mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
4af65f6c41 |
@@ -1,8 +1,6 @@
|
||||
*.conf text eol=lf
|
||||
*.md text eol=lf
|
||||
*.md5 text eol=lf
|
||||
*.py text eol=lf
|
||||
*.xml text eol=lf
|
||||
|
||||
*_ binary
|
||||
*.dll binary
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to creating a positive environment include:
|
||||
|
||||
* Using welcoming and inclusive language
|
||||
* Being respectful of differing viewpoints and experiences
|
||||
* Gracefully accepting constructive criticism
|
||||
* Focusing on what is best for the community
|
||||
* Showing empathy towards other community members
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery and unwelcome sexual attention or advances
|
||||
* Trolling, insulting/derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or electronic address, without explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a professional setting
|
||||
|
||||
## Our Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@sqlmap.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
|
||||
|
||||
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
|
||||
|
||||
[homepage]: http://contributor-covenant.org
|
||||
[version]: http://contributor-covenant.org/version/1/4/
|
||||
@@ -1,26 +0,0 @@
|
||||
## What's the problem (or question)?
|
||||
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
|
||||
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
|
||||
|
||||
## Do you have an idea for a solution?
|
||||
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
|
||||
<!--- or ideas how to implement the addition or change -->
|
||||
|
||||
## How can we reproduce the issue?
|
||||
<!--- Provide unambiguous set of steps to reproduce this bug. Include command to reproduce, if relevant (you can mask the sensitive data) -->
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
4.
|
||||
|
||||
## What are the running context details?
|
||||
<!--- Include as many relevant details about the running context you experienced the bug/problem in -->
|
||||
* Installation method (e.g. `pip`, `apt-get`, `git clone` or `zip`/`tar.gz`):
|
||||
* Client OS (e.g. `Microsoft Windows 10`)
|
||||
* Program version (`python sqlmap.py --version` or `sqlmap --version` depending on installation):
|
||||
* Target DBMS (e.g. `Microsoft SQL Server`):
|
||||
* Detected WAF/IPS protection (e.g. `ModSecurity` or `unknown`):
|
||||
* SQLi techniques found by sqlmap (e.g. `error-based` and `boolean-based blind`):
|
||||
* Results of manual target assessment (e.g. found that the payload `query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV` works):
|
||||
* Relevant console output (if any):
|
||||
* Exception traceback (if any):
|
||||
+1
-2
@@ -2,5 +2,4 @@
|
||||
output/
|
||||
.sqlmap_history
|
||||
traffic.txt
|
||||
*~
|
||||
.idea/
|
||||
*~
|
||||
@@ -1,7 +1,4 @@
|
||||
language: python
|
||||
sudo: false
|
||||
git:
|
||||
depth: 1
|
||||
python:
|
||||
- "2.6"
|
||||
- "2.7"
|
||||
|
||||
@@ -1,11 +1,9 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
|
||||
|
||||
**The sqlmap project is sponsored by [Netsparker Web Application Security Scanner](https://www.netsparker.com/scan-website-security-issues/?utm_source=sqlmap.org&utm_medium=banner&utm_campaign=github).**
|
||||
|
||||
Screenshots
|
||||
----
|
||||
|
||||
@@ -20,7 +18,7 @@ You can download the latest tarball by clicking [here](https://github.com/sqlmap
|
||||
|
||||
Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with [Python](http://www.python.org/download/) version **2.6.x** and **2.7.x** on any platform.
|
||||
|
||||
@@ -36,7 +34,7 @@ To get a list of all options and switches use:
|
||||
python sqlmap.py -hh
|
||||
|
||||
You can find a sample run [here](https://asciinema.org/a/46601).
|
||||
To get an overview of sqlmap capabilities, list of supported features and description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
To get an overview of sqlmap capabilities, list of supported features and description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Links
|
||||
----
|
||||
@@ -47,6 +45,9 @@ Links
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* User's manual: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Mailing list subscription: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Mailing list archive: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demos: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -54,17 +55,12 @@ Links
|
||||
Translations
|
||||
----
|
||||
|
||||
* [Bulgarian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-bg-BG.md)
|
||||
* [Chinese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md)
|
||||
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
||||
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
||||
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
||||
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
||||
* [Italian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-it-IT.md)
|
||||
* [Japanese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ja-JP.md)
|
||||
* [Polish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pl-PL.md)
|
||||
* [Portuguese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pt-BR.md)
|
||||
* [Russian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ru-RUS.md)
|
||||
* [Spanish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-es-MX.md)
|
||||
* [Turkish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-tr-TR.md)
|
||||
* [Ukrainian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-uk-UA.md)
|
||||
|
||||
+9
-9
@@ -3,7 +3,7 @@
|
||||
* Implemented support for automatic decoding of page content through detected charset.
|
||||
* Implemented mechanism for proper data dumping on DBMSes not supporting `LIMIT/OFFSET` like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.).
|
||||
* Major improvements to program stabilization based on user reports.
|
||||
* Added new tampering scripts avoiding popular WAF/IPS mechanisms.
|
||||
* Added new tampering scripts avoiding popular WAF/IPS/IDS mechanisms.
|
||||
* Fixed major bug with DNS leaking in Tor mode.
|
||||
* Added wordlist compilation made of the most popular cracking dictionaries.
|
||||
* Implemented multi-processor hash cracking routine(s).
|
||||
@@ -23,7 +23,7 @@
|
||||
* Added option `--csv-del` for manually setting delimiting character used in CSV output.
|
||||
* Added switch `--hex` for using DBMS hex conversion function(s) for data retrieval.
|
||||
* Added switch `--smart` for conducting through tests only in case of positive heuristic(s).
|
||||
* Added switch `--check-waf` for checking of existence of WAF/IPS protection.
|
||||
* Added switch `--check-waf` for checking of existence of WAF/IPS/IDS protection.
|
||||
* Added switch `--schema` to enumerate DBMS schema: shows all columns of all databases' tables.
|
||||
* Added switch `--count` to count the number of entries for a specific table or all database(s) tables.
|
||||
* Major improvements to switches `--tables` and `--columns`.
|
||||
@@ -55,7 +55,7 @@
|
||||
* Added option `--host` to set the HTTP Host header value.
|
||||
* Added switch `--hostname` to turn on retrieval of DBMS server hostname.
|
||||
* Added switch `--hpp` to turn on the usage of HTTP parameter pollution WAF bypass method.
|
||||
* Added switch `--identify-waf` for turning on the thorough testing of WAF/IPS protection.
|
||||
* Added switch `--identify-waf` for turning on the thorough testing of WAF/IPS/IDS protection.
|
||||
* Added switch `--ignore-401` to ignore HTTP Error Code 401 (Unauthorized).
|
||||
* Added switch `--invalid-bignum` for usage of big numbers while invalidating values.
|
||||
* Added switch `--invalid-logical` for usage of logical operations while invalidating values.
|
||||
@@ -76,14 +76,14 @@
|
||||
* Added option `--safe-post` to set POST data for sending to safe URL.
|
||||
* Added option `--safe-req` for loading HTTP request from a file that will be used during sending to safe URL.
|
||||
* Added option `--skip` to skip testing of given parameter(s).
|
||||
* Added switch `--skip-static` to skip testing parameters that not appear to be dynamic.
|
||||
* Added switch `--skip-static` to skip testing parameters that not appear dynamic.
|
||||
* Added switch `--skip-urlencode` to skip URL encoding of payload data.
|
||||
* Added switch `--skip-waf` to skip heuristic detection of WAF/IPS protection.
|
||||
* Added switch `--skip-waf` to skip heuristic detection of WAF/IPS/IDS protection.
|
||||
* Added switch `--smart` to conduct thorough tests only if positive heuristic(s).
|
||||
* Added option `--sql-file` for setting file(s) holding SQL statements to be executed (in case of stacked SQLi).
|
||||
* Added switch `--sqlmap-shell` to turn on interactive sqlmap shell prompt.
|
||||
* Added option `--test-filter` for test filtration by payloads and/or titles (e.g. `ROW`).
|
||||
* Added option `--test-skip` for skipping tests by payloads and/or titles (e.g. `BENCHMARK`).
|
||||
* Added option `--test-skip` for skiping tests by payloads and/or titles (e.g. `BENCHMARK`).
|
||||
* Added switch `--titles` to turn on comparison of pages based only on their titles.
|
||||
* Added option `--tor-port` to explicitly set Tor proxy port.
|
||||
* Added option `--tor-type` to set Tor proxy type (`HTTP` (default), `SOCKS4` or `SOCKS5`).
|
||||
@@ -149,7 +149,7 @@
|
||||
* Major bugs fixed.
|
||||
* Cleanup of UDF source code repository, https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack.
|
||||
* Major code cleanup.
|
||||
* Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus software that mistakenly mark sqlmap as a malware.
|
||||
* Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus softwares that mistakenly mark sqlmap as a malware.
|
||||
* Updated user's manual.
|
||||
* Created several demo videos, hosted on YouTube (http://www.youtube.com/user/inquisb) and linked from http://sqlmap.org/demo.html.
|
||||
|
||||
@@ -302,7 +302,7 @@
|
||||
* Added support to extract database users password hash on Microsoft SQL Server;
|
||||
* Added a fuzzer function with the aim to parse HTML page looking for standard database error messages consequently improving database fingerprinting;
|
||||
* Added support for SQL injection on HTTP Cookie and User-Agent headers;
|
||||
* Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Split getValue() into getInband() and getBlind();
|
||||
* Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Splitted getValue() into getInband() and getBlind();
|
||||
* Major enhancements in common library and added checkForBrackets() method to check if the bracket(s) are needed to perform a UNION query SQL injection attack;
|
||||
* Implemented `--dump-all` functionality to dump entire DBMS data from all databases tables;
|
||||
* Added support to exclude DBMS system databases' when enumeration tables and dumping their entries (`--exclude-sysdbs`);
|
||||
@@ -335,7 +335,7 @@
|
||||
* Added inband SQL injection (UNION query) support (`--union-use`);
|
||||
* Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements;
|
||||
* Reviewed the directory tree structure;
|
||||
* Split lib/common.py: inband injection functionalities now are moved to lib/union.py;
|
||||
* Splitted lib/common.py: inband injection functionalities now are moved to lib/union.py;
|
||||
* Updated documentation files.
|
||||
|
||||
# Version 0.3 (2007-01-20)
|
||||
|
||||
@@ -1,36 +1,38 @@
|
||||
# Contributing to sqlmap
|
||||
|
||||
## Reporting bugs
|
||||
|
||||
**Bug reports are welcome**!
|
||||
Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/sqlmap/issues).
|
||||
|
||||
### Guidelines
|
||||
|
||||
* Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant.
|
||||
* Make sure you can reproduce the bug with the latest development version of sqlmap.
|
||||
* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal.
|
||||
* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?*
|
||||
|
||||
## Submitting code changes
|
||||
|
||||
All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:[email protected]) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37).
|
||||
|
||||
Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests).
|
||||
Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next!
|
||||
|
||||
### Guidelines
|
||||
|
||||
In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions:
|
||||
|
||||
* Each patch should make one logical change.
|
||||
* Avoid tabbing, use four blank spaces instead.
|
||||
* Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:[email protected]).
|
||||
* Do not change style on numerous files in one single pull request, we can [discuss](mailto:[email protected]) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected.
|
||||
* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests.
|
||||
* Style that is too different from main branch will be ''adapted'' by the developers side.
|
||||
* Do not touch anything inside `thirdparty/` and `extra/` folders.
|
||||
|
||||
### Licensing
|
||||
|
||||
By submitting code contributions to the sqlmap developers or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them.
|
||||
# Contributing to sqlmap
|
||||
|
||||
## Reporting bugs
|
||||
|
||||
**Bug reports are welcome**!
|
||||
Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/sqlmap/issues).
|
||||
|
||||
### Guidelines
|
||||
|
||||
* Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant.
|
||||
* Make sure you can reproduce the bug with the latest development version of sqlmap.
|
||||
* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal.
|
||||
* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?*
|
||||
* If you are not sure whether something is a bug, or want to discuss a potential new feature before putting in an enhancement request, the [mailing list](https://lists.sourceforge.net/lists/listinfo/sqlmap-users) is a good place to bring it up.
|
||||
|
||||
## Submitting code changes
|
||||
|
||||
All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:[email protected]) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37).
|
||||
|
||||
Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests).
|
||||
Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next!
|
||||
|
||||
### Guidelines
|
||||
|
||||
In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions:
|
||||
|
||||
* Each patch should make one logical change.
|
||||
* Wrap code to 76 columns when possible.
|
||||
* Avoid tabbing, use four blank spaces instead.
|
||||
* Before you put time into a non-trivial patch, it is worth discussing it on the [mailing list](https://lists.sourceforge.net/lists/listinfo/sqlmap-users) or privately by [email](mailto:[email protected]).
|
||||
* Do not change style on numerous files in one single pull request, we can [discuss](mailto:[email protected]) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected.
|
||||
* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests.
|
||||
* Style that is too different from main branch will be ''adapted'' by the developers side.
|
||||
* Do not touch anything inside `thirdparty/` and `extra/` folders.
|
||||
|
||||
### Licensing
|
||||
|
||||
By submitting code contributions to the sqlmap developers, to the mailing list, or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them.
|
||||
+36
-12
@@ -1,7 +1,7 @@
|
||||
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
||||
of the GNU General Public License (GPL) is appended to this file.
|
||||
|
||||
sqlmap is (C) 2006-2019 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
sqlmap is (C) 2006-2016 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
|
||||
This program is free software; you may redistribute and/or modify it under
|
||||
the terms of the GNU General Public License as published by the Free
|
||||
@@ -31,9 +31,6 @@ interpretation of derived works with some common examples. Our
|
||||
interpretation applies only to sqlmap - we do not speak for other people's
|
||||
GPL works.
|
||||
|
||||
This license does not apply to the third-party components. More details can
|
||||
be found inside the file 'doc/THIRD-PARTY.md'.
