Fixes #2958

.github/CONTRIBUTING.md

@@ -24,7 +24,6 @@ Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md)
 In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions:
 
 * Each patch should make one logical change.
-* Wrap code to 76 columns when possible.
 * Avoid tabbing, use four blank spaces instead.
 * Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:[email protected]).
 * Do not change style on numerous files in one single pull request, we can [discuss](mailto:[email protected]) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected.

extra/shutils/precommit-hook.sh

@@ -12,21 +12,21 @@ CHECKSUM_FULLPATH=${SCRIPTPATH%/*}/$CHECKSUM
 
 git diff $SETTINGS_FULLPATH | grep "VERSION =" > /dev/null && exit 0
 
-# if [ -f $SETTINGS_FULLPATH ]
-# then
-#     LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"')
-#     declare -a LINE
-#     INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
-#     if [ -n "$INCREMENTED" ]
-#     then
-#         sed -i "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH
-#         echo "Updated ${INCREMENTED} in ${SETTINGS_FULLPATH}"
-#     else
-#         echo "Something went wrong in VERSION increment"
-#         exit 1
-#     fi
-#     git add "$SETTINGS_FULLPATH"
-# fi
+if [ -f $SETTINGS_FULLPATH ]
+then
+    LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"')
+    declare -a LINE
+    INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
+    if [ -n "$INCREMENTED" ]
+    then
+        sed -i "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH
+        echo "Updated ${INCREMENTED} in ${SETTINGS_FULLPATH}"
+    else
+        echo "Something went wrong in VERSION increment"
+        exit 1
+    fi
+    git add "$SETTINGS_FULLPATH"
+fi
 
 truncate -s 0 "$CHECKSUM_FULLPATH"
 cd $PROJECT_FULLPATH && for i in $(find . -name "*.py" -o -name "*.xml" -o -iname "*_" | sort); do git ls-files $i --error-unmatch &>/dev/null && md5sum $i | stdbuf -i0 -o0 -e0 sed 's/\.\///' >> "$CHECKSUM_FULLPATH"; git add "$CHECKSUM_FULLPATH"; done

lib/controller/checks.py

@@ -1461,11 +1461,11 @@ def checkNullConnection():
     infoMsg = "testing NULL connection to the target URL"
     logger.info(infoMsg)
 
-    try:
-        pushValue(kb.pageCompress)
-        kb.pageCompress = False
+    pushValue(kb.pageCompress)
+    kb.pageCompress = False
 
-        page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD)
+    try:
+        page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD, raise404=False)
 
         if not page and HTTP_HEADER.CONTENT_LENGTH in (headers or {}):
             kb.nullConnection = NULLCONNECTION.HEAD
@@ -1489,9 +1489,8 @@ def checkNullConnection():
                     infoMsg = "NULL connection is supported with 'skip-read' method"
                     logger.info(infoMsg)
 
-    except SqlmapConnectionException, ex:
-        errMsg = getSafeExString(ex)
-        raise SqlmapConnectionException(errMsg)
+    except SqlmapConnectionException:
+        pass
 
     finally:
         kb.pageCompress = popValue()

lib/controller/controller.py

@@ -158,6 +158,9 @@ def _formatInjection(inj):
     return data
 
 def _showInjections():
+    if conf.wizard and kb.wizardMode:
+        kb.wizardMode = False
+
     if kb.testQueryCount > 0:
         header = "sqlmap identified the following injection point(s) with "
         header += "a total of %d HTTP(s) requests" % kb.testQueryCount
@@ -368,9 +371,8 @@ def start():
                             conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data
 
                         else:
-                            if targetUrl.find("?") > -1:
-                                firstPart = targetUrl[:targetUrl.find("?")]
-                                secondPart = targetUrl[targetUrl.find("?") + 1:]
+                            if '?' in targetUrl:
+                                firstPart, secondPart = targetUrl.split('?', 1)
                                 message = "Edit GET data [default: %s]: " % secondPart
                                 test = readInput(message, default=secondPart)
                                 test = _randomFillBlankFields(test)

lib/core/bigarray.py

@@ -10,11 +10,11 @@ try:
 except:
    import pickle
 
+import bz2
 import itertools
 import os
 import sys
 import tempfile
-import zlib
 
 from lib.core.enums import MKSTEMP_PREFIX
 from lib.core.exception import SqlmapSystemException
@@ -86,7 +86,7 @@ class BigArray(list):
             self.chunks.pop()
             try:
                 with open(self.chunks[-1], "rb") as f:
-                    self.chunks[-1] = pickle.loads(zlib.decompress(f.read()))
+                    self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
             except IOError, ex:
                 errMsg = "exception occurred while retrieving data "
                 errMsg += "from a temporary file ('%s')" % ex.message
@@ -107,7 +107,7 @@ class BigArray(list):
             self.filenames.add(filename)
             os.close(handle)
             with open(filename, "w+b") as f:
-                f.write(zlib.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
+                f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
             return filename
         except (OSError, IOError), ex:
             errMsg = "exception occurred while storing data "
@@ -125,7 +125,7 @@ class BigArray(list):
         if not (self.cache and self.cache.index == index):
             try:
                 with open(self.chunks[index], "rb") as f:
-                    self.cache = Cache(index, pickle.loads(zlib.decompress(f.read())), False)
+                    self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
             except IOError, ex:
                 errMsg = "exception occurred while retrieving data "
                 errMsg += "from a temporary file ('%s')" % ex.message

lib/core/common.py

@@ -19,6 +19,7 @@ import locale
 import logging
 import ntpath
 import os
+import platform
 import posixpath
 import random
 import re
@@ -74,6 +75,7 @@ from lib.core.enums import EXPECTED
 from lib.core.enums import HEURISTIC_TEST
 from lib.core.enums import HTTP_HEADER
 from lib.core.enums import HTTPMETHOD
+from lib.core.enums import LOGGING_LEVELS
 from lib.core.enums import MKSTEMP_PREFIX
 from lib.core.enums import OPTION_TYPE
 from lib.core.enums import OS
@@ -868,7 +870,10 @@ def boldifyMessage(message):
 
 def setColor(message, bold=False):
     retVal = message
-    level = extractRegexResult(r"\[(?P<result>[A-Z ]+)\]", message) or kb.get("stickyLevel")
+    level = extractRegexResult(r"\[(?P<result>%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message) or kb.get("stickyLevel")
+
+    if isinstance(level, unicode):
+        level = unicodeencode(level)
 
     if message and getattr(LOGGER_HANDLER, "is_tty", False):  # colorizing handler
         if bold:
@@ -884,6 +889,21 @@ def setColor(message, bold=False):
 
     return retVal
 
+def clearColors(message):
+    """
+    Clears ANSI color codes
+
+    >>> clearColors("\x1b[38;5;82mHello \x1b[38;5;198mWorld")
+    'Hello World'
+    """
+
+    retVal = message
+
+    if message:
+        retVal = re.sub(r"\x1b\[[\d;]+m", "", message)
+
+    return retVal
+
 def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=CONTENT_STATUS.IN_PROGRESS):
     """
     Writes text to the stdout (console) stream
@@ -892,7 +912,7 @@ def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=
     message = ""
 
     if not kb.get("threadException"):
-        if forceOutput or not getCurrentThreadData().disableStdOut:
+        if forceOutput or not (getCurrentThreadData().disableStdOut or kb.get("wizardMode")):
             if kb.get("multiThreadMode"):
                 logging._acquireLock()
 
@@ -998,7 +1018,7 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
                 retVal = "%s,%s" % (retVal, getUnicode(item, UNICODE_ENCODING))
 
     if retVal:
-        dataToStdout("\r%s%s\n" % (message, retVal), forceOutput=True, bold=True)
+        dataToStdout("\r%s%s\n" % (message, retVal), forceOutput=not kb.wizardMode, bold=True)
 
         debugMsg = "used the given answer"
         logger.debug(debugMsg)
@@ -1012,7 +1032,7 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
             else:
                 options = unicode()
 
-            dataToStdout("\r%s%s\n" % (message, options), forceOutput=True, bold=True)
+            dataToStdout("\r%s%s\n" % (message, options), forceOutput=not kb.wizardMode, bold=True)
 
             debugMsg = "used the default behavior, running in batch mode"
             logger.debug(debugMsg)
@@ -1025,7 +1045,7 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
                 if conf.get("beep"):
                     beep()
 
-                dataToStdout("\r%s" % message, forceOutput=True, bold=True)
+                dataToStdout("\r%s" % message, forceOutput=not kb.wizardMode, bold=True)
                 kb.prependFlag = False
 
                 retVal = raw_input().strip() or default
@@ -1173,7 +1193,7 @@ def banner():
         _ = BANNER
 
         if not getattr(LOGGER_HANDLER, "is_tty", False) or "--disable-coloring" in sys.argv:
-            _ = re.sub("\033.+?m", "", _)
+            _ = clearColors(_)
         elif IS_WIN:
             coloramainit()
 
