'
|
||||
else:
|
||||
rank = '0' if not rank or not rank.isdigit() else rank
|
||||
|
||||
@@ -90,6 +90,8 @@
|
||||
<error regexp="(?i)Warning.*sybase.*"/>
|
||||
<error regexp="Sybase message"/>
|
||||
<error regexp="Sybase.*Server message.*"/>
|
||||
<error regexp="SybSQLException"/>
|
||||
<error regexp="com\.sybase\.jdbc"/>
|
||||
</dbms>
|
||||
|
||||
<!-- Ingres -->
|
||||
|
||||
Reference in New Issue
Block a user