|
||||
|
||||
If you have any questions about the GPL licensing restrictions on using
|
||||
sqlmap in non-GPL works, we would be happy to help. As mentioned above,
|
||||
we also offer alternative license to integrate sqlmap into proprietary
|
||||
@@ -49,14 +46,14 @@ to know exactly what a program is going to do before they run it.
|
||||
Source code also allows you to fix bugs and add new features. You are
|
||||
highly encouraged to send your changes to [email protected] for possible
|
||||
incorporation into the main distribution. By sending these changes to the
|
||||
sqlmap developers or via Git pull request, checking them into the sqlmap
|
||||
source code repository, it is understood (unless you specify otherwise)
|
||||
that you are offering the sqlmap project the unlimited, non-exclusive
|
||||
right to reuse, modify, and relicense the code. sqlmap will always be
|
||||
available Open Source, but this is important because the inability to
|
||||
relicense code has caused devastating problems for other Free Software
|
||||
projects (such as KDE and NASM). If you wish to specify special license
|
||||
conditions of your contributions, just say so when you send them.
|
||||
sqlmap developers, to the mailing lists, or via Git pull request, checking
|
||||
them into the sqlmap source code repository, it is understood (unless you
|
||||
specify otherwise) that you are offering the sqlmap project the unlimited,
|
||||
non-exclusive right to reuse, modify, and relicense the code. sqlmap will
|
||||
always be available Open Source, but this is important because the
|
||||
inability to relicense code has caused devastating problems for other Free
|
||||
Software projects (such as KDE and NASM). If you wish to specify special
|
||||
license conditions of your contributions, just say so when you send them.
|
||||
|
||||
This program is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
@@ -346,3 +343,30 @@ PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
****************************************************************************
|
||||
|
||||
This license does not apply to the following components:
|
||||
|
||||
* The Ansistrm library located under thirdparty/ansistrm/.
|
||||
* The Beautiful Soup library located under thirdparty/beautifulsoup/.
|
||||
* The Bottle library located under thirdparty/bottle/.
|
||||
* The Chardet library located under thirdparty/chardet/.
|
||||
* The ClientForm library located under thirdparty/clientform/.
|
||||
* The Colorama library located under thirdparty/colorama/.
|
||||
* The Fcrypt library located under thirdparty/fcrypt/.
|
||||
* The Gprof2dot library located under thirdparty/gprof2dot/.
|
||||
* The KeepAlive library located under thirdparty/keepalive/.
|
||||
* The Magic library located under thirdparty/magic/.
|
||||
* The MultipartPost library located under thirdparty/multipartpost/.
|
||||
* The Odict library located under thirdparty/odict/.
|
||||
* The Oset library located under thirdparty/oset/.
|
||||
* The PageRank library located under thirdparty/pagerank/.
|
||||
* The PrettyPrint library located under thirdparty/prettyprint/.
|
||||
* The PyDes library located under thirdparty/pydes/.
|
||||
* The SocksiPy library located under thirdparty/socks/.
|
||||
* The Termcolor library located under thirdparty/termcolor/.
|
||||
* The XDot library located under thirdparty/xdot/.
|
||||
* The icmpsh tool located under extra/icmpsh/.
|
||||
|
||||
Details for the above packages can be found in the THIRD-PARTY.md file.
|
||||
+2
-6
@@ -139,7 +139,7 @@ Jim Forster, <jimforster(at)goldenwest.com>
|
||||
* for reporting a bug
|
||||
|
||||
Rong-En Fan, <rafan(at)freebsd.org>
|
||||
* for committing the sqlmap 0.5 port to the official FreeBSD project repository
|
||||
* for commiting the sqlmap 0.5 port to the official FreeBSD project repository
|
||||
|
||||
Giorgio Fedon, <giorgio.fedon(at)gmail.com>
|
||||
* for suggesting a speed improvement for bisection algorithm
|
||||
@@ -562,12 +562,9 @@ Kazim Bugra Tombul, <mhackmail(at)gmail.com>
|
||||
* for reporting a minor bug
|
||||
|
||||
Efrain Torres, <et(at)metasploit.com>
|
||||
* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit official subversion repository
|
||||
* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for commiting it on the Metasploit official subversion repository
|
||||
* for his great Metasploit WMAP Framework
|
||||
|
||||
Jennifer Torres, <jtorresf42(at)gmail.com>
|
||||
* for contributing a tamper script luanginx.py
|
||||
|
||||
Sandro Tosi, <matrixhasu(at)gmail.com>
|
||||
* for helping to create sqlmap Debian package correctly
|
||||
|
||||
@@ -600,7 +597,6 @@ Carlos Gabriel Vergara, <carlosgabrielvergara(at)gmail.com>
|
||||
|
||||
Patrick Webster, <patrick(at)aushack.com>
|
||||
* for suggesting an enhancement
|
||||
* for donating to sqlmap development (from OSI.Security)
|
||||
|
||||
Ed Williams, <ed.williams(at)ngssecure.com>
|
||||
* for suggesting a minor enhancement
|
||||
|
||||
+2
-2
@@ -281,6 +281,8 @@ be bound by the terms and conditions of this License Agreement.
|
||||
|
||||
* The bottle web framework library located under thirdparty/bottle/.
|
||||
Copyright (C) 2012, Marcel Hellkamp.
|
||||
* The PageRank library located under thirdparty/pagerank/.
|
||||
Copyright (C) 2010, Corey Goldberg.
|
||||
* The Termcolor library located under thirdparty/termcolor/.
|
||||
Copyright (C) 2008-2011, Volvox Development Team.
|
||||
|
||||
@@ -310,5 +312,3 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
* The PyDes library located under thirdparty/pydes/.
|
||||
Copyleft 2009, Todd Whiteman.
|
||||
* The win_inet_pton library located under thirdparty/wininetpton/.
|
||||
Copyleft 2014, Ryan Vennell.
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap e инструмент за тестване и проникване, с отворен код, който автоматизира процеса на откриване и използване на недостатъците на SQL база данните чрез SQL инжекция, която ги взима от сървъра. Снабден е с мощен детектор, множество специални функции за най-добрия тестер и широк спектър от функции, които могат да се използват за множество цели - извличане на данни от базата данни, достъп до основната файлова система и изпълняване на команди на операционната система.
|
||||
|
||||
Демо снимки
|
||||
----
|
||||
|
||||
|
||||
|
||||
Можете да посетите [колекцията от снимки на екрана](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), показващи някои функции, качени на wiki.
|
||||
|
||||
Инсталиране
|
||||
----
|
||||
|
||||
Може да изтеглине най-новите tar архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/tarball/master) или най-новите zip архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
За предпочитане е да изтеглите sqlmap като клонирате [Git](https://github.com/sqlmapproject/sqlmap) хранилището:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap работи самостоятелно с [Python](http://www.python.org/download/) версия **2.6.x** и **2.7.x** на всички платформи.
|
||||
|
||||
Използване
|
||||
----
|
||||
|
||||
За да получите списък с основните опции използвайте:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
За да получите списък с всички опции използвайте:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Може да намерите пример за използване на sqlmap [тук](https://asciinema.org/a/46601).
|
||||
За да разберете възможностите на sqlmap, списък на поддържаните функции и описание на всички опции, заедно с примери, се препоръчва да се разгледа [упътването](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
|
||||
Връзки
|
||||
----
|
||||
|
||||
* Начална страница: http://sqlmap.org
|
||||
* Изтегляне: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* RSS емисия: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Проследяване на проблеми и въпроси: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Упътване: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Често задавани въпроси (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Демо: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Снимки на екрана: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band".
|
||||
|
||||
@@ -17,7 +17,7 @@ Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github
|
||||
|
||||
Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona con las siguientes versiones de [Python](http://www.python.org/download/) ** 2.6.x** y ** 2.7.x** en cualquier plataforma.
|
||||
|
||||
@@ -26,14 +26,14 @@ Uso
|
||||
|
||||
Para obtener una lista de opciones básicas:
|
||||
|
||||
python sqlmap.py -h
|
||||
python sqlmap.py -h
|
||||
|
||||
Para obtener una lista de todas las opciones:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Se puede encontrar una muestra de su funcionamiento [aquí](https://asciinema.org/a/46601).
|
||||
Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de todas las opciones y modificadores, junto con ejemplos, se recomienda consultar el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de todas las opciones y modificadores, junto con ejemplos, se recomienda consultar el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Enlaces
|
||||
---
|
||||
@@ -44,6 +44,9 @@ Enlaces
|
||||
* Seguimiento de problemas "Issue tracker": https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Manual de usuario: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Preguntas frecuentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Subscripción a la lista de correo: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Fuente de la lista de correo "RSS feed": http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Archivos de lista de correo: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demostraciones: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Imágenes: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
**sqlmap** est un outil Open Source de test d'intrusion. Cet outil permet d'automatiser le processus de détection et d'exploitation des failles d'injection SQL afin de prendre le contrôle des serveurs de base de données. __sqlmap__ dispose d'un puissant moteur de détection utilisant les techniques les plus récentes et les plus dévastatrices de tests d'intrusion comme L'Injection SQL, qui permet d'accéder à la base de données, au système de fichiers sous-jacent et permet aussi l'exécution des commandes sur le système d'exploitation.
|
||||
|
||||
@@ -13,15 +13,15 @@ Les captures d'écran disponible [ici](https://github.com/sqlmapproject/sqlmap/w
|
||||
Installation
|
||||
----
|
||||
|
||||
Vous pouvez télécharger le fichier "tarball" le plus récent en cliquant [ici](https://github.com/sqlmapproject/sqlmap/tarball/master). Vous pouvez aussi télécharger l'archive zip la plus récente [ici](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
Vous pouvez télécharger le plus récent fichier tarball en cliquant [ici](https://github.com/sqlmapproject/sqlmap/tarball/master). Vous pouvez aussi télécharger le plus récent archive zip [ici](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
De préférence, télécharger __sqlmap__ en le [clonant](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6.x** et **2.7.x** de [Python](http://www.python.org/download/)
|
||||
|
||||
Utilisation
|
||||
Usage
|
||||
----
|
||||
|
||||
Pour afficher une liste des fonctions de bases et des commutateurs (switches), tapez:
|
||||
@@ -33,7 +33,7 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta
|
||||
python sqlmap.py -hh
|
||||
|
||||
Vous pouvez regarder un vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
|
||||
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge et la description de toutes les options, ainsi que des exemples , nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Liens
|
||||
----
|
||||
@@ -41,9 +41,12 @@ Liens
|
||||
* Page d'acceuil: http://sqlmap.org
|
||||
* Téléchargement: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Suivi des issues: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Manuel de l'utilisateur: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Foire aux questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Mailing list subscription: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Mailing list archive: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Démonstrations: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Les captures d'écran: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
Το sqlmap είναι πρόγραμμα ανοιχτού κώδικα, που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου SQL Injection σε βάσεις δεδομένων. Έρχεται με μια δυνατή μηχανή αναγνώρισης ευπαθειών, πολλά εξειδικευμένα χαρακτηριστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εύρος επιλογών αρχίζοντας από την αναγνώριση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχρι και πρόσβαση στο βαθύτερο σύστημα αρχείων και εκτέλεση εντολών στο απευθείας στο λειτουργικό μέσω εκτός ζώνης συνδέσεων.
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
|
||||
Κατά προτίμηση, μπορείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) αποθετήριο:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](http://www.python.org/download/) έκδοσης **2.6.x** και **2.7.x** σε όποια πλατφόρμα.
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
python sqlmap.py -hh
|
||||
|
||||
Μπορείτε να δείτε ένα δείγμα λειτουργίας του προγράμματος [εδώ](https://asciinema.org/a/46601).
|
||||
Για μια γενικότερη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηριζόμενων χαρακτηριστικών και περιγραφή για όλες τις επιλογές, μαζί με παραδείγματα, καλείστε να συμβουλευτείτε το [εγχειρίδιο χρήστη](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
Για μια γενικότερη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηριζόμενων χαρακτηριστικών και περιγραφή για όλες τις επιλογές, μαζί με παραδείγματα, καλείστε να συμβουλευτείτε το [εγχειρίδιο χρήστη](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Σύνδεσμοι
|
||||
----
|
||||
@@ -45,6 +45,9 @@
|
||||
* Προβλήματα: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Εγχειρίδιο Χρήστη: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Συχνές Ερωτήσεις (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Εγγραφή σε Mailing list: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Mailing list αρχείο: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demos: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Εικόνες: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datotečnom sustavu i izvršavanja komandi na operacijskom sustavu korištenjem tzv. "out-of-band" veza.
|
||||
|
||||
@@ -18,7 +18,7 @@ Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/
|
||||
|
||||
Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap radi bez posebnih zahtjeva korištenjem [Python](http://www.python.org/download/) verzije **2.6.x** i/ili **2.7.x** na bilo kojoj platformi.
|
||||
|
||||
@@ -34,7 +34,7 @@ Kako biste dobili listu svih opcija i prekidača koristite:
|
||||
python sqlmap.py -hh
|
||||
|
||||
Možete pronaći primjer izvršavanja [ovdje](https://asciinema.org/a/46601).
|
||||
Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih značajki te opis svih opcija i prekidača, zajedno s primjerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih značajki te opis svih opcija i prekidača, zajedno s primjerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Poveznice
|
||||
----
|
||||
@@ -45,6 +45,9 @@ Poveznice
|
||||
* Prijava problema: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Korisnički priručnik: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Najčešće postavljena pitanja (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Pretplata na mailing listu: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* RSS feed mailing liste: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Arhiva mailing liste: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demo: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Slike zaslona: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||
|
||||
@@ -19,7 +19,7 @@ Anda dapat mengunduh tarball versi terbaru [di sini]
|
||||
|
||||
Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ repositori [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap berfungsi langsung pada [Python](http://www.python.org/download/) versi **2.6.x** dan **2.7.x** pada platform apapun.