@@ -1400,9 +1420,9 @@ def parseTargetUrl():
 
     if not re.search(r"^http[s]*://", conf.url, re.I) and not re.search(r"^ws[s]*://", conf.url, re.I):
         if ":443/" in conf.url:
-            conf.url = "https://" + conf.url
+            conf.url = "https://%s" % conf.url
         else:
-            conf.url = "http://" + conf.url
+            conf.url = "http://%s" % conf.url
 
     if kb.customInjectionMark in conf.url:
         conf.url = conf.url.replace('?', URI_QUESTION_MARKER)
@@ -3287,9 +3307,9 @@ def unhandledExceptionMessage():
     errMsg += "reproduce the bug. The "
     errMsg += "developers will try to reproduce the bug, fix it accordingly "
     errMsg += "and get back to you\n"
-    errMsg += "sqlmap version: %s\n" % VERSION_STRING[VERSION_STRING.find('/') + 1:]
+    errMsg += "Running version: %s\n" % VERSION_STRING[VERSION_STRING.find('/') + 1:]
     errMsg += "Python version: %s\n" % PYVERSION
-    errMsg += "Operating system: %s\n" % PLATFORM
+    errMsg += "Operating system: %s\n" % platform.platform()
     errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap\.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), encoding=sys.stdin.encoding))
     errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, kb.technique) if kb.get("technique") else ("DIRECT" if conf.get("direct") else None))
     errMsg += "Back-end DBMS:"
@@ -3562,7 +3582,7 @@ def safeSQLIdentificatorNaming(name, isTable=False):
         _ = isTable and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE)
 
         if _:
-            retVal = re.sub(r"(?i)\A\[?%s\]?\." % DEFAULT_MSSQL_SCHEMA, "", retVal)
+            retVal = re.sub(r"(?i)\A\[?%s\]?\." % DEFAULT_MSSQL_SCHEMA, "%s." % DEFAULT_MSSQL_SCHEMA, retVal)
 
         if retVal.upper() in kb.keywords or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal):  # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
             retVal = unsafeSQLIdentificatorNaming(retVal)
@@ -3573,8 +3593,12 @@ def safeSQLIdentificatorNaming(name, isTable=False):
                 retVal = "\"%s\"" % retVal
             elif Backend.getIdentifiedDbms() in (DBMS.ORACLE,):
                 retVal = "\"%s\"" % retVal.upper()
-            elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and ((retVal or " ")[0].isdigit() or not re.match(r"\A\w+\Z", retVal, re.U)):
-                retVal = "[%s]" % retVal
+            elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
+                parts = retVal.split('.', 1)
+                for i in xrange(len(parts)):
+                    if ((parts[i] or " ")[0].isdigit() or not re.match(r"\A\w+\Z", parts[i], re.U)):
+                        parts[i] = "[%s]" % parts[i]
+                retVal = '.'.join(parts)
 
         if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
             retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
@@ -4186,7 +4210,7 @@ def decodeHexValue(value, raw=False):
                     except UnicodeDecodeError:
                         pass
                 if not isinstance(retVal, unicode):
-                    retVal = getUnicode(retVal, "utf8")
+                    retVal = getUnicode(retVal, conf.encoding or "utf8")
 
         return retVal
 

lib/core/dump.py

@@ -46,6 +46,7 @@ from lib.core.settings import METADB_SUFFIX
 from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE
 from lib.core.settings import TRIM_STDOUT_DUMP_SIZE
 from lib.core.settings import UNICODE_ENCODING
+from lib.core.settings import UNSAFE_DUMP_FILEPATH_REPLACEMENT
 from lib.core.settings import WINDOWS_RESERVED_NAMES
 from thirdparty.magic import magic
 
@@ -418,7 +419,7 @@ class Dump(object):
                 except:
                     warnFile = True
 
-                    _ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(db)))
+                    _ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(db)))
                     dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(unicodeencode(db)).hexdigest()[:8]))
 
                     if not os.path.isdir(dumpDbPath):
@@ -441,7 +442,7 @@ class Dump(object):
 
                             dumpDbPath = tempDir
 
-            dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower()))
+            dumpFileName = os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower())))
             if not checkFile(dumpFileName, False):
                 try:
                     openFile(dumpFileName, "w+b").close()
@@ -450,9 +451,9 @@ class Dump(object):
                 except:
                     warnFile = True
 
-                    _ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(table)))
+                    _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(table)))
                     if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES:
-                        _ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(table)))
+                        _ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table)))
                         dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(unicodeencode(table)).hexdigest()[:8], conf.dumpFormat.lower()))
                     else:
                         dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower()))
@@ -613,7 +614,7 @@ class Dump(object):
                                 if not os.path.isdir(dumpDbPath):
                                     os.makedirs(dumpDbPath, 0755)
 
-                                _ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
+                                _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
                                 filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
                                 warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
                                 logger.warn(warnMsg)

lib/core/enums.py

@@ -22,6 +22,15 @@ class SORT_ORDER:
     FIFTH = 4
     LAST = 100
 
+# Reference: https://docs.python.org/2/library/logging.html#logging-levels
+class LOGGING_LEVELS:
+    NOTSET = 0
+    DEBUG = 10
+    INFO = 20
+    WARNING = 30
+    ERROR = 40
+    CRITICAL = 50
+
 class DBMS:
     ACCESS = "Microsoft Access"
     DB2 = "IBM DB2"

lib/core/option.py

@@ -931,7 +931,7 @@ def _setTamperingFunctions():
 
             try:
                 module = __import__(filename[:-3].encode(sys.getfilesystemencoding() or UNICODE_ENCODING))
-            except (ImportError, SyntaxError), ex:
+            except Exception, ex:
                 raise SqlmapSyntaxException("cannot import tamper script '%s' (%s)" % (filename[:-3], getSafeExString(ex)))
 
             priority = PRIORITY.NORMAL if not hasattr(module, "__priority__") else module.__priority__
@@ -1046,7 +1046,7 @@ def _setSocketPreConnect():
     if conf.disablePrecon:
         return
 
-    def _():
+    def _thread():
         while kb.get("threadContinue") and not conf.get("disablePrecon"):
             try:
                 for key in socket._ready:
@@ -1078,6 +1078,7 @@ def _setSocketPreConnect():
                     break
                 else:
                     try:
+                        candidate.shutdown(socket.SHUT_RDWR)
                         candidate.close()
                     except socket.error:
                         pass
@@ -1090,7 +1091,7 @@ def _setSocketPreConnect():
         socket.socket._connect = socket.socket.connect
         socket.socket.connect = connect
 
-        thread = threading.Thread(target=_)
+        thread = threading.Thread(target=_thread)
         setDaemon(thread)
         thread.start()
 
@@ -1647,7 +1648,10 @@ def _cleanupOptions():
         conf.rParam = []
 
     if conf.paramDel and '\\' in conf.paramDel:
-        conf.paramDel = conf.paramDel.decode("string_escape")
+        try:
+            conf.paramDel = conf.paramDel.decode("string_escape")
+        except ValueError:
+            pass
 
     if conf.skip:
         conf.skip = conf.skip.replace(" ", "")
@@ -1784,8 +1788,8 @@ def _cleanupOptions():
     if conf.col:
         conf.col = re.sub(r"\s*,\s*", ',', conf.col)
 
-    if conf.excludeCol:
-        conf.excludeCol = re.sub(r"\s*,\s*", ',', conf.excludeCol)
+    if conf.exclude:
+        conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
 
     if conf.binaryFields:
         conf.binaryFields = re.sub(r"\s*,\s*", ',', conf.binaryFields)
@@ -2034,6 +2038,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
     kb.uChar = NULL
     kb.unionDuplicates = False
     kb.wafSpecificResponse = None
+    kb.wizardMode = False
     kb.xpCmdshellAvailable = False
 
     if flushAll:
@@ -2115,6 +2120,8 @@ def _useWizardInterface():
 
     dataToStdout("\nsqlmap is running, please wait..\n\n")
 
+    kb.wizardMode = True
+
 def _saveConfig():
     """
     Saves the command line options to a sqlmap configuration INI file
@@ -2584,9 +2591,9 @@ def _basicOptionValidation():
     if conf.encoding:
         _ = checkCharEncoding(conf.encoding, False)
         if _ is None:
-            errMsg = "unknown charset '%s'. Please visit " % conf.encoding
+            errMsg = "unknown encoding '%s'. Please visit " % conf.encoding
             errMsg += "'%s' to get the full list of " % CODECS_LIST_PAGE
-            errMsg += "supported charsets"
+            errMsg += "supported encodings"
             raise SqlmapSyntaxException(errMsg)
         else:
             conf.encoding = _

lib/core/optiondict.py

@@ -139,7 +139,7 @@ optDict = {
                                "db":                "string",
                                "tbl":               "string",
                                "col":               "string",
-                               "excludeCol":        "string",
+                               "exclude":           "string",
                                "pivotColumn":       "string",
                                "dumpWhere":         "string",
                                "user":              "string",

lib/core/settings.py

@@ -19,7 +19,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME
 from lib.core.enums import OS
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.2"
+VERSION = "1.2.3.0"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -299,6 +299,10 @@ BASIC_HELP_ITEMS = (
     "wizard",
 )
 
+# Tags used for value replacements inside shell scripts
+SHELL_WRITABLE_DIR_TAG = "%WRITABLE_DIR%"
+SHELL_RUNCMD_EXE_TAG = "%RUNCMD_EXE%"
+
 # String representation for NULL value
 NULL = "NULL"
 
@@ -312,7 +316,7 @@ CURRENT_DB = "CD"
 SESSION_SQLITE_FILE = "session.sqlite"
 
 # Regular expressions used for finding file paths in error messages
-FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line \d+", r"(?P<result>[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.~-]+)", r"href=['\"]file://(?P<result>/[^'\"]+)")
+FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line \d+", r"in (?P<result>[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.~-]+)", r"href=['\"]file://(?P<result>/[^'\"]+)")
 
 # Regular expressions used for parsing error messages (--parse-errors)
 ERROR_PARSING_REGEXES = (
@@ -424,6 +428,9 @@ HASH_MOD_ITEM_DISPLAY = 11
 # Maximum integer value
 MAX_INT = sys.maxint
 
+# Replacement for unsafe characters in dump table filenames
+UNSAFE_DUMP_FILEPATH_REPLACEMENT = '_'
+
 # Options that need to be restored in multiple targets run mode
 RESTORE_MERGED_OPTIONS = ("col", "db", "dnsDomain", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user")
 
@@ -531,7 +538,7 @@ ROTATING_CHARS = ('\\', '|', '|', '/', '-')
 # Approximate chunk length (in bytes) used by BigArray objects (only last chunk and cached one are held in memory)
 BIGARRAY_CHUNK_SIZE = 1024 * 1024
 
-# Compress (zlib) level used for storing BigArray chunks to disk (0-9)
+# Compress level used for storing BigArray chunks to disk (0-9)
 BIGARRAY_COMPRESS_LEVEL = 9
 