|
||||
|
||||
@@ -35,7 +35,7 @@ Untuk mendapatkan daftar opsi lanjut gunakan:
|
||||
python sqlmap.py -hh
|
||||
|
||||
Anda dapat mendapatkan contoh penggunaan [di sini](https://asciinema.org/a/46601).
|
||||
Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut dengan contohnya, Anda disarankan untuk membaca [Panduan Pengguna](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut dengan contohnya, Anda disarankan untuk membaca [manual pengguna](https://github.com/sqlmapproject/sqlmap/wiki).
|
||||
|
||||
Tautan
|
||||
----
|
||||
@@ -46,6 +46,9 @@ Tautan
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Berlangganan milis: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* RSS feed dari milis: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Arsip milis: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Video Demo [#1](http://www.youtube.com/user/inquisb/videos) dan [#2](http://www.youtube.com/user/stamparm/videos)
|
||||
* Tangkapan Layar: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap è uno strumento open source per il penetration testing. Il suo scopo è quello di rendere automatico il processo di scoperta ed exploit di vulnerabilità di tipo SQL injection al fine di compromettere database online. Dispone di un potente motore per la ricerca di vulnerabilità, molti strumenti di nicchia anche per il più esperto penetration tester ed un'ampia gamma di controlli che vanno dal fingerprinting di database allo scaricamento di dati, fino all'accesso al file system sottostante e l'esecuzione di comandi nel sistema operativo attraverso connessioni out-of-band.
|
||||
|
||||
Screenshot
|
||||
----
|
||||
|
||||
|
||||
|
||||
Nella wiki puoi visitare [l'elenco di screenshot](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) che mostrano il funzionamento di alcune delle funzionalità del programma.
|
||||
|
||||
Installazione
|
||||
----
|
||||
|
||||
Puoi scaricare l'ultima tarball cliccando [qui](https://github.com/sqlmapproject/sqlmap/tarball/master) oppure l'ultima zipball cliccando [qui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
La cosa migliore sarebbe però scaricare sqlmap clonando la repository [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap è in grado di funzionare con le versioni **2.6.x** e **2.7.x** di [Python](http://www.python.org/download/) su ogni piattaforma.
|
||||
|
||||
Utilizzo
|
||||
----
|
||||
|
||||
Per una lista delle opzioni e dei controlli di base:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Per una lista di tutte le opzioni e di tutti i controlli:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Puoi trovare un esempio di esecuzione [qui](https://asciinema.org/a/46601).
|
||||
Per una panoramica delle capacità di sqlmap, una lista delle sue funzionalità e la descrizione di tutte le sue opzioni e controlli, insieme ad un gran numero di esempi, siete pregati di visitare lo [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (disponibile solo in inglese).
|
||||
|
||||
Link
|
||||
----
|
||||
|
||||
* Sito: http://sqlmap.org
|
||||
* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* RSS feed dei commit: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Manuale dell'utente: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Domande più frequenti (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Dimostrazioni: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Screenshot: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmapはオープンソースのペネトレーションテスティングツールです。SQLインジェクションの脆弱性の検出、活用、そしてデータベースサーバ奪取のプロセスを自動化します。
|
||||
強力な検出エンジン、ペネトレーションテスターのための多くのニッチ機能、持続的なデータベースのフィンガープリンティングから、データベースのデータ取得やアウトオブバンド接続を介したオペレーティング・システム上でのコマンド実行、ファイルシステムへのアクセスなどの広範囲に及ぶスイッチを提供します。
|
||||
@@ -19,7 +19,7 @@ wikiに載っているいくつかの機能のデモをスクリーンショッ
|
||||
|
||||
[Git](https://github.com/sqlmapproject/sqlmap) レポジトリをクローンして、sqlmapをダウンロードすることも可能です。:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmapは、 [Python](http://www.python.org/download/) バージョン **2.6.x** または **2.7.x** がインストールされていれば、全てのプラットフォームですぐに使用できます。
|
||||
|
||||
@@ -35,7 +35,7 @@ sqlmapは、 [Python](http://www.python.org/download/) バージョン **2.6.x**
|
||||
python sqlmap.py -hh
|
||||
|
||||
実行例を [こちら](https://asciinema.org/a/46601) で見ることができます。
|
||||
sqlmapの概要、機能の一覧、全てのオプションやスイッチの使用法を例とともに、 [ユーザーマニュアル](https://github.com/sqlmapproject/sqlmap/wiki/Usage) で確認することができます。
|
||||
sqlmapの概要、機能の一覧、全てのオプションやスイッチの使用法を例とともに、 [ユーザーマニュアル](https://github.com/sqlmapproject/sqlmap/wiki) で確認することができます。
|
||||
|
||||
リンク
|
||||
----
|
||||
@@ -46,6 +46,9 @@ sqlmapの概要、機能の一覧、全てのオプションやスイッチの
|
||||
* 課題管理: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* ユーザーマニュアル: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* よくある質問 (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* メーリングリストへの参加: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* メーリングリストのRSSフィード: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* メーリングリストのアーカイブ: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* デモ: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* スクリーンショット: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap to open sourceowe narzędzie do testów penetracyjnych, które automatyzuje procesy detekcji, przejmowania i testowania odporności serwerów SQL na podatność na iniekcję niechcianego kodu. Zawiera potężny mechanizm detekcji, wiele niszowych funkcji dla zaawansowanych testów penetracyjnych oraz szeroki wachlarz opcji począwszy od identyfikacji bazy danych, poprzez wydobywanie z nich danych, a nawet pozwalającuch na dostęp do systemu plików o uruchamianie poleceń w systemie operacyjnym serwera poprzez niestandardowe połączenia.
|
||||
|
||||
Zrzuty ekranowe
|
||||
----
|
||||
|
||||
|
||||
|
||||
Możesz odwiedzić [kolekcję zrzutów](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstruującą na wiki niektóre możliwości.
|
||||
|
||||
Instalacja
|
||||
----
|
||||
|
||||
Najnowsze tarball archiwum jest dostępne po klikcięciu [tutaj](https://github.com/sqlmapproject/sqlmap/tarball/master) lub najnowsze zipball archiwum po kliknięciu [tutaj](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
Można również pobrać sqlmap klonując rezozytorium [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
do użycia sqlmap potrzebny jest [Python](http://www.python.org/download/) w wersji **2.6.x** lub **2.7.x** na dowolnej platformie systemowej.
|
||||
|
||||
Sposób użycia
|
||||
----
|
||||
|
||||
Aby uzyskać listę podstawowych funkcji i parametrów użyj polecenia:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Aby uzyskać listę wszystkich funkcji i parametrów użyj polecenia:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Przykładowy wynik działania dostępny [tutaj](https://asciinema.org/a/46601).
|
||||
Aby uzyskać listę wszystkich dostępnych fukcji, parametrów i opisów ich działania wraz z przykładami użycia sqlnap proponujemy odwiedzić [instrukjcę użytkowania](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
|
||||
Odnośniki
|
||||
----
|
||||
|
||||
* Strona projektu: http://sqlmap.org
|
||||
* Pobieranie: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Raportowanie błędów: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Instrukcja użytkowania: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Często zadawane pytania (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Dema: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Zrzuty ekranowe: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
|
||||
|
||||
@@ -19,7 +19,7 @@ Você pode baixar o arquivo tar mais recente clicando [aqui]
|
||||
|
||||
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap funciona em [Python](http://www.python.org/download/) nas versões **2.6.x** e **2.7.x** em todas as plataformas.
|
||||
|
||||
@@ -46,6 +46,9 @@ Links
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Manual do Usuário: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Perguntas frequentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Mailing list subscription: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Mailing list archive: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demonstrações: [#1](http://www.youtube.com/user/inquisb/videos) e [#2](http://www.youtube.com/user/stamparm/videos)
|
||||
* Imagens: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap - это инструмент для тестирования уязвимостей с открытым исходным кодом, который автоматизирует процесс обнаружения и использования ошибок SQL-инъекций и захвата серверов баз данных. Он оснащен мощным механизмом обнаружения, множеством приятных функций для профессионального тестера уязвимостей и широким спектром скриптов, которые упрощают работу с базами данных, от сбора данных из базы данных, до доступа к базовой файловой системе и выполнения команд в операционной системе через out-of-band соединение.
|
||||
|
||||
Скриншоты
|
||||
----
|
||||
|
||||
|
||||
|
||||
Вы можете посетить [набор скриншотов](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) демонстрируемые некоторые функции в wiki.
|
||||
|
||||
Установка
|
||||
----
|
||||
|
||||
Вы можете скачать последнюю версию tarball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/tarball/master) или последний zipball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
Предпочтительно вы можете загрузить sqlmap, клонируя [Git](https://github.com/sqlmapproject/sqlmap) репозиторий:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap работает из коробки с [Python](http://www.python.org/download/) версии **2.6.x** и **2.7.x** на любой платформе.
|
||||
|
||||
Использование
|
||||
----
|
||||
|
||||
Чтобы получить список основных опций и вариантов выбора, используйте:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Чтобы получить список всех опций и вариантов выбора, используйте:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Вы можете найти пробный запуск [тут](https://asciinema.org/a/46601).
|
||||
Чтобы получить обзор возможностей sqlmap, список поддерживаемых функций и описание всех параметров и переключателей, а также примеры, вам рекомендуется ознакомится с [пользовательским мануалом](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
|
||||
Ссылки
|
||||
----
|
||||
|
||||
* Основной сайт: http://sqlmap.org
|
||||
* Скачивание: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) или [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* Канал новостей RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Отслеживание проблем: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Пользовательский мануал: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Часто задаваемые вопросы (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Демки: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Скриншоты: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap gelişmiş tespit özelliğinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak veritabınınından, veri indirmek, dosya sistemine erişmek, dosya çalıştırmak gibi - işlevleri de barındırmaktadır.
|
||||
|
||||
@@ -21,7 +21,7 @@ Kurulum
|
||||
|
||||
Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayarak indirebilirsiniz
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap [Python](http://www.python.org/download/) sitesinde bulunan **2.6.x** and **2.7.x** versiyonları ile bütün platformlarda çalışabilmektedir.
|
||||
|
||||
@@ -37,7 +37,7 @@ Bütün seçenekleri gösterir
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Program ile ilgili örnekleri [burada](https://asciinema.org/a/46601) bulabilirsiniz. Daha fazlası içinsqlmap'in bütün açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile bulunduğu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki/Usage) bakmanızı tavsiye ediyoruz
|
||||
Program ile ilgili örnekleri [burada](https://asciinema.org/a/46601) bulabilirsiniz. Daha fazlası içinsqlmap'in bütün açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile bulunduğu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki) bakmanızı tavsiye ediyoruz
|
||||
|
||||
Links
|
||||
----
|
||||
@@ -48,6 +48,9 @@ Links
|
||||
* Hata takip etme sistemi: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Kullanıcı Manueli: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Sıkça Sorulan Sorular(SSS): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Mail listesi: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* Mail RSS takibi: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* Mail listesi arşivi: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Demolar: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Ekran görüntüleri: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap - це інструмент для тестування вразливостей з відкритим сирцевим кодом, який автоматизує процес виявлення і використання дефектів SQL-ін'єкцій, а також захоплення серверів баз даних. Він оснащений потужним механізмом виявлення, безліччю приємних функцій для професійного тестувальника вразливостей і широким спектром скриптів, які спрощують роботу з базами даних - від відбитка бази даних до доступу до базової файлової системи та виконання команд в операційній системі через out-of-band з'єднання.
|
||||
|
||||
Скриншоти
|
||||
----
|
||||
|
||||
|
||||
|
||||
Ви можете ознайомитися з [колекцією скриншотів](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), які демонструють деякі функції в wiki.
|
||||
|
||||
Встановлення
|
||||
----
|
||||
|
||||
Ви можете завантажити останню версію tarball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/tarball/master) або останню версію zipball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||
|
||||
Найкраще завантажити sqlmap шляхом клонування [Git](https://github.com/sqlmapproject/sqlmap) репозиторію:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap «працює з коробки» з [Python](http://www.python.org/download/) версії **2.6.x** та **2.7.x** на будь-якій платформі.
|
||||
|
||||
Використання
|
||||
----
|
||||
|
||||
Щоб отримати список основних опцій і перемикачів, використовуйте:
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
Щоб отримати список всіх опцій і перемикачів, використовуйте:
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
Ви можете знайти приклад виконання [тут](https://asciinema.org/a/46601).