 # Maximum number of socket pre-connects

lib/core/update.py

@@ -32,7 +32,7 @@ def update():
         errMsg += "from GitHub (e.g. 'git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap')"
         logger.error(errMsg)
     else:
-        infoMsg = "updating sqlmap to the latest development version from the "
+        infoMsg = "updating sqlmap to the latest development revision from the "
         infoMsg += "GitHub repository"
         logger.info(infoMsg)
 

lib/parse/cmdline.py

@@ -464,8 +464,8 @@ def cmdLineParser(argv=None):
         enumeration.add_option("-C", dest="col",
                                help="DBMS database table column(s) to enumerate")
 
-        enumeration.add_option("-X", dest="excludeCol",
-                               help="DBMS database table column(s) to not enumerate")
+        enumeration.add_option("-X", dest="exclude",
+                               help="DBMS database identifier(s) to not enumerate")
 
         enumeration.add_option("-U", dest="user",
                                help="DBMS user to enumerate")

lib/request/basic.py

@@ -218,7 +218,7 @@ def checkCharEncoding(encoding, warn=True):
     try:
         codecs.lookup(encoding.encode(UNICODE_ENCODING) if isinstance(encoding, unicode) else encoding)
     except (LookupError, ValueError):
-        if warn:
+        if warn and ' ' not in encoding:
             warnMsg = "unknown web page charset '%s'. " % encoding
             warnMsg += "Please report by e-mail to '%s'" % DEV_EMAIL_ADDRESS
             singleTimeLogMessage(warnMsg, logging.WARN, encoding)

lib/request/connect.py

@@ -479,8 +479,7 @@ class Connect(object):
 
                 # Get HTTP response
                 if hasattr(conn, "redurl"):
-                    page = (threadData.lastRedirectMsg[1] if kb.redirectChoice == REDIRECTION.NO\
-                    else Connect._connReadProxy(conn)) if not skipRead else None
+                    page = (threadData.lastRedirectMsg[1] if kb.redirectChoice == REDIRECTION.NO else Connect._connReadProxy(conn)) if not skipRead else None
                     skipLogTraffic = kb.redirectChoice == REDIRECTION.NO
                     code = conn.redcode
                 else:

lib/takeover/web.py

@@ -47,6 +47,8 @@ from lib.core.enums import WEB_API
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.settings import BACKDOOR_RUN_CMD_TIMEOUT
 from lib.core.settings import EVENTVALIDATION_REGEX
+from lib.core.settings import SHELL_RUNCMD_EXE_TAG
+from lib.core.settings import SHELL_WRITABLE_DIR_TAG
 from lib.core.settings import VIEWSTATE_REGEX
 from lib.request.connect import Connect as Request
 from thirdparty.oset.pyoset import oset
@@ -134,7 +136,7 @@ class Web:
 
     def _webFileInject(self, fileContent, fileName, directory):
         outFile = posixpath.join(ntToPosixSlashes(directory), fileName)
-        uplQuery = getUnicode(fileContent).replace("WRITABLE_DIR", directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory)
+        uplQuery = getUnicode(fileContent).replace(SHELL_WRITABLE_DIR_TAG, directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory)
         query = ""
 
         if isTechniqueAvailable(kb.technique):
@@ -257,6 +259,7 @@ class Web:
         directories = list(oset(directories))
 
         path = urlparse.urlparse(conf.url).path or '/'
+        path = re.sub(r"/[^/]*\.\w+\Z", '/', path)
         if path != '/':
             _ = []
             for directory in directories:
@@ -324,7 +327,7 @@ class Web:
 
                     with open(filename, "w+b") as f:
                         _ = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stagers", "stager.%s_" % self.webApi))
-                        _ = _.replace("WRITABLE_DIR", utf8encode(directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory))
+                        _ = _.replace(SHELL_WRITABLE_DIR_TAG, utf8encode(directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory))
                         f.write(_)
 
                     self.unionWriteFile(filename, self.webStagerFilePath, "text", forceCheck=True)
@@ -369,7 +372,7 @@ class Web:
                     continue
 
                 _ = "tmpe%s.exe" % randomStr(lowercase=True)
-                if self.webUpload(backdoorName, backdoorDirectory, content=backdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", _)):
+                if self.webUpload(backdoorName, backdoorDirectory, content=backdoorContent.replace(SHELL_WRITABLE_DIR_TAG, backdoorDirectory).replace(SHELL_RUNCMD_EXE_TAG, _)):
                     self.webUpload(_, backdoorDirectory, filepath=os.path.join(paths.SQLMAP_EXTRAS_PATH, "runcmd", "runcmd.exe_"))
                     self.webBackdoorUrl = "%s/Scripts/%s" % (self.webBaseUrl, backdoorName)
                     self.webDirectory = backdoorDirectory

lib/techniques/blind/inference.py

@@ -223,7 +223,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
 
             result = not Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False)
 
-            if result and timeBasedCompare:
+            if result and timeBasedCompare and kb.injection.data[kb.technique].trueCode:
                 result = threadData.lastCode == kb.injection.data[kb.technique].trueCode
                 if not result:
                     warnMsg = "detected HTTP code '%s' in validation phase is differing from expected '%s'" % (threadData.lastCode, kb.injection.data[kb.technique].trueCode)

lib/techniques/union/test.py

@@ -48,7 +48,7 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
     """
     retVal = None
 
-    def _orderByTechnique():
+    def _orderByTechnique(lowerCount, upperCount):
         def _orderByTest(cols):
             query = agent.prefixQuery("ORDER BY %d" % cols, prefix=prefix)
             query = agent.suffixQuery(query, suffix=suffix, comment=comment)
@@ -56,7 +56,7 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
             page, headers, code = Request.queryPage(payload, place=place, content=True, raise404=False)
             return not any(re.search(_, page or "", re.I) and not re.search(_, kb.pageTemplate or "", re.I) for _ in ("(warning|error):", "order by", "unknown column", "failed")) and comparison(page, headers, code) or re.search(r"data types cannot be compared or sorted", page or "", re.I)
 
-        if _orderByTest(1) and not _orderByTest(randomInt()):
+        if _orderByTest(1 if lowerCount is None else lowerCount) and not _orderByTest(randomInt() if upperCount is None else upperCount + 1):
             infoMsg = "'ORDER BY' technique appears to be usable. "
             infoMsg += "This should reduce the time needed "
             infoMsg += "to find the right number "
@@ -64,10 +64,10 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
             infoMsg += "range for current UNION query injection technique test"
             singleTimeLogMessage(infoMsg)
 
-            lowCols, highCols = 1, ORDER_BY_STEP
+            lowCols, highCols = 1 if lowerCount is None else lowerCount, ORDER_BY_STEP if upperCount is None else upperCount
             found = None
             while not found:
-                if _orderByTest(highCols):
+                if not conf.uCols and _orderByTest(highCols):
                     lowCols = highCols
                     highCols += ORDER_BY_STEP
                 else:
@@ -88,8 +88,8 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
         kb.errorIsNone = False
         lowerCount, upperCount = conf.uColsStart, conf.uColsStop
 
-        if lowerCount == 1:
-            found = kb.orderByColumns or _orderByTechnique()
+        if lowerCount == 1 or conf.uCols:
+            found = kb.orderByColumns or _orderByTechnique(lowerCount, upperCount)
             if found:
                 kb.orderByColumns = found
                 infoMsg = "target URL appears to have %d column%s in query" % (found, 's' if found > 1 else "")

lib/utils/api.py

@@ -45,7 +45,6 @@ from lib.core.settings import RESTAPI_DEFAULT_ADDRESS
 from lib.core.settings import RESTAPI_DEFAULT_PORT
 from lib.core.subprocessng import Popen
 from lib.parse.cmdline import cmdLineParser
-from thirdparty.bottle.bottle import abort
 from thirdparty.bottle.bottle import error as return_error
 from thirdparty.bottle.bottle import get
 from thirdparty.bottle.bottle import hook

lib/utils/deps.py

@@ -25,7 +25,7 @@ def checkDependencies():
                 if not hasattr(pymssql, "__version__") or pymssql.__version__ < "1.0.2":
                     warnMsg = "'%s' third-party library must be " % data[1]
                     warnMsg += "version >= 1.0.2 to work properly. "
-                    warnMsg += "Download from %s" % data[2]
+                    warnMsg += "Download from '%s'" % data[2]
                     logger.warn(warnMsg)
             elif dbmsName == DBMS.MYSQL:
                 __import__("pymysql")
@@ -49,7 +49,7 @@ def checkDependencies():
         except:
             warnMsg = "sqlmap requires '%s' third-party library " % data[1]
             warnMsg += "in order to directly connect to the DBMS "
-            warnMsg += "'%s'. Download from %s" % (dbmsName, data[2])
+            warnMsg += "'%s'. Download from '%s'" % (dbmsName, data[2])
             logger.warn(warnMsg)
             missing_libraries.add(data[1])
 
@@ -65,7 +65,7 @@ def checkDependencies():
     except ImportError:
         warnMsg = "sqlmap requires 'python-impacket' third-party library for "
         warnMsg += "out-of-band takeover feature. Download from "
-        warnMsg += "http://code.google.com/p/impacket/"
+        warnMsg += "'http://code.google.com/p/impacket/'"
         logger.warn(warnMsg)
         missing_libraries.add('python-impacket')
 
@@ -76,7 +76,7 @@ def checkDependencies():
     except ImportError:
         warnMsg = "sqlmap requires 'python-ntlm' third-party library "
         warnMsg += "if you plan to attack a web application behind NTLM "
-        warnMsg += "authentication. Download from http://code.google.com/p/python-ntlm/"
+        warnMsg += "authentication. Download from 'http://code.google.com/p/python-ntlm/'"
         logger.warn(warnMsg)
         missing_libraries.add('python-ntlm')
 
@@ -87,7 +87,7 @@ def checkDependencies():
     except ImportError:
         warnMsg = "sqlmap requires 'websocket-client' third-party library "
         warnMsg += "if you plan to attack a web application using WebSocket. "
-        warnMsg += "Download from https://pypi.python.org/pypi/websocket-client/"
+        warnMsg += "Download from 'https://pypi.python.org/pypi/websocket-client/'"
         logger.warn(warnMsg)
         missing_libraries.add('websocket-client')
 