|
||||
Для того, щоб ознайомитися з можливостями sqlmap, списком підтримуваних функцій та описом всіх параметрів і перемикачів, а також прикладами, вам рекомендується скористатися [інструкцією користувача](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||
|
||||
Посилання
|
||||
----
|
||||
|
||||
* Основний сайт: http://sqlmap.org
|
||||
* Завантаження: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) або [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||
* Канал новин RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
* Відстеження проблем: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* Інструкція користувача: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* Поширенні питання (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* Демо: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* Скриншоти: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
@@ -1,6 +1,6 @@
|
||||
# sqlmap
|
||||
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||
[](https://api.travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过外带数据连接的方式执行操作系统命令。
|
||||
|
||||
@@ -18,7 +18,7 @@ sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，
|
||||
|
||||
推荐你从 [Git](https://github.com/sqlmapproject/sqlmap) 仓库获取最新的源代码:
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6.x** 和 **2.7.x** 版本的任何平台上
|
||||
|
||||
@@ -33,7 +33,7 @@ sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6.x** 和
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
你可以从 [这里](https://asciinema.org/a/46601) 看到一个sqlmap 的使用样例。除此以外，你还可以查看 [使用手册](https://github.com/sqlmapproject/sqlmap/wiki/Usage)。获取sqlmap所有支持的特性、参数、命令行选项开关及说明的使用帮助。
|
||||
你可以从 [这里](https://asciinema.org/a/46601) 看到一个sqlmap 的使用样例。除此以外，你还可以查看 [使用手册](https://github.com/sqlmapproject/sqlmap/wiki)。获取sqlmap所有支持的特性、参数、命令行选项开关及说明的使用帮助。
|
||||
|
||||
链接
|
||||
----
|
||||
@@ -44,6 +44,9 @@ sqlmap 可以运行在 [Python](http://www.python.org/download/) **2.6.x** 和
|
||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
* 使用手册: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
* 常见问题 (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
* 邮件讨论列表: https://lists.sourceforge.net/lists/listinfo/sqlmap-users
|
||||
* 邮件列表 RSS 订阅: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap
|
||||
* 邮件列表归档: http://news.gmane.org/gmane.comp.security.sqlmap
|
||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
* 教程: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos)
|
||||
* 截图: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@
|
||||
"""
|
||||
beep.py - Make a beep sound
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
Regular → Executable
+2
-2
@@ -3,8 +3,8 @@
|
||||
"""
|
||||
cloak.py - Simple file encryption/compression utility
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
@@ -3,8 +3,8 @@
|
||||
"""
|
||||
dbgtool.py - Portable executable to ASCII debug script converter
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
Regular → Executable
@@ -80,7 +80,7 @@ def main(src, dst):
|
||||
cmd = ''
|
||||
|
||||
# Wait for incoming replies
|
||||
if sock in select.select([sock], [], [])[0]:
|
||||
if sock in select.select([ sock ], [], [])[0]:
|
||||
buff = sock.recv(4096)
|
||||
|
||||
if 0 == len(buff):
|
||||
@@ -125,12 +125,8 @@ def main(src, dst):
|
||||
# Have the IP packet contain the ICMP packet (along with its payload)
|
||||
ip.contains(icmp)
|
||||
|
||||
try:
|
||||
# Send it to the target host
|
||||
sock.sendto(ip.get_packet(), (dst, 0))
|
||||
except socket.error, ex:
|
||||
sys.stderr.write("'%s'\n" % ex)
|
||||
sys.stderr.flush()
|
||||
# Send it to the target host
|
||||
sock.sendto(ip.get_packet(), (dst, 0))
|
||||
|
||||
if __name__ == '__main__':
|
||||
if len(sys.argv) < 3:
|
||||
|
||||
@@ -0,0 +1,137 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import os
|
||||
import re
|
||||
import urllib2
|
||||
import urlparse
|
||||
|
||||
from xml.dom.minidom import Document
|
||||
|
||||
# Path to the XML file with signatures
|
||||
MSSQL_XML = os.path.abspath("../../xml/banner/mssql.xml")
|
||||
|
||||
# Url to update Microsoft SQL Server XML versions file from
|
||||
MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx"
|
||||
|
||||
def updateMSSQLXML():
|
||||
if not os.path.exists(MSSQL_XML):
|
||||
errMsg = "[ERROR] file '%s' does not exist. Please run the script from its parent directory" % MSSQL_XML
|
||||
print errMsg
|
||||
return
|
||||
|
||||
infoMsg = "[INFO] retrieving data from '%s'" % MSSQL_VERSIONS_URL
|
||||
print infoMsg
|
||||
|
||||
try:
|
||||
req = urllib2.Request(MSSQL_VERSIONS_URL)
|
||||
f = urllib2.urlopen(req)
|
||||
mssqlVersionsHtmlString = f.read()
|
||||
f.close()
|
||||
except urllib2.URLError:
|
||||
__mssqlPath = urlparse.urlsplit(MSSQL_VERSIONS_URL)
|
||||
__mssqlHostname = __mssqlPath[1]
|
||||
|
||||
warnMsg = "[WARNING] sqlmap was unable to connect to %s," % __mssqlHostname
|
||||
warnMsg += " check your Internet connection and retry"
|
||||
print warnMsg
|
||||
|
||||
return
|
||||
|
||||
releases = re.findall("class=\"BCC_DV_01DarkBlueTitle\">SQL Server\s(.+?)\sBuilds", mssqlVersionsHtmlString, re.I | re.M)
|
||||
releasesCount = len(releases)
|
||||
|
||||
# Create the minidom document
|
||||
doc = Document()
|
||||
|
||||
# Create the <root> base element
|
||||
root = doc.createElement("root")
|
||||
doc.appendChild(root)
|
||||
|
||||
for index in xrange(0, releasesCount):
|
||||
release = releases[index]
|
||||
|
||||
# Skip Microsoft SQL Server 6.5 because the HTML
|
||||
# table is in another format
|
||||
if release == "6.5":
|
||||
continue
|
||||
|
||||
# Create the <signatures> base element
|
||||
signatures = doc.createElement("signatures")
|
||||
signatures.setAttribute("release", release)
|
||||
root.appendChild(signatures)
|
||||
|
||||
startIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index])
|
||||
|
||||
if index == releasesCount - 1:
|
||||
stopIdx = len(mssqlVersionsHtmlString)
|
||||
else:
|
||||
stopIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index + 1])
|
||||
|
||||
mssqlVersionsReleaseString = mssqlVersionsHtmlString[startIdx:stopIdx]
|
||||
servicepackVersion = re.findall("</td><td>[7\.0|2000|2005|2008|2008 R2]*(.*?)</td><td.*?([\d\.]+)</td>[\r]*\n", mssqlVersionsReleaseString, re.I | re.M)
|
||||
|
||||
for servicePack, version in servicepackVersion:
|
||||
if servicePack.startswith(" "):
|
||||
servicePack = servicePack[1:]
|
||||
if "/" in servicePack:
|
||||
servicePack = servicePack[:servicePack.index("/")]
|
||||
if "(" in servicePack:
|
||||
servicePack = servicePack[:servicePack.index("(")]
|
||||
if "-" in servicePack:
|
||||
servicePack = servicePack[:servicePack.index("-")]
|
||||
if "*" in servicePack:
|
||||
servicePack = servicePack[:servicePack.index("*")]
|
||||
if servicePack.startswith("+"):
|
||||
servicePack = "0%s" % servicePack
|
||||
|
||||
servicePack = servicePack.replace("\t", " ")
|
||||
servicePack = servicePack.replace("No SP", "0")
|
||||
servicePack = servicePack.replace("RTM", "0")
|
||||
servicePack = servicePack.replace("TM", "0")
|
||||
servicePack = servicePack.replace("SP", "")
|
||||
servicePack = servicePack.replace("Service Pack", "")
|
||||
servicePack = servicePack.replace("<a href=\"http:", "")
|
||||
servicePack = servicePack.replace(" ", " ")
|
||||
servicePack = servicePack.replace("+ ", "+")
|
||||
servicePack = servicePack.replace(" +", "+")
|
||||
|
||||
if servicePack.endswith(" "):
|
||||
servicePack = servicePack[:-1]
|
||||
|
||||
if servicePack and version:
|
||||
# Create the main <card> element
|
||||
signature = doc.createElement("signature")
|
||||
signatures.appendChild(signature)
|
||||
|
||||
# Create a <version> element
|
||||
versionElement = doc.createElement("version")
|
||||
signature.appendChild(versionElement)
|
||||
|
||||
# Give the <version> elemenet some text
|
||||
versionText = doc.createTextNode(version)
|
||||
versionElement.appendChild(versionText)
|
||||
|
||||
# Create a <servicepack> element
|
||||
servicepackElement = doc.createElement("servicepack")
|
||||
signature.appendChild(servicepackElement)
|
||||
|
||||
# Give the <servicepack> elemenet some text
|
||||
servicepackText = doc.createTextNode(servicePack)
|
||||
servicepackElement.appendChild(servicepackText)
|
||||
|
||||
# Save our newly created XML to the signatures file
|
||||
mssqlXml = codecs.open(MSSQL_XML, "w", "utf8")
|
||||
doc.writexml(writer=mssqlXml, addindent=" ", newl="\n")
|
||||
mssqlXml.close()
|
||||
|
||||
infoMsg = "[INFO] done. retrieved data parsed and saved into '%s'" % MSSQL_XML
|
||||
print infoMsg
|
||||
|
||||
if __name__ == "__main__":
|
||||
updateMSSQLXML()
|
||||
@@ -1,3 +1,3 @@
|
||||
runcmd.exe is an auxiliary program that can be used for running command prompt
|
||||
commands skipping standard "cmd /c" way. It is licensed under the terms of the
|
||||
GNU Lesser General Public License.
|
||||
Files in this folder can be used to compile auxiliary program that can
|
||||
be used for running command prompt commands skipping standard "cmd /c" way.
|
||||
They are licensed under the terms of the GNU Lesser General Public License.
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
@@ -3,8 +3,8 @@
|
||||
"""
|
||||
safe2bin.py - Simple safe(hex) to binary format converter
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import binascii
|
||||
@@ -23,7 +23,7 @@ HEX_ENCODED_CHAR_REGEX = r"(?P<result>\\x[0-9A-Fa-f]{2})"
|
||||
SAFE_ENCODE_SLASH_REPLACEMENTS = "\t\n\r\x0b\x0c"
|
||||
|
||||
# Characters that don't need to be safe encoded
|
||||
SAFE_CHARS = "".join(filter(lambda _: _ not in SAFE_ENCODE_SLASH_REPLACEMENTS, string.printable.replace('\\', '')))
|
||||
SAFE_CHARS = "".join(filter(lambda x: x not in SAFE_ENCODE_SLASH_REPLACEMENTS, string.printable.replace('\\', '')))
|
||||
|
||||
# Prefix used for hex encoded values
|
||||
HEX_ENCODED_PREFIX = r"\x"
|
||||
@@ -47,7 +47,7 @@ def safecharencode(value):
|
||||
retVal = value
|
||||
|
||||
if isinstance(value, basestring):
|
||||
if any([_ not in SAFE_CHARS for _ in value]):
|
||||
if any(_ not in SAFE_CHARS for _ in value):
|
||||
retVal = retVal.replace(HEX_ENCODED_PREFIX, HEX_ENCODED_PREFIX_MARKER)
|
||||
retVal = retVal.replace('\\', SLASH_MARKER)
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
# Removes trailing spaces from blank lines inside project files
|
||||
find . -type f -iname '*.py' -exec sed -i 's/^[ \t]*$//' {} \;
|
||||
|
||||
Executable → Regular
+2
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
# Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
# Removes duplicate entries in wordlist like files
|
||||
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
#! /usr/bin/env python
|
||||
|
||||
# Runs pylint on all python scripts found in a directory tree
|
||||
# Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html
|
||||
|
||||
import os
|
||||
import sys
|
||||
|
||||
def check(filepath):
|
||||
if filepath.endswith(".py"):
|
||||
content = open(filepath, "rb").read()
|
||||
|
||||
if "\n\n\n" in content:
|
||||
index = content.find("\n\n\n")
|
||||
print filepath, repr(content[index - 30:index + 30])
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
BASE_DIRECTORY = sys.argv[1]
|
||||
except IndexError:
|
||||
print "no directory specified, defaulting to current working directory"
|
||||
BASE_DIRECTORY = os.getcwd()
|
||||
|
||||
print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY
|
||||
for root, dirs, files in os.walk(BASE_DIRECTORY):
|
||||
if any(_ in root for _ in ("extra", "thirdparty")):
|
||||
continue
|
||||
for name in files:
|
||||
filepath = os.path.join(root, name)
|
||||
check(filepath)
|
||||
Executable
+7
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
# Runs pep8 on all python files (prerequisite: apt-get install pep8)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pep8 '{}' \;
|
||||
Executable → Regular
+6
-18
@@ -1,15 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
: '
|
||||
cat > .git/hooks/post-commit << EOF
|
||||
#!/bin/bash
|
||||
|
||||
source ./extra/shutils/postcommit-hook.sh
|
||||
EOF
|
||||
|
||||
chmod +x .git/hooks/post-commit
|
||||
'
|
||||
|
||||
SETTINGS="../../lib/core/settings.py"
|
||||
|
||||
declare -x SCRIPTPATH="${0}"
|
||||
@@ -18,16 +8,14 @@ FULLPATH=${SCRIPTPATH%/*}/$SETTINGS
|
||||
|
||||
if [ -f $FULLPATH ]
|
||||
then
|
||||
LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"')
|
||||
declare -a LINE
|
||||
LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"');
|
||||
declare -a LINE;
|
||||
NEW_TAG=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); print '.'.join(_[:-1]) if len(_) == 4 and _[-1] == '0' else ''" "$LINE")
|
||||
if [ -n "$NEW_TAG" ]
|
||||
then
|
||||
#git commit -am "Automatic monthly tagging"
|
||||
echo "Creating new tag ${NEW_TAG}"
|
||||
git tag $NEW_TAG
|
||||
git commit -am "Automatic monthly tagging"
|
||||
echo "Creating new tag ${NEW_TAG}";
|
||||
git tag $NEW_TAG;
|
||||
git push origin $NEW_TAG
|
||||
echo "Going to push PyPI package"
|
||||
/bin/bash ${SCRIPTPATH%/*}/pypi.sh
|
||||
fi
|
||||
fi
|
||||
fi;
|
||||
Executable → Regular
+7
-20
@@ -1,15 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
: '
|
||||
cat > .git/hooks/pre-commit << EOF
|
||||
#!/bin/bash
|
||||
|
||||
source ./extra/shutils/precommit-hook.sh
|
||||
EOF
|
||||
|
||||
chmod +x .git/hooks/pre-commit
|
||||
'
|
||||
|
||||
PROJECT="../../"
|
||||
SETTINGS="../../lib/core/settings.py"
|
||||
CHECKSUM="../../txt/checksum.md5"
|
||||
@@ -20,23 +10,20 @@ PROJECT_FULLPATH=${SCRIPTPATH%/*}/$PROJECT
|
||||
SETTINGS_FULLPATH=${SCRIPTPATH%/*}/$SETTINGS
|
||||
CHECKSUM_FULLPATH=${SCRIPTPATH%/*}/$CHECKSUM
|
||||
|
||||
git diff $SETTINGS_FULLPATH | grep "VERSION =" > /dev/null && exit 0
|
||||
truncate -s 0 "$CHECKSUM_FULLPATH"
|
||||
cd $PROJECT_FULLPATH && for i in $(find . -name "*.py" -o -name "*.xml" -o -iname "*_" | sort); do git ls-files $i --error-unmatch &>/dev/null && md5sum $i | sed 's/\.\///' >> "$CHECKSUM_FULLPATH"; git add "$CHECKSUM_FULLPATH"; done
|
||||
|
||||
if [ -f $SETTINGS_FULLPATH ]
|
||||
then
|
||||
LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"')
|
||||
declare -a LINE
|
||||
LINE=$(grep -o ${SETTINGS_FULLPATH} -e 'VERSION = "[0-9.]*"');
|
||||
declare -a LINE;
|
||||
INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE")
|
||||
if [ -n "$INCREMENTED" ]
|
||||
then
|
||||
sed -i "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH
|
||||
echo "Updated ${INCREMENTED} in ${SETTINGS_FULLPATH}"
|
||||
sed "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH > $SETTINGS_FULLPATH.tmp && mv $SETTINGS_FULLPATH.tmp $SETTINGS_FULLPATH
|
||||
echo "Updated ${INCREMENTED} in ${SETTINGS_FULLPATH}";
|
||||
else
|
||||
echo "Something went wrong in VERSION increment"
|
||||
exit 1
|
||||
fi
|
||||
git add "$SETTINGS_FULLPATH"
|
||||
fi
|
||||
|
||||
truncate -s 0 "$CHECKSUM_FULLPATH"
|
||||
cd $PROJECT_FULLPATH && for i in $(find . -name "*.py" -o -name "*.xml" -o -iname "*_" | sort); do git ls-files $i --error-unmatch &>/dev/null && md5sum $i | stdbuf -i0 -o0 -e0 sed 's/\.\///' >> "$CHECKSUM_FULLPATH"; git add "$CHECKSUM_FULLPATH"; done
|
||||
fi;
|
||||
@@ -1,7 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pycodestyle --ignore=E501,E302,E305,E722,E402 '{}' \;
|
||||
@@ -1,7 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs py2diatra on all python files (prerequisite: pip install pydiatra)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec py2diatra '{}' \; | grep -v bare-except
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \;
|
||||
|
||||
Executable → Regular
+3
-3
@@ -20,11 +20,11 @@ def check(module):
|
||||
print "CHECKING ", module
|
||||
pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r')
|
||||
for line in pout:
|
||||
if re.match(r"\AE:", line):
|
||||
print line.strip()
|
||||
if re.match("E....:.", line):
|
||||
print line
|
||||
if __RATING__ and "Your code has been rated at" in line:
|
||||
print line
|
||||
score = re.findall(r"\d.\d\d", line)[0]
|
||||
score = re.findall("\d.\d\d", line)[0]
|
||||
total += float(score)
|
||||
count += 1
|
||||
|
||||
|
||||
Executable → Regular
+9
-130
@@ -1,14 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ ! -f ~/.pypirc ]; then
|
||||
echo "File ~/.pypirc is missing"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
declare -x SCRIPTPATH="${0}"
|
||||
SETTINGS="${SCRIPTPATH%/*}/../../lib/core/settings.py"
|
||||
VERSION=$(cat $SETTINGS | grep -E "^VERSION =" | cut -d '"' -f 2 | cut -d '.' -f 1-3)
|
||||
TYPE=pip
|
||||
VERSION=1.0.8
|
||||
TMP_DIR=/tmp/pypi
|
||||
mkdir $TMP_DIR
|
||||
cd $TMP_DIR
|
||||
@@ -16,8 +8,8 @@ cat > $TMP_DIR/setup.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from setuptools import setup, find_packages
|
||||
@@ -25,27 +17,15 @@ from setuptools import setup, find_packages
|
||||
setup(
|
||||
name='sqlmap',
|
||||
version='$VERSION',
|
||||
description='Automatic SQL injection and database takeover tool',
|
||||
long_description='sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.',
|
||||
description="Automatic SQL injection and database takeover tool",
|
||||
author='Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar',
|
||||
author_email='[email protected], [email protected]',
|
||||
url='http://sqlmap.org',
|
||||
url='https://sqlmap.org',
|
||||
download_url='https://github.com/sqlmapproject/sqlmap/archive/$VERSION.zip',
|
||||
license='GNU General Public License v2 (GPLv2)',
|
||||
license='GPLv2',
|
||||
packages=find_packages(),
|
||||
include_package_data=True,
|
||||
zip_safe=False,
|
||||
# https://pypi.python.org/pypi?%3Aaction=list_classifiers
|
||||
classifiers=[
|
||||
'Development Status :: 5 - Production/Stable',
|
||||
'License :: OSI Approved :: GNU General Public License v2 (GPLv2)',
|
||||
'Natural Language :: English',
|
||||
'Operating System :: OS Independent',
|
||||
'Programming Language :: Python',
|
||||
'Environment :: Console',
|
||||
'Topic :: Database',
|
||||
'Topic :: Security',
|
||||
],
|
||||
entry_points={
|
||||
'console_scripts': [
|
||||
'sqlmap = sqlmap.sqlmap:main',
|
||||
@@ -61,117 +41,16 @@ cat > sqlmap/__init__.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
|
||||
sys.dont_write_bytecode = True
|
||||
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
||||
EOF
|
||||
cat > README.rst << "EOF"
|
||||
sqlmap
|
||||
======
|
||||
|
||||
|Build Status| |Python 2.6|2.7| |License| |Twitter|
|
||||
|
||||
sqlmap is an open source penetration testing tool that automates the
|
||||
process of detecting and exploiting SQL injection flaws and taking over
|
||||
of database servers. It comes with a powerful detection engine, many
|
||||
niche features for the ultimate penetration tester and a broad range of
|
||||
switches lasting from database fingerprinting, over data fetching from
|
||||
the database, to accessing the underlying file system and executing
|
||||
commands on the operating system via out-of-band connections.
|
||||
|
||||
Screenshots
|
||||
-----------
|
||||
|
||||
.. figure:: https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png
|
||||
:alt: Screenshot
|
||||
|
||||
|
||||
You can visit the `collection of
|
||||
screenshots <https://github.com/sqlmapproject/sqlmap/wiki/Screenshots>`__
|
||||
demonstrating some of features on the wiki.
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
You can use pip to install and/or upgrade the sqlmap to latest (monthly) tagged version with: ::
|
||||
|
||||
pip install --upgrade sqlmap
|
||||
|
||||
Alternatively, you can download the latest tarball by clicking
|
||||
`here <https://github.com/sqlmapproject/sqlmap/tarball/master>`__ or
|
||||
latest zipball by clicking
|
||||
`here <https://github.com/sqlmapproject/sqlmap/zipball/master>`__.
|
||||
|
||||
If you prefer fetching daily updates, you can download sqlmap by cloning the
|
||||
`Git <https://github.com/sqlmapproject/sqlmap>`__ repository:
|
||||
|
||||
::
|
||||
|
||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||
|
||||
sqlmap works out of the box with
|
||||
`Python <http://www.python.org/download/>`__ version **2.6.x** and
|
||||
**2.7.x** on any platform.
|
||||
|
||||
Usage
|
||||
-----
|
||||
|
||||
To get a list of basic options and switches use:
|
||||
|
||||
::
|
||||
|
||||
python sqlmap.py -h
|
||||
|
||||
To get a list of all options and switches use:
|
||||
|
||||
::
|
||||
|
||||
python sqlmap.py -hh
|
||||
|
||||
You can find a sample run `here <https://asciinema.org/a/46601>`__. To
|
||||
get an overview of sqlmap capabilities, list of supported features and
|
||||
description of all options and switches, along with examples, you are
|
||||
advised to consult the `user's
|
||||
manual <https://github.com/sqlmapproject/sqlmap/wiki/Usage>`__.
|
||||
|
||||
Links
|
||||
-----
|
||||
|
||||
- Homepage: http://sqlmap.org
|
||||
- Download:
|
||||
`.tar.gz <https://github.com/sqlmapproject/sqlmap/tarball/master>`__
|
||||
or `.zip <https://github.com/sqlmapproject/sqlmap/zipball/master>`__
|
||||
- Commits RSS feed:
|
||||
https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||
- Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
||||
- User's manual: https://github.com/sqlmapproject/sqlmap/wiki
|
||||
- Frequently Asked Questions (FAQ):
|
||||
https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||
- Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||
- Demos: http://www.youtube.com/user/inquisb/videos
|
||||
- Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||
|
||||
.. |Build Status| image:: https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master
|
||||
:target: https://api.travis-ci.org/sqlmapproject/sqlmap
|
||||
.. |Python 2.6|2.7| image:: https://img.shields.io/badge/python-2.6|2.7-yellow.svg
|
||||
:target: https://www.python.org/
|
||||
.. |License| image:: https://img.shields.io/badge/license-GPLv2-red.svg
|
||||
:target: https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE
|
||||
.. |Twitter| image:: https://img.shields.io/badge/[email protected]
|
||||
:target: https://twitter.com/sqlmap
|
||||
|
||||
.. pandoc --from=markdown --to=rst --output=README.rst sqlmap/README.md
|
||||
.. http://rst.ninjs.org/
|
||||
EOF
|
||||
sed -i "s/^VERSION =.*/VERSION = \"$VERSION\"/g" sqlmap/lib/core/settings.py
|
||||
sed -i "s/^TYPE =.*/TYPE = \"$TYPE\"/g" sqlmap/lib/core/settings.py
|
||||
sed -i "s/.*lib\/core\/settings\.py/`md5sum sqlmap/lib/core/settings.py | cut -d ' ' -f 1` lib\/core\/settings\.py/g" sqlmap/txt/checksum.md5
|
||||
for file in $(find sqlmap -type f | grep -v -E "\.(git|yml)"); do echo include $file >> MANIFEST.in; done
|
||||
python setup.py sdist
|
||||
python setup.py sdist upload
|
||||
rm -rf $TMP_DIR
|
||||
Executable → Regular
+7
-6
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
# Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'doc/COPYING' for copying permission
|
||||
|
||||
import codecs
|
||||
import inspect
|
||||
@@ -22,14 +22,15 @@ from lib.core.revision import getRevisionNumber
|
||||
|
||||
START_TIME = time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime())
|
||||
SQLMAP_HOME = "/opt/sqlmap"
|
||||
REVISION = getRevisionNumber()
|
||||
|
||||
SMTP_SERVER = "127.0.0.1"
|
||||
SMTP_PORT = 25
|
||||
SMTP_TIMEOUT = 30
|
||||
FROM = "[email protected]"
|
||||
# TO = "[email protected]"
|
||||
#TO = "[email protected]"
|
||||
TO = ["[email protected]", "[email protected]"]
|
||||
SUBJECT = "regression test started on %s using revision %s" % (START_TIME, getRevisionNumber())
|
||||
SUBJECT = "regression test started on %s using revision %s" % (START_TIME, REVISION)
|
||||
TARGET = "debian"
|
||||
|
||||
def prepare_email(content):
|
||||
@@ -40,7 +41,7 @@ def prepare_email(content):
|
||||
msg = MIMEMultipart()
|
||||
msg["Subject"] = SUBJECT
|
||||
msg["From"] = FROM
|
||||
msg["To"] = TO if isinstance(TO, basestring) else ','.join(TO)
|
||||
msg["To"] = TO if isinstance(TO, basestring) else ",".join(TO)
|
||||
|
||||
msg.attach(MIMEText(content))
|
||||
|
||||
@@ -83,7 +84,7 @@ def main():
|
||||
if stderr:
|
||||
failure_email("Execution of regression test failed with error:\n\n%s" % stderr)
|
||||
|
||||
failed_tests = re.findall(r"running live test case: (.+?) \((\d+)\/\d+\)[\r]*\n.+test failed (at parsing items: (.+))?\s*\- scan folder: (\/.+) \- traceback: (.*?)( - SQL injection not detected)?[\r]*\n", stdout)
|
||||
failed_tests = re.findall("running live test case: (.+?) \((\d+)\/\d+\)[\r]*\n.+test failed (at parsing items: (.+))?\s*\- scan folder: (\/.+) \- traceback: (.*?)( - SQL injection not detected)?[\r]*\n", stdout, re.M)
|
||||
|
||||
for failed_test in failed_tests:
|
||||
title = failed_test[0]
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# References: http://www.thegeekstuff.com/2012/09/strip-command-examples/
|
||||
# http://www.muppetlabs.com/~breadbox/software/elfkickers.html
|
||||
# https://ptspts.blogspot.hr/2013/12/how-to-make-smaller-c-and-c-binaries.html
|
||||
|
||||
# For example:
|
||||
# python ../../../../../extra/cloak/cloak.py -d -i lib_postgresqludf_sys.so_
|
||||
# ../../../../../extra/shutils/strip.sh lib_postgresqludf_sys.so
|
||||
# python ../../../../../extra/cloak/cloak.py -i lib_postgresqludf_sys.so
|
||||
# rm lib_postgresqludf_sys.so
|
||||
|
||||
strip -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag $*
|
||||
sstrip $*
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import cookielib
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
@@ -1,121 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import cookielib
|
||||
import glob
|
||||
import httplib
|
||||
import inspect
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import urllib2
|
||||
|
||||
sys.dont_write_bytecode = True
|
||||
|
||||
NAME, VERSION, AUTHOR = "WAF Detectify", "0.1", "sqlmap developers (@sqlmap)"
|
||||
TIMEOUT = 10
|
||||
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Cache-Control": "max-age=0"}
|
||||
SQLMAP_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