@@ -101,7 +101,7 @@ def checkDependencies():
             warnMsg += "be able to take advantage of the sqlmap TAB "
             warnMsg += "completion and history support features in the SQL "
             warnMsg += "shell and OS shell. Download from "
-            warnMsg += "http://ipython.scipy.org/moin/PyReadline/Intro"
+            warnMsg += "'http://ipython.scipy.org/moin/PyReadline/Intro'"
             logger.warn(warnMsg)
             missing_libraries.add('python-pyreadline')
 

lib/utils/hash.py

@@ -16,6 +16,9 @@ try:
 
     # problems on FreeBSD (Reference: http://www.eggheadcafe.com/microsoft/Python/35880259/multiprocessing-on-freebsd.aspx)
     _ = multiprocessing.Queue()
+
+    # problems with ctypes (Reference: https://github.com/sqlmapproject/sqlmap/issues/2952)
+    _ = multiprocessing.Value('i')
 except (ImportError, OSError):
     pass
 else:
@@ -693,9 +696,7 @@ def hashRecognition(value):
     if isinstance(value, basestring):
         for name, regex in getPublicTypeMembers(HASH):
             # Hashes for Oracle and old MySQL look the same hence these checks
-            if isOracle and regex == HASH.MYSQL_OLD:
-                continue
-            elif isMySQL and regex == HASH.ORACLE_OLD:
+            if isOracle and regex == HASH.MYSQL_OLD or isMySQL and regex == HASH.ORACLE_OLD:
                 continue
             elif regex == HASH.CRYPT_GENERIC:
                 if any((value.lower() == value, value.upper() == value)):
@@ -712,7 +713,7 @@ def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc
 
     count = 0
     rotator = 0
-    hashes = set([item[0][1] for item in attack_info])
+    hashes = set(item[0][1] for item in attack_info)
 
     wordlist = Wordlist(wordlists, proc_id, getattr(proc_count, "value", 0), custom_wordlist)
 
@@ -721,6 +722,8 @@ def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc
             if not attack_info:
                 break
 
+            count += 1
+
             if not isinstance(word, basestring):
                 continue
 
@@ -730,8 +733,6 @@ def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc
             try:
                 current = __functions__[hash_regex](password=word, uppercase=False)
 
-                count += 1
-
                 if current in hashes:
                     for item in attack_info[:]:
                         ((user, hash_), _) = item
@@ -758,7 +759,7 @@ def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc
                     if rotator >= len(ROTATING_CHARS):
                         rotator = 0
 
-                    status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator])
+                    status = "current status: %s... %s" % (word.ljust(5)[:5], ROTATING_CHARS[rotator])
 
                     if not api:
                         dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status))
@@ -796,7 +797,6 @@ def _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found
             if found.value:
                 break
 
-            current = __functions__[hash_regex](password=word, uppercase=False, **kwargs)
             count += 1
 
             if not isinstance(word, basestring):
@@ -806,6 +806,8 @@ def _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found
                 word = word + suffix
 
             try:
+                current = __functions__[hash_regex](password=word, uppercase=False, **kwargs)
+
                 if hash_ == current:
                     if hash_regex == HASH.ORACLE_OLD:  # only for cosmetic purposes
                         word = word.upper()
@@ -827,12 +829,14 @@ def _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found
 
                 elif (proc_id == 0 or getattr(proc_count, "value", 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0:
                     rotator += 1
+
                     if rotator >= len(ROTATING_CHARS):
                         rotator = 0
-                    status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator])
+
+                    status = "current status: %s... %s" % (word.ljust(5)[:5], ROTATING_CHARS[rotator])
 
                     if user and not user.startswith(DUMMY_USER_PREFIX):
-                        status += ' (user: %s)' % user
+                        status += " (user: %s)" % user
 
                     if not api:
                         dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status))

lib/utils/sqlalchemy.py

@@ -54,7 +54,13 @@ class SQLAlchemy(GenericConnector):
                 if self.dialect:
                     conf.direct = conf.direct.replace(conf.dbms, self.dialect, 1)
 
-                engine = _sqlalchemy.create_engine(conf.direct, connect_args={"check_same_thread": False} if self.dialect == "sqlite" else {})
+                if self.dialect == "sqlite":
+                    engine = _sqlalchemy.create_engine(conf.direct, connect_args={"check_same_thread": False})
+                elif self.dialect == "oracle":
+                    engine = _sqlalchemy.create_engine(conf.direct, connect_args={"allow_twophase": False})
+                else:
+                    engine = _sqlalchemy.create_engine(conf.direct, connect_args={})
+
                 self.connector = engine.connect()
             except (TypeError, ValueError):
                 if "_get_server_version_info" in traceback.format_exc():

lib/utils/versioncheck.py

@@ -10,9 +10,9 @@ import sys
 PYVERSION = sys.version.split()[0]
 
 if PYVERSION >= "3" or PYVERSION < "2.6":
-    exit("[CRITICAL] incompatible Python version detected ('%s'). For successfully running sqlmap you'll have to use version 2.6.x or 2.7.x (visit 'https://www.python.org/downloads/')" % PYVERSION)
+    exit("[CRITICAL] incompatible Python version detected ('%s'). To successfully run sqlmap you'll have to use version 2.6.x or 2.7.x (visit 'https://www.python.org/downloads/')" % PYVERSION)
 
-extensions = ("gzip", "ssl", "sqlite3", "zlib")
+extensions = ("bz2", "gzip", "ssl", "sqlite3", "zlib")
 try:
     for _ in extensions:
         __import__(_)

plugins/dbms/maxdb/enumeration.py

@@ -120,8 +120,8 @@ class Enumeration(GenericEnumeration):
         else:
             colList = []
 
-        if conf.excludeCol:
-            colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+        if conf.exclude:
+            colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
         for col in colList:
             colList[colList.index(col)] = safeSQLIdentificatorNaming(col)

plugins/dbms/mssqlserver/enumeration.py

@@ -14,6 +14,7 @@ from lib.core.common import isNumPosStrValue
 from lib.core.common import isTechniqueAvailable
 from lib.core.common import safeSQLIdentificatorNaming
 from lib.core.common import safeStringFormat
+from lib.core.common import singleTimeLogMessage
 from lib.core.common import unArrayizeValue
 from lib.core.common import unsafeSQLIdentificatorNaming
 from lib.core.data import conf
@@ -94,8 +95,12 @@ class Enumeration(GenericEnumeration):
             for db in dbs:
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
-                    logger.info(infoMsg)
+                    singleTimeLogMessage(infoMsg)
+                    continue
 
+                if conf.exclude and db in conf.exclude.split(','):
+                    infoMsg = "skipping database '%s'" % db
+                    singleTimeLogMessage(infoMsg)
                     continue
 
                 for query in (rootQuery.inband.query, rootQuery.inband.query2, rootQuery.inband.query3):
@@ -113,8 +118,12 @@ class Enumeration(GenericEnumeration):
             for db in dbs:
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
-                    logger.info(infoMsg)
+                    singleTimeLogMessage(infoMsg)
+                    continue
 
+                if conf.exclude and db in conf.exclude.split(','):
+                    infoMsg = "skipping database '%s'" % db
+                    singleTimeLogMessage(infoMsg)
                     continue
 
                 infoMsg = "fetching number of tables for "
@@ -199,8 +208,12 @@ class Enumeration(GenericEnumeration):
 
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
-                    logger.info(infoMsg)
+                    singleTimeLogMessage(infoMsg)
+                    continue
 
+                if conf.exclude and db in conf.exclude.split(','):
+                    infoMsg = "skipping database '%s'" % db
+                    singleTimeLogMessage(infoMsg)
                     continue
 
                 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
@@ -271,8 +284,8 @@ class Enumeration(GenericEnumeration):
         infoMsgDb = ""
         colList = conf.col.split(',')
 
-        if conf.excludeCol:
-            colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+        if conf.exclude:
+            colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
         origTbl = conf.tbl
         origDb = conf.db
@@ -318,8 +331,7 @@ class Enumeration(GenericEnumeration):
                 _ = conf.db.split(',')
                 infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _))
             elif conf.excludeSysDbs:
-                msg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList))
-                logger.info(msg)
+                infoMsgDb = " not in system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList))
             else:
                 infoMsgDb = " across all databases"
 
@@ -334,6 +346,9 @@ class Enumeration(GenericEnumeration):
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     continue
 
+                if conf.exclude and db in conf.exclude.split(','):
+                    continue
+
                 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
                     query = rootQuery.inband.query % (db, db, db, db, db, db)
                     query += " AND %s" % colQuery.replace("[DB]", db)

plugins/dbms/mysql/filesystem.py

@@ -68,14 +68,13 @@ class Filesystem(GenericFilesystem):
                 raise SqlmapNoneDataException(warnMsg)
         else:
             length = int(length)
-            sustrLen = 1024
+            chunkSize = 1024
 
-            if length > sustrLen:
+            if length > chunkSize:
                 result = []
 
-                for i in xrange(1, length, sustrLen):
-                    chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, sustrLen, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)
-
+                for i in xrange(1, length, chunkSize):
+                    chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, chunkSize, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)
                     result.append(chunk)
             else:
                 result = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)

plugins/dbms/oracle/connector.py

@@ -12,6 +12,7 @@ except:
 
 import logging
 import os
+import re
 
 from lib.core.convert import utf8encode
 from lib.core.data import conf
@@ -42,7 +43,13 @@ class Connector(GenericConnector):
         try:
             self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password, mode=cx_Oracle.SYSDBA)
             logger.info("successfully connected as SYSDBA")
-        except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError, cx_Oracle.InterfaceError):
+        except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError, cx_Oracle.InterfaceError), ex:
+            if "Oracle Client library" in str(ex):
+                msg = re.sub(r"DPI-\d+:\s+", "", str(ex))
+                msg = re.sub(r': ("[^"]+")', r" (\g<1>)", msg)
+                msg = re.sub(r". See (http[^ ]+)", r'. See "\g<1>"', msg)
+                raise SqlmapConnectionException(msg)
+
             try:
                 self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password)
             except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError, cx_Oracle.InterfaceError), msg:

plugins/dbms/sybase/enumeration.py

@@ -188,8 +188,8 @@ class Enumeration(GenericEnumeration):
         else:
             colList = []
 