|
||||
SCRIPTS_DIR = os.path.join(SQLMAP_DIR, "waf")
|
||||
LEVEL_COLORS = {"o": "\033[00;94m", "x": "\033[00;91m", "!": "\033[00;93m", "i": "\033[00;92m"}
|
||||
CACHE = {}
|
||||
WAF_FUNCTIONS = []
|
||||
|
||||
def get_page(get=None, url=None, host=None, data=None):
|
||||
key = (get, url, host, data)
|
||||
|
||||
if key in CACHE:
|
||||
return CACHE[key]
|
||||
|
||||
page, headers, code = None, {}, httplib.OK
|
||||
|
||||
url = url or ("%s%s%s" % (sys.argv[1], '?' if '?' not in sys.argv[1] else '&', get) if get else sys.argv[1])
|
||||
if not url.startswith("http"):
|
||||
url = "http://%s" % url
|
||||
|
||||
try:
|
||||
req = urllib2.Request("".join(url[_].replace(' ', "%20") if _ > url.find('?') else url[_] for _ in xrange(len(url))), data, HEADERS)
|
||||
conn = urllib2.urlopen(req, timeout=TIMEOUT)
|
||||
page = conn.read()
|
||||
headers = conn.info()
|
||||
except Exception, ex:
|
||||
code = getattr(ex, "code", None)
|
||||
page = ex.read() if hasattr(ex, "read") else getattr(ex, "msg", "")
|
||||
headers = ex.info() if hasattr(ex, "info") else {}
|
||||
|
||||
result = CACHE[key] = page, headers, code
|
||||
|
||||
return result
|
||||
|
||||
def colorize(message):
|
||||
if not subprocess.mswindows and sys.stdout.isatty():
|
||||
message = re.sub(r"\[(.)\]", lambda match: "[%s%s\033[00;49m]" % (LEVEL_COLORS[match.group(1)], match.group(1)), message)
|
||||
message = message.replace("@sqlmap", "\033[00;96m@sqlmap\033[00;49m")
|
||||
message = message.replace(NAME, "\033[00;93m%s\033[00;49m" % NAME)
|
||||
|
||||
return message
|
||||
|
||||
def main():
|
||||
global WAF_FUNCTIONS
|
||||
|
||||
print colorize("%s #v%s\n by: %s\n" % (NAME, VERSION, AUTHOR))
|
||||
|
||||
if len(sys.argv) < 2:
|
||||
exit(colorize("[x] usage: python %s <hostname>" % os.path.split(__file__)[-1]))
|
||||
|
||||
cookie_jar = cookielib.CookieJar()
|
||||
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))
|
||||
urllib2.install_opener(opener)
|
||||
|
||||
sys.path.insert(0, SQLMAP_DIR)
|
||||
|
||||
for found in glob.glob(os.path.join(SCRIPTS_DIR, "*.py")):
|
||||
dirname, filename = os.path.split(found)
|
||||
dirname = os.path.abspath(dirname)
|
||||
|
||||
if filename == "__init__.py":
|
||||
continue
|
||||
|
||||
if dirname not in sys.path:
|
||||
sys.path.insert(0, dirname)
|
||||
|
||||
try:
|
||||
if filename[:-3] in sys.modules:
|
||||
del sys.modules[filename[:-3]]
|
||||
module = __import__(filename[:-3].encode(sys.getfilesystemencoding() or "utf8"))
|
||||
except ImportError, msg:
|
||||
exit(colorize("[x] cannot import WAF script '%s' (%s)" % (filename[:-3], msg)))
|
||||
|
||||
_ = dict(inspect.getmembers(module))
|
||||
if "detect" not in _:
|
||||
exit(colorize("[x] missing function 'detect(get_page)' in WAF script '%s'" % found))
|
||||
else:
|
||||
WAF_FUNCTIONS.append((_["detect"], _.get("__product__", filename[:-3])))
|
||||
|
||||
WAF_FUNCTIONS = sorted(WAF_FUNCTIONS, key=lambda _: "generic" in _[1].lower())
|
||||
|
||||
print colorize("[i] checking '%s'..." % sys.argv[1])
|
||||
|
||||
found = False
|
||||
for function, product in WAF_FUNCTIONS:
|
||||
if found and "unknown" in product.lower():
|
||||
continue
|
||||
|
||||
if function(get_page):
|
||||
print colorize("[!] WAF/IPS identified as '%s'" % product)
|
||||
found = True
|
||||
|
||||
if not found:
|
||||
print colorize("[o] nothing found")
|
||||
|
||||
print
|
||||
|
||||
exit(int(not found))
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
+14
-11
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.controller.handler import setHandler
|
||||
@@ -16,8 +16,8 @@ from lib.core.enums import CONTENT_TYPE
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapUnsupportedDBMSException
|
||||
from lib.core.settings import SUPPORTED_DBMS
|
||||
from lib.utils.brute import columnExists
|
||||
from lib.utils.brute import tableExists
|
||||
from lib.techniques.brute.use import columnExists
|
||||
from lib.techniques.brute.use import tableExists
|
||||
|
||||
def action():
|
||||
"""
|
||||
@@ -74,7 +74,8 @@ def action():
|
||||
|
||||
if conf.getPasswordHashes:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS)
|
||||
conf.dumper.userSettings("database management system users password hashes",
|
||||
conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS)
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
@@ -82,7 +83,8 @@ def action():
|
||||
|
||||
if conf.getPrivileges:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES)
|
||||
conf.dumper.userSettings("database management system users privileges",
|
||||
conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES)
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
@@ -90,7 +92,8 @@ def action():
|
||||
|
||||
if conf.getRoles:
|
||||
try:
|
||||
conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES)
|
||||
conf.dumper.userSettings("database management system users roles",
|
||||
conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES)
|
||||
except SqlmapNoneDataException, ex:
|
||||
logger.critical(ex)
|
||||
except:
|
||||
@@ -140,11 +143,11 @@ def action():
|
||||
conf.dbmsHandler.udfInjectCustom()
|
||||
|
||||
# File system options
|
||||
if conf.fileRead:
|
||||
conf.dumper.rFile(conf.dbmsHandler.readFile(conf.fileRead))
|
||||
if conf.rFile:
|
||||
conf.dumper.rFile(conf.dbmsHandler.readFile(conf.rFile))
|
||||
|
||||
if conf.fileWrite:
|
||||
conf.dbmsHandler.writeFile(conf.fileWrite, conf.fileDest, conf.fileWriteType)
|
||||
if conf.wFile:
|
||||
conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
|
||||
|
||||
# Operating system options
|
||||
if conf.osCmd:
|
||||
|
||||
+196
-348
File diff suppressed because it is too large
Load Diff
+69
-103
@@ -1,13 +1,12 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import re
|
||||
import time
|
||||
|
||||
from lib.controller.action import action
|
||||
from lib.controller.checks import checkSqlInjection
|
||||
@@ -16,7 +15,6 @@ from lib.controller.checks import checkStability
|
||||
from lib.controller.checks import checkString
|
||||
from lib.controller.checks import checkRegexp
|
||||
from lib.controller.checks import checkConnection
|
||||
from lib.controller.checks import checkInternet
|
||||
from lib.controller.checks import checkNullConnection
|
||||
from lib.controller.checks import checkWaf
|
||||
from lib.controller.checks import heuristicCheckSqlInjection
|
||||
@@ -43,7 +41,6 @@ from lib.core.common import urldecode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.decorators import stackedmethod
|
||||
from lib.core.enums import CONTENT_TYPE
|
||||
from lib.core.enums import HASHDB_KEYS
|
||||
from lib.core.enums import HEURISTIC_TEST
|
||||
@@ -55,12 +52,9 @@ from lib.core.exception import SqlmapBaseException
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapNotVulnerableException
|
||||
from lib.core.exception import SqlmapSilentQuitException
|
||||
from lib.core.exception import SqlmapSkipTargetException
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.settings import ASP_NET_CONTROL_REGEX
|
||||
from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import EMPTY_FORM_FIELDS_REGEX
|
||||
from lib.core.settings import IGNORE_PARAMETERS
|
||||
@@ -71,7 +65,7 @@ from lib.core.settings import REFERER_ALIASES
|
||||
from lib.core.settings import USER_AGENT_ALIASES
|
||||
from lib.core.target import initTargetEnv
|
||||
from lib.core.target import setupTargetEnv
|
||||
from lib.utils.hash import crackHashFile
|
||||
from thirdparty.pagerank.pagerank import get_pagerank
|
||||
|
||||
def _selectInjection():
|
||||
"""
|
||||
@@ -123,11 +117,11 @@ def _selectInjection():
|
||||
message += "\n"
|
||||
|
||||
message += "[q] Quit"
|
||||
choice = readInput(message, default='0').upper()
|
||||
select = readInput(message, default="0")
|
||||
|
||||
if choice.isdigit() and int(choice) < len(kb.injections) and int(choice) >= 0:
|
||||
index = int(choice)
|
||||
elif choice == 'Q':
|
||||
if select.isdigit() and int(select) < len(kb.injections) and int(select) >= 0:
|
||||
index = int(select)
|
||||
elif select[0] in ("Q", "q"):
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
errMsg = "invalid choice"
|
||||
@@ -147,7 +141,7 @@ def _formatInjection(inj):
|
||||
if inj.place == PLACE.CUSTOM_HEADER:
|
||||
payload = payload.split(',', 1)[1]
|
||||
if stype == PAYLOAD.TECHNIQUE.UNION:
|
||||
count = re.sub(r"(?i)(\(.+\))|(\blimit[^a-z]+)", "", sdata.payload).count(',') + 1
|
||||
count = re.sub(r"(?i)(\(.+\))|(\blimit[^A-Za-z]+)", "", sdata.payload).count(',') + 1
|
||||
title = re.sub(r"\d+ to \d+", str(count), title)
|
||||
vector = agent.forgeUnionQuery("[QUERY]", vector[0], vector[1], vector[2], None, None, vector[5], vector[6])
|
||||
if count == 1:
|
||||
@@ -156,26 +150,22 @@ def _formatInjection(inj):
|
||||
vector = "%s%s" % (vector, comment)
|
||||
data += " Type: %s\n" % PAYLOAD.SQLINJECTION[stype]
|
||||
data += " Title: %s\n" % title
|
||||
data += " Payload: %s\n" % urldecode(payload, unsafe="&", spaceplus=(inj.place != PLACE.GET and kb.postSpaceToPlus))
|
||||
data += " Payload: %s\n" % urldecode(payload, unsafe="&", plusspace=(inj.place != PLACE.GET and kb.postSpaceToPlus))
|
||||
data += " Vector: %s\n\n" % vector if conf.verbose > 1 else "\n"
|
||||
|
||||
return data
|
||||
|
||||
def _showInjections():
|
||||
if conf.wizard and kb.wizardMode:
|
||||
kb.wizardMode = False
|
||||
|
||||
if kb.testQueryCount > 0:
|
||||
header = "sqlmap identified the following injection point(s) with "
|
||||
header += "a total of %d HTTP(s) requests" % kb.testQueryCount
|
||||
else:
|
||||
header = "sqlmap resumed the following injection point(s) from stored session"
|
||||
|
||||
if conf.api:
|
||||
conf.dumper.string("", {"url": conf.url, "query": conf.parameters.get(PLACE.GET), "data": conf.parameters.get(PLACE.POST)}, content_type=CONTENT_TYPE.TARGET)
|
||||
if hasattr(conf, "api"):
|
||||
conf.dumper.string("", kb.injections, content_type=CONTENT_TYPE.TECHNIQUES)
|
||||
else:
|
||||
data = "".join(set(_formatInjection(_) for _ in kb.injections)).rstrip("\n")
|
||||
data = "".join(set(map(lambda x: _formatInjection(x), kb.injections))).rstrip("\n")
|
||||
conf.dumper.string(header, data)
|
||||
|
||||
if conf.tamper:
|
||||
@@ -193,8 +183,8 @@ def _randomFillBlankFields(value):
|
||||
|
||||
if extractRegexResult(EMPTY_FORM_FIELDS_REGEX, value):
|
||||
message = "do you want to fill blank fields with random values? [Y/n] "
|
||||
|
||||
if readInput(message, default='Y', boolean=True):
|
||||
test = readInput(message, default="Y")
|
||||
if not test or test[0] in ("y", "Y"):
|
||||
for match in re.finditer(EMPTY_FORM_FIELDS_REGEX, retVal):
|
||||
item = match.group("result")
|
||||
if not any(_ in item for _ in IGNORE_PARAMETERS) and not re.search(ASP_NET_CONTROL_REGEX, item):
|
||||
@@ -234,7 +224,7 @@ def _saveToResultsFile():
|
||||
return
|
||||
|
||||
results = {}
|
||||
techniques = dict((_[1], _[0]) for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE))
|
||||
techniques = dict(map(lambda x: (x[1], x[0]), getPublicTypeMembers(PAYLOAD.TECHNIQUE)))
|
||||
|
||||
for injection in kb.injections + kb.falsePositives:
|
||||
if injection.place is None or injection.parameter is None:
|
||||
@@ -246,22 +236,15 @@ def _saveToResultsFile():
|
||||
|
||||
results[key].extend(injection.data.keys())
|
||||
|
||||
try:
|
||||
for key, value in results.items():
|
||||
place, parameter, notes = key
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
for key, value in results.items():
|
||||
place, parameter, notes = key
|
||||
line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(map(lambda x: techniques[x][0].upper(), sorted(value))), notes, os.linesep)
|
||||
conf.resultsFP.writelines(line)
|
||||
|
||||
if not results:
|
||||
line = "%s,,,,%s" % (conf.url, os.linesep)
|
||||
conf.resultsFP.write(line)
|
||||
if not results:
|
||||
line = "%s,,,,%s" % (conf.url, os.linesep)
|
||||
conf.resultsFP.writelines(line)
|
||||
|
||||
conf.resultsFP.flush()
|
||||
except IOError, ex:
|
||||
errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFilename, getSafeExString(ex))
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
@stackedmethod
|
||||
def start():
|
||||
"""
|
||||
This function calls a function that performs checks on both URL
|
||||
@@ -269,9 +252,6 @@ def start():
|
||||
check if they are dynamic and SQL injection affected
|
||||
"""
|
||||
|
||||
if conf.hashFile:
|
||||
crackHashFile(conf.hashFile)
|
||||
|
||||
if conf.direct:
|
||||
initTargetEnv()
|
||||
setupTargetEnv()
|
||||
@@ -296,28 +276,12 @@ def start():
|
||||
|
||||
for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets:
|
||||
try:
|
||||
|
||||
if conf.checkInternet:
|
||||
infoMsg = "checking for Internet connection"
|
||||
logger.info(infoMsg)
|
||||
|
||||
if not checkInternet():
|
||||
warnMsg = "[%s] [WARNING] no connection detected" % time.strftime("%X")
|
||||
dataToStdout(warnMsg)
|
||||
|
||||
while not checkInternet():
|
||||
dataToStdout('.')
|
||||
time.sleep(5)
|
||||
|
||||
dataToStdout("\n")
|
||||
|
||||
conf.url = targetUrl
|
||||
conf.method = targetMethod.upper() if targetMethod else targetMethod
|
||||
conf.data = targetData
|
||||
conf.cookie = targetCookie
|
||||
conf.httpHeaders = list(initialHeaders)
|
||||
conf.httpHeaders.extend(targetHeaders or [])
|
||||
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
||||
|
||||
initTargetEnv()
|
||||
parseTargetUrl()
|
||||
@@ -341,9 +305,7 @@ def start():
|
||||
message = "SQL injection vulnerability has already been detected "
|
||||
message += "against '%s'. Do you want to skip " % conf.hostname
|
||||
message += "further tests involving it? [Y/n]"
|
||||
|
||||
kb.skipVulnHost = readInput(message, default='Y', boolean=True)
|
||||
|
||||
kb.skipVulnHost = readInput(message, default="Y").upper() != 'N'
|
||||
testSqlInj = not kb.skipVulnHost
|
||||
|
||||
if not testSqlInj:
|
||||
@@ -357,7 +319,7 @@ def start():
|
||||
if conf.forms and conf.method:
|
||||
message = "[#%d] form:\n%s %s" % (hostCount, conf.method, targetUrl)
|
||||
else:
|
||||
message = "URL %d:\n%s %s" % (hostCount, HTTPMETHOD.GET, targetUrl)
|
||||
message = "URL %d:\n%s %s%s" % (hostCount, HTTPMETHOD.GET, targetUrl, " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork and conf.pageRank else "")
|
||||
|
||||
if conf.cookie:
|
||||
message += "\nCookie: %s" % conf.cookie
|
||||
@@ -370,13 +332,9 @@ def start():
|
||||
continue
|
||||
|
||||
message += "\ndo you want to test this form? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
test = readInput(message, default="Y")
|
||||
|
||||
if choice == 'N':
|
||||
continue
|
||||
elif choice == 'Q':
|
||||
break
|
||||
else:
|
||||
if not test or test[0] in ("y", "Y"):
|
||||
if conf.method != HTTPMETHOD.GET:
|
||||
message = "Edit %s data [default: %s]%s: " % (conf.method, urlencode(conf.data) if conf.data else "None", " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "")
|
||||
conf.data = readInput(message, default=conf.data)
|
||||
@@ -384,8 +342,9 @@ def start():
|
||||
conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data
|
||||
|
||||
else:
|
||||
if '?' in targetUrl:
|
||||
firstPart, secondPart = targetUrl.split('?', 1)
|
||||
if targetUrl.find("?") > -1:
|
||||
firstPart = targetUrl[:targetUrl.find("?")]
|
||||
secondPart = targetUrl[targetUrl.find("?") + 1:]
|
||||
message = "Edit GET data [default: %s]: " % secondPart
|
||||
test = readInput(message, default=secondPart)
|
||||
test = _randomFillBlankFields(test)
|
||||
@@ -393,14 +352,21 @@ def start():
|
||||
|
||||
parseTargetUrl()
|
||||
|
||||
elif test[0] in ("n", "N"):
|
||||
continue
|
||||
elif test[0] in ("q", "Q"):
|
||||
break
|
||||
|
||||
else:
|
||||
message += "\ndo you want to test this URL? [Y/n/q]"
|
||||
choice = readInput(message, default='Y').upper()
|
||||
test = readInput(message, default="Y")
|
||||
|
||||
if choice == 'N':
|
||||
if not test or test[0] in ("y", "Y"):
|
||||
pass
|
||||
elif test[0] in ("n", "N"):
|
||||
dataToStdout(os.linesep)
|
||||
continue
|
||||
elif choice == 'Q':
|
||||
elif test[0] in ("q", "Q"):
|
||||
break
|
||||
|
||||
infoMsg = "testing URL '%s'" % targetUrl
|
||||
@@ -419,7 +385,8 @@ def start():
|
||||
if conf.nullConnection:
|
||||
checkNullConnection()
|
||||
|
||||
if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) and (kb.injection.place is None or kb.injection.parameter is None):
|
||||
if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) \
|
||||
and (kb.injection.place is None or kb.injection.parameter is None):
|
||||
|
||||
if not any((conf.string, conf.notString, conf.regexp)) and PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech:
|
||||
# NOTE: this is not needed anymore, leaving only to display
|
||||
@@ -503,20 +470,14 @@ def start():
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif conf.paramExclude and (re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search(conf.paramExclude, parameter.split(' ')[-1], re.I)):
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping %s parameter '%s'" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
elif conf.csrfToken and re.search(conf.csrfToken, parameter, re.I):
|
||||
elif parameter == conf.csrfToken:
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "skipping anti-CSRF token parameter '%s'" % parameter
|
||||
logger.info(infoMsg)
|
||||
|
||||
# Ignore session-like parameters for --level < 4
|
||||
elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any(_ in parameter.lower() for _ in CSRF_TOKEN_PARAMETER_INFIXES) or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
|
||||
elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)):
|
||||
testSqlInj = False
|
||||
|
||||
infoMsg = "ignoring %s parameter '%s'" % (paramType, parameter)
|
||||
@@ -526,7 +487,7 @@ def start():
|
||||
check = checkDynParam(place, parameter, value)
|
||||
|
||||
if not check:
|
||||
warnMsg = "%s parameter '%s' does not appear to be dynamic" % (paramType, parameter)
|
||||
warnMsg = "%s parameter '%s' does not appear dynamic" % (paramType, parameter)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
if conf.skipStatic:
|
||||
@@ -535,7 +496,7 @@ def start():
|
||||
|
||||
testSqlInj = False
|
||||
else:
|
||||
infoMsg = "%s parameter '%s' appears to be dynamic" % (paramType, parameter)
|
||||
infoMsg = "%s parameter '%s' is dynamic" % (paramType, parameter)
|
||||
logger.info(infoMsg)
|
||||
|
||||
kb.testedParams.add(paramKey)
|
||||
@@ -576,14 +537,15 @@ def start():
|
||||
|
||||
msg = "%s parameter '%s' " % (injection.place, injection.parameter)
|
||||
msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] "
|
||||
test = readInput(msg, default="N")
|
||||
|
||||
if not readInput(msg, default='N', boolean=True):
|
||||
if test[0] not in ("y", "Y"):
|
||||
proceed = False
|
||||
paramKey = (conf.hostname, conf.path, None, None)
|
||||
kb.testedParams.add(paramKey)
|
||||
|
||||
if not injectable:
|
||||
warnMsg = "%s parameter '%s' does not seem to be " % (paramType, parameter)
|
||||
warnMsg = "%s parameter '%s' is not " % (paramType, parameter)
|
||||
warnMsg += "injectable"
|
||||
logger.warn(warnMsg)
|
||||
|
||||
@@ -597,11 +559,11 @@ def start():
|
||||
errMsg += "(e.g. GET parameter 'id' in 'www.site.com/index.php?id=1')"
|
||||
raise SqlmapNoneDataException(errMsg)
|
||||
else:
|
||||
errMsg = "all tested parameters do not appear to be injectable."
|
||||
errMsg = "all tested parameters appear to be not injectable."
|
||||
|
||||
if conf.level < 5 or conf.risk < 3:
|
||||
errMsg += " Try to increase values for '--level'/'--risk' options "
|
||||
errMsg += "if you wish to perform more tests."
|
||||
errMsg += " Try to increase '--level'/'--risk' values "
|
||||
errMsg += "to perform more tests."
|
||||
|
||||
if isinstance(conf.tech, list) and len(conf.tech) < 5:
|
||||
errMsg += " Rerun without providing the option '--technique'."
|
||||
@@ -624,9 +586,15 @@ def start():
|
||||
|
||||
if kb.heuristicTest == HEURISTIC_TEST.POSITIVE:
|
||||
errMsg += " As heuristic test turned out positive you are "
|
||||
errMsg += "strongly advised to continue on with the tests."
|
||||
errMsg += "strongly advised to continue on with the tests. "
|
||||
errMsg += "Please, consider usage of tampering scripts as "
|
||||
errMsg += "your target might filter the queries."
|
||||
|
||||
if conf.string:
|
||||
if not conf.string and not conf.notString and not conf.regexp:
|
||||
errMsg += " Also, you can try to rerun by providing "
|
||||
errMsg += "either a valid value for option '--string' "
|
||||
errMsg += "(or '--regexp')."
|
||||
elif conf.string:
|
||||
errMsg += " Also, you can try to rerun by providing a "
|
||||
errMsg += "valid value for option '--string' as perhaps the string you "
|
||||
errMsg += "have chosen does not match "
|
||||
@@ -639,11 +607,8 @@ def start():
|
||||
|
||||
if not conf.tamper:
|
||||
errMsg += " If you suspect that there is some kind of protection mechanism "
|
||||
errMsg += "involved (e.g. WAF) maybe you could try to use "
|
||||
errMsg += "option '--tamper' (e.g. '--tamper=space2comment')"
|
||||
|
||||
if not conf.randomAgent:
|
||||
errMsg += " and/or switch '--random-agent'"
|
||||
errMsg += "involved (e.g. WAF) maybe you could retry "
|
||||
errMsg += "with an option '--tamper' (e.g. '--tamper=space2comment')"
|
||||
|
||||
raise SqlmapNotVulnerableException(errMsg.rstrip('.'))