-        if conf.excludeCol:
-            colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+        if conf.exclude:
+            colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
         for col in colList:
             colList[colList.index(col)] = safeSQLIdentificatorNaming(col)

plugins/generic/databases.py

@@ -23,6 +23,7 @@ from lib.core.common import pushValue
 from lib.core.common import randomStr
 from lib.core.common import readInput
 from lib.core.common import safeSQLIdentificatorNaming
+from lib.core.common import singleTimeLogMessage
 from lib.core.common import singleTimeWarnMessage
 from lib.core.common import unArrayizeValue
 from lib.core.common import unsafeSQLIdentificatorNaming
@@ -298,7 +299,11 @@ class Databases:
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % unsafeSQLIdentificatorNaming(db)
                     logger.info(infoMsg)
+                    continue
 
+                if conf.exclude and db in conf.exclude.split(','):
+                    infoMsg = "skipping database '%s'" % unsafeSQLIdentificatorNaming(db)
+                    singleTimeLogMessage(infoMsg)
                     continue
 
                 infoMsg = "fetching number of tables for "
@@ -410,8 +415,8 @@ class Databases:
         else:
             colList = []
 
-        if conf.excludeCol:
-            colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+        if conf.exclude:
+            colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
         for col in colList:
             colList[colList.index(col)] = safeSQLIdentificatorNaming(col)

plugins/generic/entries.py

@@ -22,6 +22,7 @@ from lib.core.common import isTechniqueAvailable
 from lib.core.common import prioritySortColumns
 from lib.core.common import readInput
 from lib.core.common import safeSQLIdentificatorNaming
+from lib.core.common import singleTimeLogMessage
 from lib.core.common import unArrayizeValue
 from lib.core.common import unsafeSQLIdentificatorNaming
 from lib.core.data import conf
@@ -68,11 +69,16 @@ class Entries:
             if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB):
                 conf.db = conf.db.upper()
 
-            if  ',' in conf.db:
+            if ',' in conf.db:
                 errMsg = "only one database name is allowed when enumerating "
                 errMsg += "the tables' columns"
                 raise SqlmapMissingMandatoryOptionException(errMsg)
 
+            if conf.exclude and conf.db in conf.exclude.split(','):
+                infoMsg = "skipping database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
+                singleTimeLogMessage(infoMsg)
+                return
+
         conf.db = safeSQLIdentificatorNaming(conf.db)
 
         if conf.tbl:
@@ -99,6 +105,11 @@ class Entries:
             tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True)
 
         for tbl in tblList:
+            if conf.exclude and tbl in conf.exclude.split(','):
+                infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl)
+                singleTimeLogMessage(infoMsg)
+                continue
+
             conf.tbl = tbl
             kb.data.dumpedTable = {}
 
@@ -129,8 +140,8 @@ class Entries:
                 columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]
                 colList = sorted(filter(None, columns.keys()))
 
-                if conf.excludeCol:
-                    colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+                if conf.exclude:
+                    colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
                 if not colList:
                     warnMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl)
@@ -465,6 +476,11 @@ class Entries:
                 conf.db = db
 
                 for table in tables:
+                    if conf.exclude and table in conf.exclude.split(','):
+                        infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table)
+                        logger.info(infoMsg)
+                        continue
+
                     try:
                         conf.tbl = table
                         kb.data.cachedColumns = {}
@@ -530,8 +546,8 @@ class Entries:
                 conf.tbl = table
                 colList = filter(None, sorted(columns))
 
-                if conf.excludeCol:
-                    colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+                if conf.exclude:
+                    colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
                 conf.col = ','.join(colList)
                 kb.data.cachedColumns = {}

plugins/generic/search.py

@@ -371,8 +371,8 @@ class Search:
         infoMsgDb = ""
         colList = conf.col.split(',')
 
-        if conf.excludeCol:
-            colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')]
+        if conf.exclude:
+            colList = [_ for _ in colList if _ not in conf.exclude.split(',')]
 
         origTbl = conf.tbl
         origDb = conf.db

shell/README.txt

@@ -1,7 +1,7 @@
 Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
 
 To prepare the original scripts to the cloaked form use this command:
-find backdoor.* stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
+find backdoors/backdoor.* stagers/stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
 
 To get back them into the original form use this:
-find backdoor.*_ stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
+find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;

sqlmap.conf

@@ -494,8 +494,8 @@ tbl =
 # Back-end database management system database table column(s) to enumerate.
 col = 
 
-# Back-end database management system database table column(s) to not enumerate.
-excludeCol = 
+# Back-end database management system identifiers (database(s), table(s) and column(s)) to not enumerate.
+exclude = 
 
 # Pivot column name.
 pivotColumn =

sqlmap.py

@@ -297,6 +297,14 @@ def main():
                 logger.error(errMsg)
                 raise SystemExit
 
+            elif "url = url.strip()" in excMsg:
+                dataToStdout(excMsg)
+                print
+                errMsg = "please contact '[email protected]' with details for this issue "
+                errMsg += "as he is trying to reproduce it for long time"
+                logger.error(errMsg)
+                raise SystemExit
+
             elif "valueStack.pop" in excMsg and kb.get("dumpKeyboardInterrupt"):
                 raise SystemExit
 
@@ -381,3 +389,6 @@ def main():
 
 if __name__ == "__main__":
     main()
+else:
+    # cancelling postponed imports (because of Travis CI checks)
+    from lib.controller.controller import start

tamper/appendnullbyte.py

@@ -5,12 +5,16 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.LOWEST
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ACCESS))
 
 def tamper(payload, **kwargs):
     """

tamper/base64encode.py

@@ -10,7 +10,7 @@ import base64
 from lib.core.enums import PRIORITY
 from lib.core.settings import UNICODE_ENCODING
 
-__priority__ = PRIORITY.LOWEST
+__priority__ = PRIORITY.LOW
 
 def dependencies():
     pass

tamper/bluecoat.py

@@ -18,7 +18,7 @@ def dependencies():
 def tamper(payload, **kwargs):
     """
     Replaces space character after SQL statement with a valid random blank character.
-    Afterwards replace character = with LIKE operator
+    Afterwards replace character '=' with operator LIKE
 
     Requirement:
         * Blue Coat SGOS with WAF activated as documented in

tamper/charunicodeescape.py

@@ -9,7 +9,7 @@ import string
 
 from lib.core.enums import PRIORITY
 
-__priority__ = PRIORITY.LOWEST
+__priority__ = PRIORITY.NORMAL
 
 def tamper(payload, **kwargs):
     """

tamper/commalesslimit.py

@@ -5,14 +5,17 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
 import re
 
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGH
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
 
 def tamper(payload, **kwargs):
     """

tamper/commalessmid.py

@@ -9,12 +9,13 @@ import os
 import re
 
 from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGH
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
 
 def tamper(payload, **kwargs):
     """

tamper/commentbeforeparentheses.py

@@ -9,7 +9,7 @@ import re
 
 from lib.core.enums import PRIORITY
 
-__priority__ = PRIORITY.LOW
+__priority__ = PRIORITY.NORMAL
 
 def dependencies():
     pass

tamper/concat2concatws.py

@@ -5,12 +5,16 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGHEST
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
 
 def tamper(payload, **kwargs):
     """

tamper/escapequotes.py

@@ -7,7 +7,7 @@ See the file 'LICENSE' for copying permission
 
 from lib.core.enums import PRIORITY
 
-__priority__ = PRIORITY.LOWEST
+__priority__ = PRIORITY.NORMAL
 
 def dependencies():
     pass

tamper/informationschemacomment.py

@@ -9,7 +9,7 @@ import re
 
 from lib.core.enums import PRIORITY
 
-__priority__ = PRIORITY.LOW
+__priority__ = PRIORITY.NORMAL
 
 def tamper(payload, **kwargs):
     """

tamper/lowercase.py

@@ -28,7 +28,6 @@ def tamper(payload, **kwargs):
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that has poorly written permissive regular expressions
-        * This tamper script should work against all (?) databases
 
     >>> tamper('INSERT')
     'insert'
@@ -37,7 +36,7 @@ def tamper(payload, **kwargs):
     retVal = payload
 
     if payload:
-        for match in re.finditer(r"[A-Za-z_]+", retVal):
+        for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
             word = match.group()
 
             if word.upper() in kb.keywords:

tamper/modsecurityversioned.py

@@ -5,13 +5,17 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
+
 from lib.core.common import randomInt
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGHER
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
 
 def tamper(payload, **kwargs):
     """

tamper/modsecurityzeroversioned.py

@@ -5,12 +5,16 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGHER
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
 
 def tamper(payload, **kwargs):
     """

tamper/multiplespaces.py

@@ -36,7 +36,7 @@ def tamper(payload, **kwargs):
     if payload:
         words = set()
 
-        for match in re.finditer(r"[A-Za-z_]+", payload):
+        for match in re.finditer(r"\b[A-Za-z_]+\b", payload):
             word = match.group()
 
             if word.upper() in kb.keywords:

tamper/overlongutf8.py

@@ -16,13 +16,13 @@ def dependencies():
 
 def tamper(payload, **kwargs):
     """
-    Converts all characters in a given payload (not processing already
-    encoded)
+    Converts all (non-alphanum) characters in a given payload (not processing already encoded)
 
     Reference: https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/
+    Reference: https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/
 
     >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')
-    'SELECT%C0%AAFIELD%C0%AAFROM%C0%AATABLE%C0%AAWHERE%C0%AA2%C0%BE1'
+    'SELECT%C0%A0FIELD%C0%A0FROM%C0%A0TABLE%C0%A0WHERE%C0%A02%C0%BE1'
     """
 
     retVal = payload
@@ -37,7 +37,7 @@ def tamper(payload, **kwargs):
                 i += 3
             else:
                 if payload[i] not in (string.ascii_letters + string.digits):
-                    retVal += "%%C0%%%.2X" % (0x8A | ord(payload[i]))
+                    retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f))
                 else:
                     retVal += payload[i]
                 i += 1

tamper/overlongutf8more.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
+See the file 'LICENSE' for copying permission
+"""
+
+import string
+
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.LOWEST
+
+def dependencies():
+    pass
+
+def tamper(payload, **kwargs):
+    """
+    Converts all characters in a given payload (not processing already encoded)
+
+    Reference: https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/
+    Reference: https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/
+
+    >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')
+    '%C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94%C0%A0%C1%86%C1%89%C1%85%C1%8C%C1%84%C0%A0%C1%86%C1%92%C1%8F%C1%8D%C0%A0%C1%94%C1%81%C1%82%C1%8C%C1%85%C0%A0%C1%97%C1%88%C1%85%C1%92%C1%85%C0%A0%C0%B2%C0%BE%C0%B1'
+    """
+
+    retVal = payload
+
+    if payload:
+        retVal = ""
+        i = 0
+
+        while i < len(payload):
+            if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits:
+                retVal += payload[i:i + 3]
+                i += 3
+            else:
+                retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f))
+                i += 1
+
+    return retVal

tamper/plus2concat.py

@@ -5,15 +5,18 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
 import re
 
+from lib.core.common import singleTimeWarnMessage
 from lib.core.common import zeroDepthSearch
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGHEST
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL))
 
 def tamper(payload, **kwargs):
     """
@@ -58,7 +61,7 @@ def tamper(payload, **kwargs):
 
                 retVal = "%sCONCAT(%s)%s" % (retVal[:start], ''.join(chars)[start:end], retVal[end:])
             else:
-                match = re.search(r"\((CHAR\(\d+.+CHAR\(\d+\))\)", retVal)
+                match = re.search(r"\((CHAR\(\d+.+\bCHAR\(\d+\))\)", retVal)
                 if match:
                     part = match.group(0)
                     indexes = set(zeroDepthSearch(match.group(1), '+'))

tamper/plus2fnconcat.py

@@ -5,15 +5,18 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+import os
 import re
 
+from lib.core.common import singleTimeWarnMessage
 from lib.core.common import zeroDepthSearch
+from lib.core.enums import DBMS
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.HIGHEST
 
 def dependencies():
-    pass
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL))
 
 def tamper(payload, **kwargs):
     """
@@ -64,7 +67,7 @@ def tamper(payload, **kwargs):
 
                 retVal = "%s%s%s)}%s" % (retVal[:start], "{fn CONCAT(" * count, ''.join(chars)[start:end].replace('\x01', ")},"), retVal[end:])
             else:
-                match = re.search(r"\((CHAR\(\d+.+CHAR\(\d+\))\)", retVal)
+                match = re.search(r"\((CHAR\(\d+.+\bCHAR\(\d+\))\)", retVal)
                 if match:
                     part = match.group(0)
                     indexes = set(zeroDepthSearch(match.group(1), '+'))

tamper/randomcase.py

@@ -40,7 +40,7 @@ def tamper(payload, **kwargs):
     retVal = payload
 
     if payload:
-        for match in re.finditer(r"[A-Za-z_]+", retVal):
+        for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
             word = match.group()
 
             if word.upper() in kb.keywords:

thirdparty/clientform/clientform.py

@@ -2455,7 +2455,7 @@ class SubmitControl(ScalarControl):
         # IE5 defaults SUBMIT value to "Submit Query"; Firebird 0.6 leaves it
         # blank, Konqueror 3.1 defaults to "Submit".  HTML spec. doesn't seem
         # to define this.
-        if self.value is None and not self.disabled: self.value = ""
+        if self.value is None and not self.disabled and not self.readonly: self.value = ""
         self.readonly = True
 
     def get_labels(self):

thirdparty/colorama/ansitowin32.py

@@ -171,9 +171,19 @@ class AnsiToWin32(object):
 
     def write_plain_text(self, text, start, end):
         if start < end:
-            self.wrapped.write(text[start:end])
+            self._write(text[start:end])
             self.wrapped.flush()
 
+    # Reference: https://github.com/robotframework/robotframework/commit/828c67695d85519e4435c556c43ed1b00985df05
+    #  Workaround for Windows 10 console bug:
+    #  https://github.com/robotframework/robotframework/issues/2709
+    def _write(self, text, retry=5):
+        try:
+            self.wrapped.write(text)
+        except IOError, err:
+            if not (err.errno == 0 and retry > 0):
+                raise
+            self._write(text, retry-1)
 
     def convert_ansi(self, paramstring, command):
         if self.convert:

txt/checksum.md5

@@ -21,43 +21,43 @@ c88d66597f4aab719bde4542b0a1a6e0  extra/shutils/regressiontest.py
 1e5532ede194ac9c083891c2f02bca93  extra/sqlharvest/__init__.py
 b3e60ea4e18a65c48515d04aab28ff68  extra/sqlharvest/sqlharvest.py
 0f581182871148b0456a691ae85b04c0  lib/controller/action.py
-43cbf0f72f57279c6f65d531241e962c  lib/controller/checks.py
-ccd66880fc677a3c83db2a3a70d196d7  lib/controller/controller.py
+a4605691d340fd05d4bfe7dde922da92  lib/controller/checks.py
+9fbd66da9b5cf58bbb8474ccf9252bb7  lib/controller/controller.py
 a7b0c8e5a18a3abe8803999dcfc4664f  lib/controller/handler.py
 1e5532ede194ac9c083891c2f02bca93  lib/controller/__init__.py
 e3a3f5218b2e52dd0afafdfc9fed2002  lib/core/agent.py
-62fade52c1524364e6e0653c31143a9c  lib/core/bigarray.py
-787f1b610fec311c8ed26a1a36993fae  lib/core/common.py
+86a4703d5474badd8462146510b2c460  lib/core/bigarray.py
+863d9c00a7684db29005705d6dcc36b9  lib/core/common.py
 2a40d5b5997265daa890545d4a4a59b9  lib/core/convert.py
 9f87391b6a3395f7f50830b391264f27  lib/core/data.py
 72016ea5c994a711a262fd64572a0fcd  lib/core/datatype.py
 12e80071013606f01822c3823fb51054  lib/core/decorators.py
 9458679feb9184f3fb1611daf1ebef63  lib/core/defaults.py
 a8bea09096a42a9a7feeb9d4d118ae66  lib/core/dicts.py
-1a94690d60ed792ce441b6f2f4dbbef8  lib/core/dump.py
-2ef745b04933855e049ba7fdc98f57b8  lib/core/enums.py
+0d742fbf72bca25a3e82640616c30c9a  lib/core/dump.py
+c8551f7696a76450e6d139409e4f06cd  lib/core/enums.py
 cada93357a7321655927fc9625b3bfec  lib/core/exception.py
 1e5532ede194ac9c083891c2f02bca93  lib/core/__init__.py
 458a194764805cd8312c14ecd4be4d1e  lib/core/log.py
-9eed2d4d370f375bda5e0c0488740e7f  lib/core/optiondict.py
-8ca14b6faf28d2e5a2703ed5e7d6cce2  lib/core/option.py
+63ac6631d75e4f7c20b946a0c06bad33  lib/core/optiondict.py
+a377168b153725d3677924040b7861f4  lib/core/option.py
 7dadbb9a301d40cc8cd9c7491e99b43d  lib/core/profiling.py
 ffa5f01f39b17c8d73423acca6cfe86a  lib/core/readlineng.py
 0c3eef46bdbf87e29a3f95f90240d192  lib/core/replication.py
 a7db43859b61569b601b97f187dd31c5  lib/core/revision.py
 fcb74fcc9577523524659ec49e2e964b  lib/core/session.py
-e5967d7d5119cf82bb78949a40fa0486  lib/core/settings.py
+ae4670ba5c8569d10ae0a55f2284f11e  lib/core/settings.py
 d0adc28a38e43a787df4471f7f027413  lib/core/shell.py
 63491be462c515a1a3880c27c2acc4a2  lib/core/subprocessng.py
 505aaa61e1bba3c3d4567c3e667699e3  lib/core/target.py
 72d499ca8d792e90a1ebfb2ad2341a51  lib/core/testing.py
 de9922a29c71a235cb95a916ff925db2  lib/core/threads.py
 c40758411bb0bd68764d78e0bb72bd0f  lib/core/unescaper.py
-35a1b50e3687e1a174073b46c8022c81  lib/core/update.py
+1c2e5a9a34d4778c336a3d66d86ad000  lib/core/update.py
 fc624104ddb36d41794b7a943fde5f21  lib/core/wordlist.py
 1e5532ede194ac9c083891c2f02bca93  lib/__init__.py
 7620f1f4b8791e13c7184c06b5421754  lib/parse/banner.py
-a6912de35b7184e2e8b1fe2510c0c333  lib/parse/cmdline.py
+27c4d3e568d199e01d1cffd37b370516  lib/parse/cmdline.py
 fb2e2f05dde98caeac6ccf3e67192177  lib/parse/configfile.py
 3794ff139869f5ae8e81cfdbe5714f56  lib/parse/handler.py
 263ee1cec41facd2a06d0dc887b207ad  lib/parse/headers.py
@@ -66,9 +66,9 @@ fb2e2f05dde98caeac6ccf3e67192177  lib/parse/configfile.py
 307d4001682f38dd574548d98c0f1c3e  lib/parse/payloads.py
 38563853a32dd677ce6c65a0945d7227  lib/parse/sitemap.py
 4e60fe7c94bbfa631087ed3426df8ef0  lib/request/basicauthhandler.py
-054a83429e2538293175d6a7242f2e63  lib/request/basic.py
+eb39d5cbd69a2238e2f4ea2fde183cdb  lib/request/basic.py
 c0cabedead14b8a23353b606672cff42  lib/request/comparison.py
-a38e09038468387b20e978ce1b885018  lib/request/connect.py
+b3c3b71e9d4aeaa2ece681cabefc953d  lib/request/connect.py
 dd4598675027fae99f2e2475b05986da  lib/request/direct.py
 2044fce3f4ffa268fcfaaf63241b1e64  lib/request/dns.py
 a1436e4e4f9b636cb8332f00b686bfd5  lib/request/httpshandler.py
@@ -85,9 +85,9 @@ acc1db3667bf910b809eb279b60595eb  lib/takeover/icmpsh.py
 703e15714316a8cc4bbe54cdd0a8cb87  lib/takeover/metasploit.py
 0fc9b00596df21c8878ef92f513ecad7  lib/takeover/registry.py
 48575dde7bb867b7937769f569a98309  lib/takeover/udf.py
-1398cb4ee55becf628367854b5310f33  lib/takeover/web.py
+746f400dfa6dc1139f14c44574d6b948  lib/takeover/web.py
 d8c10f278e5943b137a222f4cedca59d  lib/takeover/xp_cmdshell.py
-f6844893afa7569052529e1c8d89bc35  lib/techniques/blind/inference.py
+b84d45fc7349caa714f9769b13d70cab  lib/techniques/blind/inference.py
 1e5532ede194ac9c083891c2f02bca93  lib/techniques/blind/__init__.py
 1e5532ede194ac9c083891c2f02bca93  lib/techniques/dns/__init__.py
 855355a1a216f6b267a5f089028f1cd8  lib/techniques/dns/test.py
@@ -96,25 +96,25 @@ f6844893afa7569052529e1c8d89bc35  lib/techniques/blind/inference.py
 627ddc86a5a969e5509c7531c5c27a6c  lib/techniques/error/use.py
 1e5532ede194ac9c083891c2f02bca93  lib/techniques/__init__.py
 1e5532ede194ac9c083891c2f02bca93  lib/techniques/union/__init__.py
-c497003ecf231d03a311a816a6b3b753  lib/techniques/union/test.py
+e58ab8029ffb2cc37e42d68747c4da39  lib/techniques/union/test.py
 6c3c4c7d43ad75e61a73184323a81eac  lib/techniques/union/use.py
-918d6f34c415c578c2eae8730f555ae8  lib/utils/api.py
+e4146464cf968d4015a52cb8c10e3da5  lib/utils/api.py
 37dfb641358669f62c2acedff241348b  lib/utils/brute.py
 a34c4fd2e7d78c5dfdd9eeccb079fb1c  lib/utils/crawler.py
-985c737cd8a6a722160c55cf5ee224f4  lib/utils/deps.py
+69c25da85a3a71a9798804075cdfd62b  lib/utils/deps.py
 a6d6888e14a7c11f0884c8cc18489caa  lib/utils/getch.py
 7af29f61302c8693cd6436d4b69e22d3  lib/utils/har.py
 9bd8fbfb9c25ee685c97b260331e7165  lib/utils/hashdb.py
-578007a75d75a2e510a9ec33f01eeeb0  lib/utils/hash.py
+55c552e754b54cd25a47efb84d3e6892  lib/utils/hash.py
 145120b21fcfca843d5e2c8b0562e4db  lib/utils/htmlentities.py
 1e5532ede194ac9c083891c2f02bca93  lib/utils/__init__.py
 010d8327239d33af4ce9f25683cfc012  lib/utils/pivotdumptable.py
 5d6d73d27833eef1b10b9215629533ff  lib/utils/progress.py
 0ec5cec9d93d5ffd1eaeda6e942ecadf  lib/utils/purge.py
 4a6886d3a0c7bf768df97738fa257de9  lib/utils/search.py
-3abe64e696ad75ad28cadf2695a58be8  lib/utils/sqlalchemy.py
+4b17311256f0081904a67831252e3fb9  lib/utils/sqlalchemy.py
 dcc25183c6bd85b172c87cfcbc305ab6  lib/utils/timeout.py
-e426eae9ddf6a42bcb6b7355e2c2936f  lib/utils/versioncheck.py
+ce5ec6300bc0a185827a21d8a8f09de3  lib/utils/versioncheck.py
 1e9cf437451ff8147a372a002641b963  lib/utils/xrange.py
 b9d2761f47fec3d98b88311a263fd5db  plugins/dbms/access/connector.py
 3f1c50a1507d1c2f69c20c706230e2e2  plugins/dbms/access/enumeration.py
@@ -153,14 +153,14 @@ da9dccd1f9ec2cf1e53295125dd983a0  plugins/dbms/informix/filesystem.py
 25f0fb28e9defcab48a2e946fbb7550a  plugins/dbms/informix/takeover.py
 1e5532ede194ac9c083891c2f02bca93  plugins/dbms/__init__.py
 6917f9b045f6188b89e816dea9b46a3f  plugins/dbms/maxdb/connector.py
-b2df2dfaa44659ac02df396fb2174d23  plugins/dbms/maxdb/enumeration.py
+615be11d750530211af244b6ca6aef14  plugins/dbms/maxdb/enumeration.py
 ffd26f64142226d0b1ed1d70f7f294c0  plugins/dbms/maxdb/filesystem.py
 9f9f1c4c4c3150545c4b61d1cffc76a8  plugins/dbms/maxdb/fingerprint.py
 4321d7018f5121343460ebfd83bb69be  plugins/dbms/maxdb/__init__.py
 e7d44671ae26c0bcd5fe8448be070bbd  plugins/dbms/maxdb/syntax.py
 bf7842bb291e2297c3c8d1023eb3e550  plugins/dbms/maxdb/takeover.py
 6439d15c1e8cdb069056c4fa725326df  plugins/dbms/mssqlserver/connector.py
-fdc3cc66d0d35f6ebee0dd625a87f4e9  plugins/dbms/mssqlserver/enumeration.py
+a833fbc30ab1133bc6ba293d97d0ef7c  plugins/dbms/mssqlserver/enumeration.py
 7e495d786fa8e1da96e73e2905bbd7dd  plugins/dbms/mssqlserver/filesystem.py
 03d463c15ebbfa4e49155b261b59db31  plugins/dbms/mssqlserver/fingerprint.py
 affef90b1442285da7e89e46603c502e  plugins/dbms/mssqlserver/__init__.py
@@ -168,12 +168,12 @@ affef90b1442285da7e89e46603c502e  plugins/dbms/mssqlserver/__init__.py
 b9e62a80bd3ead133a511f9769e5e6c3  plugins/dbms/mssqlserver/takeover.py
 f6e1f3f09f32b9cb2ca11c016d373423  plugins/dbms/mysql/connector.py
 445164daf59b890aeacc968af58fcb53  plugins/dbms/mysql/enumeration.py
-d6836e2a6a308eb3536e2e7fc74fdc8b  plugins/dbms/mysql/filesystem.py
+f36e09edc3eafedd989fbe44ec048e71  plugins/dbms/mysql/filesystem.py
 2bfd2369aebe2999f7333cca0895507c  plugins/dbms/mysql/fingerprint.py
 88b876f085fec2569a0697f4b69f41da  plugins/dbms/mysql/__init__.py
 0e2adbee217f5b94dcc124d24b8dde99  plugins/dbms/mysql/syntax.py
 f30009816db6a0b41342301f0d657a01  plugins/dbms/mysql/takeover.py
-9a50b600d65d178b374d19775d1f95e4  plugins/dbms/oracle/connector.py
+999cb8d0d52820d30bdd4b3d658a765d  plugins/dbms/oracle/connector.py
 e1ffee36fd18f33f34bb4bac4ae43f14  plugins/dbms/oracle/enumeration.py
 c326b0d8bed92be67888b0242f565ac8  plugins/dbms/oracle/filesystem.py
 e16cbf8abda91a906ca7bafb81d8866e  plugins/dbms/oracle/fingerprint.py
@@ -195,7 +195,7 @@ f639120d42b33b6ca67930bddbf2ac1f  plugins/dbms/sqlite/__init__.py
 964e59d2eba619b068b0a15cea28efe0  plugins/dbms/sqlite/syntax.py
 3364b2938d7040c507cd622c323557dc  plugins/dbms/sqlite/takeover.py
 6439d15c1e8cdb069056c4fa725326df  plugins/dbms/sybase/connector.py
-006b647e955d7638687d16e047e9c587  plugins/dbms/sybase/enumeration.py
+31462dc5a1cd2a1b4eba6762d18fb48c  plugins/dbms/sybase/enumeration.py
 74de450dd6d6d006aa9c7eed56e6b09a  plugins/dbms/sybase/filesystem.py
 c8ee0deaa2309e96d9a409ff1524f3ad  plugins/dbms/sybase/fingerprint.py
 a3db8618eed5bb2807b6f77605cba9cc  plugins/dbms/sybase/__init__.py
@@ -203,62 +203,63 @@ a3db8618eed5bb2807b6f77605cba9cc  plugins/dbms/sybase/__init__.py
 79f6c7017db4ded8f74a0117188836ff  plugins/dbms/sybase/takeover.py
 34d181a7086d6dfc7e72ae5f8a4cfe0f  plugins/generic/connector.py
 e6cd1c5a5244d83396b401f7db43d323  plugins/generic/custom.py
-315a3ced9667065b24de040af296037a  plugins/generic/databases.py
-b1bd764e8f417222ebb1890232290679  plugins/generic/entries.py
+554f925e0a66f62b8ba39dd6c95d1e7f  plugins/generic/databases.py
+764a8fd5a99224910885c6b94a592170  plugins/generic/entries.py
 d82f2c78c1d4d7c6487e94fd3a68a908  plugins/generic/enumeration.py
 ea0f3b9085061b272bfd98c13ad2d977  plugins/generic/filesystem.py
 f5d5419efddfe04648ea5e953c650793  plugins/generic/fingerprint.py
 1e5532ede194ac9c083891c2f02bca93  plugins/generic/__init__.py
 f7874230e5661910d5fd21544c7d1022  plugins/generic/misc.py
-8995e814cb8e854bd77534f687535014  plugins/generic/search.py
+b1d2a7f3170f9b69e71335aa47f9b08b  plugins/generic/search.py
 a70cc0ada4b0cc9e7df23cb6d48a4a0c  plugins/generic/syntax.py
 e522c294676ede15bee751107e9bb449  plugins/generic/takeover.py
 4419b13a4b78d7e9e4a2632302344a1a  plugins/generic/users.py
 1e5532ede194ac9c083891c2f02bca93  plugins/__init__.py
-b04db3e861edde1f9dd0a3850d5b96c8  shell/backdoors/backdoor.asp_
+5dc693e22f5d020c5c568d7325bd4226  shell/backdoors/backdoor.asp_
 158bfa168128393dde8d6ed11fe9a1b8  shell/backdoors/backdoor.aspx_
-1add5a9a67539e7fd1999c8c20a69d15  shell/backdoors/backdoor.jsp_
+595f711adf1ecb5f3b9a64532b04d8b9  shell/backdoors/backdoor.jsp_
 09fc3ed6543f4d1885e338b271e5e97a  shell/backdoors/backdoor.php_
-0e7aba05423c272f051f31165b0e416d  shell/stagers/stager.asp_
-c3cc8b7727161e64ab59f312c33b541a  shell/stagers/stager.aspx_
-1f7f125f30e0e800beb21e2ebbab18e1  shell/stagers/stager.jsp_
-01e3505e796edf19aad6a996101c81c9  shell/stagers/stager.php_
+ec2ba8c757ac96425dcd2b97970edd3a  shell/stagers/stager.asp_
+4e6d2094bd6afe35032fb8bc8a86e83c  shell/stagers/stager.aspx_
+0c48ddb1feb7e38a951ef05a0d48e032  shell/stagers/stager.jsp_
+2f9e459a4cf6a58680978cdce5ff7971  shell/stagers/stager.php_
 4eaeef94314956e4517e5310a28d579a  sqlmapapi.py
-1bef42b51e59db28d04181955c405931  sqlmap.py
+082aa29ab77c647a0d3830c07279d437  sqlmap.py
 4c3b8a7daa4bff52e01d4168be0eedbe  tamper/apostrophemask.py
 4115a55b8aba464723d645b7d3156b6e  tamper/apostrophenullencode.py
-4b1024cecb00f13a4e1be78391e9cedb  tamper/appendnullbyte.py
-84e6ad0010ed1d9a326d51b493116256  tamper/base64encode.py
+d7e9a979eff4d7315d804a181e66fc93  tamper/appendnullbyte.py
+0298d81e9dfac7ff18a5236c0f1d84b6  tamper/base64encode.py
 55e9fbe57967e57a05a8ca77c312dc70  tamper/between.py
-f942ad818d3e26ec34f0d15ca8b84207  tamper/bluecoat.py
+e1d2329adc6ca89828a2eaec2951806c  tamper/bluecoat.py
 e3cdf13caedb4682bee3ff8fac103606  tamper/chardoubleencode.py
 3b2f68476fbcf8223199e8dd4ec14b64  tamper/charencode.py
 b502023ac6c48e49e652ba524b8e18cc  tamper/charunicodeencode.py
-8bc697b143bba852b459806fcfaa5422  tamper/charunicodeescape.py
-9e9719d822afab818d6a8a42351baa40  tamper/commalesslimit.py
-7f0110c706aca9cd090c0371e6d1a4cb  tamper/commalessmid.py
-8070799415795bd6f23d11d02b99fbe9  tamper/commentbeforeparentheses.py
-6498568524665729cb04a41c5f67f975  tamper/concat2concatws.py
+2c2b38974dc773568de7e7d771d7042c  tamper/charunicodeescape.py
+6a395de07b60f47d9474ace0a98c160f  tamper/commalesslimit.py
+211bb8fa36a6ecb42b719c951c362851  tamper/commalessmid.py
+19acfde79c9a2d8458e15182f5b73d71  tamper/commentbeforeparentheses.py
+334e4a2485b3a1bbc1734823b93ea694  tamper/concat2concatws.py
 dcdc433fe946f1b9005bcd427a951dd6  tamper/equaltolike.py
-0a61e7b57ad593202b8449601e757f16  tamper/escapequotes.py
+06df880df5d8749963f5562f60fd1637  tamper/escapequotes.py
 4393cc5220d2e39c5c9c5a9af4e2635d  tamper/greatest.py
 25ec62158d3e289bda8a04c8b65686ba  tamper/halfversionedmorekeywords.py
 9d8c350cbb90d4b21ec9c9db184a213a  tamper/htmlencode.py
 838212f289632526777b7224bf8aacf9  tamper/ifnull2casewhenisnull.py
 e2c2b6a67546b36983a72f129a817ec0  tamper/ifnull2ifisnull.py
-2416ff8e020fc2db29a580f55dcb6fb1  tamper/informationschemacomment.py
+91c92ee203e7e619cb547643883924ca  tamper/informationschemacomment.py
 1e5532ede194ac9c083891c2f02bca93  tamper/__init__.py
 2dc49bcd6c55f4e2322b07fa92685356  tamper/least.py
-22a740e6fbcb8cc3ada430e3fb1be05f  tamper/lowercase.py
-e44163d21e055805b5e55667e72f5978  tamper/modsecurityversioned.py
-f83a11d594fad3ed3291074c7b37b281  tamper/modsecurityzeroversioned.py
-abd6490408551a8c8226a32fbc2b5345  tamper/multiplespaces.py
+1834b5409c449d2ea1b70a5038fed9eb  tamper/lowercase.py
+de4c83d33968a0cbf00cdfd8d35deddc  tamper/modsecurityversioned.py
+39981d5d6cb84aca950458739102bb07  tamper/modsecurityzeroversioned.py
+b4cadf2ddcdc0598c9a3bf24521a2fa1  tamper/multiplespaces.py
 be757e4c9a6fb36af7b9a8c444fddb05  tamper/nonrecursivereplacement.py
-aca15cb5474fb0a32e517ae5e940cbd0  tamper/overlongutf8.py
+e298e486c06bb39d81f10d61a5c4ceec  tamper/overlongutf8more.py
+b9f698556f8333d9fa6eadaab44a77ab  tamper/overlongutf8.py
 bc0363e4fc04240c9f7b81e4ecce0714  tamper/percentage.py
-4fa8b6c0e7573e395330bb6a405abbaf  tamper/plus2concat.py
-5b947c6cd78eab22ee53f5f534c532d3  tamper/plus2fnconcat.py
-44fd1c13a7dd6ae792f11afb28976480  tamper/randomcase.py
+91272e566ceb4644254cd6abd613db21  tamper/plus2concat.py
+265314f4b3b921f4c0d470ddaa6506e4  tamper/plus2fnconcat.py
+e94a1c7e4dc7450ac224436269d823bb  tamper/randomcase.py
 6368a971a80b1acbbbc6b76616bd96b9  tamper/randomcomments.py
 48228322d40d97016b05e408c5234634  tamper/securesphere.py
 cac8a56f8cc6c14524ee392daa5ae2fd  tamper/space2comment.py
@@ -325,10 +326,10 @@ ee25f2a03587e2c283eab0b36c9e5783  thirdparty/chardet/sbcsgroupprober.py
 c9349824f2647962175d321cc0c52134  thirdparty/chardet/sjisprober.py
 bcae4c645a737d3f0e7c96a66528ca4a  thirdparty/chardet/universaldetector.py
 6f8b3e25472c02fb45a75215a175991f  thirdparty/chardet/utf8prober.py
-658da0466b798cc70f48f35fe49b7813  thirdparty/clientform/clientform.py
+3c1b0d627e98643b317244ecfd240bb5  thirdparty/clientform/clientform.py
 722281d87fb13ec22555480f8f4c715b  thirdparty/clientform/__init__.py
 0b625ccefa6b066f79d3cbb3639267e6  thirdparty/colorama/ansi.py
-e52252bb81ce1a14b7245b53af33e75f  thirdparty/colorama/ansitowin32.py
+93bb7f06c8300a91b533ea55e8aead43  thirdparty/colorama/ansitowin32.py
 ed4d76c08741d34ac79f6488663345f7  thirdparty/colorama/initialise.py
 c0707ca77ccb4a2c0f12b4085057193c  thirdparty/colorama/__init__.py
 ad3d022d4591aee80f7391248d722413  thirdparty/colorama/win32.py
@@ -461,7 +462,7 @@ d989813ee377252bca2103cea524c06b  xml/banner/sharepoint.xml
 350605448f049cd982554123a75f11e1  xml/banner/x-aspnet-version.xml
 817078783e1edaa492773d3b34d8eef0  xml/banner/x-powered-by.xml
 fb93505ef0ab3b4a20900f3e5625260d  xml/boundaries.xml
-9567590d35dfd9f214b9979e6000b139  xml/errors.xml
+0d0d4bd0e06c99dd8eb4f92acc25caf3  xml/errors.xml
 a279656ea3fcb85c727249b02f828383  xml/livetests.xml
 14a2abeb88b00ab489359d0dd7a3017f  xml/payloads/boolean_blind.xml
 b5b8b0aebce810e6cdda1b7106c96427  xml/payloads/error_based.xml

xml/errors.xml

@@ -6,10 +6,12 @@
         <error regexp="SQL syntax.*?MySQL"/>
         <error regexp="Warning.*?mysql_"/>
         <error regexp="MySqlException \(0x"/>
+        <error regexp="MySQLSyntaxErrorException"/>
         <error regexp="valid MySQL result"/>
         <error regexp="check the manual that corresponds to your (MySQL|MariaDB) server version"/>
         <error regexp="MySqlClient\."/>
         <error regexp="com\.mysql\.jdbc\.exceptions"/>
+        <error regexp="Zend_Db_Statement_Mysqli_Exception"/>
     </dbms>
 
     <!-- PostgreSQL -->
@@ -35,9 +37,11 @@
         <error regexp="Microsoft SQL Native Client error '[0-9a-fA-F]{8}"/>
         <error regexp="com\.microsoft\.sqlserver\.jdbc\.SQLServerException"/>
         <error regexp="ODBC SQL Server Driver"/>
+        <error regexp="ODBC Driver \d+ for SQL Server"/>
         <error regexp="SQLServer JDBC Driver"/>
         <error regexp="macromedia\.jdbc\.sqlserver"/>
         <error regexp="com\.jnetdirect\.jsql"/>
+        <error regexp="SQLSrvException"/>
     </dbms>
 
     <!-- Microsoft Access -->