|
||||
else:
|
||||
@@ -658,7 +623,9 @@ def start():
|
||||
if kb.injection.place is not None and kb.injection.parameter is not None:
|
||||
if conf.multipleTargets:
|
||||
message = "do you want to exploit this SQL injection? [Y/n] "
|
||||
condition = readInput(message, default='Y', boolean=True)
|
||||
exploit = readInput(message, default="Y")
|
||||
|
||||
condition = not exploit or exploit[0] in ("y", "Y")
|
||||
else:
|
||||
condition = True
|
||||
|
||||
@@ -671,18 +638,17 @@ def start():
|
||||
logger.warn(warnMsg)
|
||||
|
||||
message = "do you want to skip to the next target in list? [Y/n/q]"
|
||||
choice = readInput(message, default='Y').upper()
|
||||
test = readInput(message, default="Y")
|
||||
|
||||
if choice == 'N':
|
||||
if not test or test[0] in ("y", "Y"):
|
||||
pass
|
||||
elif test[0] in ("n", "N"):
|
||||
return False
|
||||
elif choice == 'Q':
|
||||
elif test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
raise
|
||||
|
||||
except SqlmapSkipTargetException:
|
||||
pass
|
||||
|
||||
except SqlmapUserQuitException:
|
||||
raise
|
||||
|
||||
@@ -696,7 +662,7 @@ def start():
|
||||
_saveToResultsFile()
|
||||
|
||||
errMsg += ", skipping to the next %s" % ("form" if conf.forms else "URL")
|
||||
logger.error(errMsg.lstrip(", "))
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.critical(errMsg)
|
||||
return False
|
||||
|
||||
+35
-59
@@ -1,16 +1,16 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.common import Backend
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.dicts import DBMS_DICT
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.settings import MSSQL_ALIASES
|
||||
from lib.core.settings import MYSQL_ALIASES
|
||||
from lib.core.settings import ORACLE_ALIASES
|
||||
@@ -22,8 +22,6 @@ from lib.core.settings import MAXDB_ALIASES
|
||||
from lib.core.settings import SYBASE_ALIASES
|
||||
from lib.core.settings import DB2_ALIASES
|
||||
from lib.core.settings import HSQLDB_ALIASES
|
||||
from lib.core.settings import H2_ALIASES
|
||||
from lib.core.settings import INFORMIX_ALIASES
|
||||
from lib.utils.sqlalchemy import SQLAlchemy
|
||||
|
||||
from plugins.dbms.mssqlserver import MSSQLServerMap
|
||||
@@ -48,10 +46,6 @@ from plugins.dbms.db2 import DB2Map
|
||||
from plugins.dbms.db2.connector import Connector as DB2Conn
|
||||
from plugins.dbms.hsqldb import HSQLDBMap
|
||||
from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn
|
||||
from plugins.dbms.h2 import H2Map
|
||||
from plugins.dbms.h2.connector import Connector as H2Conn
|
||||
from plugins.dbms.informix import InformixMap
|
||||
from plugins.dbms.informix.connector import Connector as InformixConn
|
||||
|
||||
def setHandler():
|
||||
"""
|
||||
@@ -60,76 +54,58 @@ def setHandler():
|
||||
"""
|
||||
|
||||
items = [
|
||||
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
|
||||
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
|
||||
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
|
||||
(DBMS.MSSQL, MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn),
|
||||
(DBMS.SQLITE, SQLITE_ALIASES, SQLiteMap, SQLiteConn),
|
||||
(DBMS.ACCESS, ACCESS_ALIASES, AccessMap, AccessConn),
|
||||
(DBMS.FIREBIRD, FIREBIRD_ALIASES, FirebirdMap, FirebirdConn),
|
||||
(DBMS.MAXDB, MAXDB_ALIASES, MaxDBMap, MaxDBConn),
|
||||
(DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
|
||||
(DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
|
||||
(DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
|
||||
(DBMS.H2, H2_ALIASES, H2Map, H2Conn),
|
||||
(DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
|
||||
]
|
||||
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
|
||||
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
|
||||
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
|
||||
(DBMS.MSSQL, MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn),
|
||||
(DBMS.SQLITE, SQLITE_ALIASES, SQLiteMap, SQLiteConn),
|
||||
(DBMS.ACCESS, ACCESS_ALIASES, AccessMap, AccessConn),
|
||||
(DBMS.FIREBIRD, FIREBIRD_ALIASES, FirebirdMap, FirebirdConn),
|
||||
(DBMS.MAXDB, MAXDB_ALIASES, MaxDBMap, MaxDBConn),
|
||||
(DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
|
||||
(DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
|
||||
(DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
|
||||
]
|
||||
|
||||
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else None for _ in items)
|
||||
_ = max(_ if (Backend.getIdentifiedDbms() or "").lower() in _[1] else None for _ in items)
|
||||
if _:
|
||||
items.remove(_)
|
||||
items.insert(0, _)
|
||||
|
||||
for dbms, aliases, Handler, Connector in items:
|
||||
if conf.forceDbms:
|
||||
if conf.forceDbms.lower() not in aliases:
|
||||
continue
|
||||
else:
|
||||
kb.dbms = conf.dbms = conf.forceDbms = dbms
|
||||
|
||||
if kb.dbmsFilter:
|
||||
if dbms not in kb.dbmsFilter:
|
||||
continue
|
||||
if conf.dbms and conf.dbms.lower() != dbms and conf.dbms.lower() not in aliases:
|
||||
debugMsg = "skipping test for %s" % dbms
|
||||
logger.debug(debugMsg)
|
||||
continue
|
||||
|
||||
handler = Handler()
|
||||
conf.dbmsConnector = Connector()
|
||||
|
||||
if conf.direct:
|
||||
exception = None
|
||||
logger.debug("forcing timeout to 10 seconds")
|
||||
conf.timeout = 10
|
||||
|
||||
dialect = DBMS_DICT[dbms][3]
|
||||
|
||||
if dialect:
|
||||
try:
|
||||
sqlalchemy = SQLAlchemy(dialect=dialect)
|
||||
sqlalchemy.connect()
|
||||
sqlalchemy = SQLAlchemy(dialect=dialect)
|
||||
sqlalchemy.connect()
|
||||
|
||||
if sqlalchemy.connector:
|
||||
conf.dbmsConnector = sqlalchemy
|
||||
except Exception, ex:
|
||||
exception = ex
|
||||
if sqlalchemy.connector:
|
||||
conf.dbmsConnector = sqlalchemy
|
||||
else:
|
||||
try:
|
||||
conf.dbmsConnector.connect()
|
||||
except NameError:
|
||||
pass
|
||||
else:
|
||||
conf.dbmsConnector.connect()
|
||||
|
||||
if not dialect or exception:
|
||||
try:
|
||||
conf.dbmsConnector.connect()
|
||||
except Exception, ex:
|
||||
if exception:
|
||||
raise exception
|
||||
else:
|
||||
if not isinstance(ex, NameError):
|
||||
raise
|
||||
else:
|
||||
msg = "support for direct connection to '%s' is not available. " % dbms
|
||||
msg += "Please rerun with '--dependencies'"
|
||||
raise SqlmapConnectionException(msg)
|
||||
|
||||
if conf.forceDbms == dbms or handler.checkDbms():
|
||||
if handler.checkDbms():
|
||||
if kb.resolutionDbms:
|
||||
conf.dbmsHandler = max(_ for _ in items if _[0] == kb.resolutionDbms)[2]()
|
||||
conf.dbmsHandler._dbms = kb.resolutionDbms
|
||||
else:
|
||||
conf.dbmsHandler = handler
|
||||
conf.dbmsHandler._dbms = dbms
|
||||
|
||||
break
|
||||
else:
|
||||
conf.dbmsConnector = None
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
+79
-107
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import re
|
||||
@@ -36,15 +36,13 @@ from lib.core.enums import POST_HINT
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
||||
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
||||
from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
|
||||
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import GENERIC_SQL_COMMENT
|
||||
from lib.core.settings import INFERENCE_MARKER
|
||||
from lib.core.settings import NULL
|
||||
from lib.core.settings import PAYLOAD_DELIMITER
|
||||
from lib.core.settings import REPLACEMENT_MARKER
|
||||
from lib.core.settings import SINGLE_QUOTE_MARKER
|
||||
from lib.core.settings import SLEEP_TIME_MARKER
|
||||
from lib.core.unescaper import unescaper
|
||||
|
||||
class Agent(object):
|
||||
@@ -64,7 +62,7 @@ class Agent(object):
|
||||
|
||||
if Backend.getIdentifiedDbms() in (DBMS.ORACLE,): # non-standard object(s) make problems to a database connector while returned (e.g. XMLTYPE)
|
||||
_, _, _, _, _, _, fieldsToCastStr, _ = self.getFields(query)
|
||||
for field in fieldsToCastStr.split(','):
|
||||
for field in fieldsToCastStr.split(","):
|
||||
query = query.replace(field, self.nullAndCastField(field))
|
||||
|
||||
if kb.tamperFunctions:
|
||||
@@ -98,33 +96,32 @@ class Agent(object):
|
||||
paramString = conf.parameters[place]
|
||||
paramDict = conf.paramDict[place]
|
||||
origValue = getUnicode(paramDict[parameter])
|
||||
newValue = getUnicode(newValue) if newValue else newValue
|
||||
|
||||
if place == PLACE.URI or BOUNDED_INJECTION_MARKER in origValue:
|
||||
paramString = origValue
|
||||
if place == PLACE.URI:
|
||||
origValue = origValue.split(kb.customInjectionMark)[0]
|
||||
origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
|
||||
else:
|
||||
origValue = filter(None, (re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z")))[0].group(0)
|
||||
origValue = origValue[origValue.rfind('/') + 1:]
|
||||
for char in ('?', '=', ':', ','):
|
||||
for char in ('?', '=', ':'):
|
||||
if char in origValue:
|
||||
origValue = origValue[origValue.rfind(char) + 1:]
|
||||
elif place == PLACE.CUSTOM_POST:
|
||||
paramString = origValue
|
||||
origValue = origValue.split(kb.customInjectionMark)[0]
|
||||
origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
|
||||
if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML):
|
||||
origValue = origValue.split('>')[-1]
|
||||
elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE):
|
||||
origValue = extractRegexResult(r"(?s)\"\s*:\s*(?P<result>\d+\Z)", origValue) or extractRegexResult(r'(?s)[\s:]*(?P<result>[^"\[,]+\Z)', origValue)
|
||||
origValue = extractRegexResult(r"(?s)\"\s*:\s*(?P<result>\d+\Z)", origValue) or extractRegexResult(r'(?s)\s*(?P<result>[^"\[,]+\Z)', origValue)
|
||||
else:
|
||||
_ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
|
||||
origValue = _.split('=', 1)[1] if '=' in _ else ""
|
||||
elif place == PLACE.CUSTOM_HEADER:
|
||||
paramString = origValue
|
||||
origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
|
||||
origValue = origValue[origValue.find(',') + 1:]
|
||||
origValue = origValue.split(kb.customInjectionMark)[0]
|
||||
match = re.search(r"([^;]+)=(?P<value>[^;]*);?\Z", origValue)
|
||||
match = re.search(r"([^;]+)=(?P<value>[^;]+);?\Z", origValue)
|
||||
if match:
|
||||
origValue = match.group("value")
|
||||
elif ',' in paramString:
|
||||
@@ -133,17 +130,15 @@ class Agent(object):
|
||||
if header.upper() == HTTP_HEADER.AUTHORIZATION.upper():
|
||||
origValue = origValue.split(' ')[-1].split(':')[-1]
|
||||
|
||||
origValue = origValue or ""
|
||||
|
||||
if value is None:
|
||||
if where == PAYLOAD.WHERE.ORIGINAL:
|
||||
value = origValue
|
||||
elif where == PAYLOAD.WHERE.NEGATIVE:
|
||||
if conf.invalidLogical:
|
||||
match = re.search(r"\A[^ ]+", newValue)
|
||||
match = re.search(r'\A[^ ]+', newValue)
|
||||
newValue = newValue[len(match.group() if match else ""):]
|
||||
_ = randomInt(2)
|
||||
value = "%s%s AND %s LIKE %s" % (origValue, match.group() if match else "", _, _ + 1)
|
||||
value = "%s%s AND %s=%s" % (origValue, match.group() if match else "", _, _ + 1)
|
||||
elif conf.invalidBignum:
|
||||
value = randomInt(6)
|
||||
elif conf.invalidString:
|
||||
@@ -163,16 +158,17 @@ class Agent(object):
|
||||
newValue = self.cleanupPayload(newValue, origValue)
|
||||
|
||||
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
||||
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
||||
_ = "%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR)
|
||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and not '"%s"' % _ in paramString:
|
||||
newValue = '"%s"' % newValue
|
||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and not "'%s'" % _ in paramString:
|
||||
newValue = "'%s'" % newValue
|
||||
newValue = newValue.replace(kb.customInjectionMark, REPLACEMENT_MARKER)
|
||||
newValue = newValue.replace(CUSTOM_INJECTION_MARK_CHAR, REPLACEMENT_MARKER)
|
||||
retVal = paramString.replace(_, self.addPayloadDelimiters(newValue))
|
||||
retVal = retVal.replace(kb.customInjectionMark, "").replace(REPLACEMENT_MARKER, kb.customInjectionMark)
|
||||
retVal = retVal.replace(CUSTOM_INJECTION_MARK_CHAR, "").replace(REPLACEMENT_MARKER, CUSTOM_INJECTION_MARK_CHAR)
|
||||
elif BOUNDED_INJECTION_MARKER in paramDict[parameter]:
|
||||
retVal = paramString.replace("%s%s" % (origValue, BOUNDED_INJECTION_MARKER), self.addPayloadDelimiters(newValue))
|
||||
_ = "%s%s" % (origValue, BOUNDED_INJECTION_MARKER)
|
||||
retVal = "%s=%s" % (re.sub(r" (\#\d\*|\(.+\))\Z", "", parameter), paramString.replace(_, self.addPayloadDelimiters(newValue)))
|
||||
elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST):
|
||||
retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
|
||||
else:
|
||||
@@ -199,7 +195,7 @@ class Agent(object):
|
||||
regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "")
|
||||
retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
|
||||
else:
|
||||
retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
|
||||
retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), "%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
|
||||
|
||||
if retVal == paramString and urlencode(parameter) != parameter:
|
||||
retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString)
|
||||
@@ -209,6 +205,16 @@ class Agent(object):
|
||||
|
||||
return retVal
|
||||
|
||||
def fullPayload(self, query):
|
||||
if conf.direct:
|
||||
return self.payloadDirect(query)
|
||||
|
||||
query = self.prefixQuery(query)
|
||||
query = self.suffixQuery(query)
|
||||
payload = self.payload(newValue=query)
|
||||
|
||||
return payload
|
||||
|
||||
def prefixQuery(self, expression, prefix=None, where=None, clause=None):
|
||||
"""
|
||||
This method defines how the input expression has to be escaped
|
||||
@@ -247,9 +253,6 @@ class Agent(object):
|
||||
else:
|
||||
query = kb.injection.prefix or prefix or ""
|
||||
|
||||
if "SELECT '[RANDSTR]'" in query: # escaping of pre-WHERE prefixes
|
||||
query = query.replace("'[RANDSTR]'", unescaper.escape(randomStr(), quote=False))
|
||||
|
||||
if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('):
|
||||
query += " "
|
||||
|
||||
@@ -292,37 +295,29 @@ class Agent(object):
|
||||
elif suffix and not comment:
|
||||
expression += suffix.replace('\\', BOUNDARY_BACKSLASH_MARKER)
|
||||
|
||||
return re.sub(r";\W*;", ";", expression)
|
||||
return re.sub(r"(?s);\W*;", ";", expression)
|
||||
|
||||
def cleanupPayload(self, payload, origValue=None):
|
||||
if payload is None:
|
||||
return
|
||||
|
||||
replacements = (
|
||||
("[DELIMITER_START]", kb.chars.start),
|
||||
("[DELIMITER_STOP]", kb.chars.stop),
|
||||
("[AT_REPLACE]", kb.chars.at),
|
||||
("[SPACE_REPLACE]", kb.chars.space),
|
||||
("[DOLLAR_REPLACE]", kb.chars.dollar),
|
||||
("[HASH_REPLACE]", kb.chars.hash_),
|
||||
("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
|
||||
)
|
||||
payload = reduce(lambda x, y: x.replace(y[0], y[1]), replacements, payload)
|
||||
_ = (
|
||||
("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\
|
||||
("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\
|
||||
("[HASH_REPLACE]", kb.chars.hash_), ("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
|
||||
)
|
||||
payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload)
|
||||
|
||||
for _ in set(re.findall(r"(?i)\[RANDNUM(?:\d+)?\]", payload)):
|
||||
for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)):
|
||||
payload = payload.replace(_, str(randomInt()))
|
||||
|
||||
for _ in set(re.findall(r"(?i)\[RANDSTR(?:\d+)?\]", payload)):
|
||||
for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)):
|
||||
payload = payload.replace(_, randomStr())
|
||||
|
||||
if origValue is not None:
|
||||
origValue = getUnicode(origValue)
|
||||
if "[ORIGVALUE]" in payload:
|
||||
payload = getUnicode(payload).replace("[ORIGVALUE]", origValue if origValue.isdigit() else unescaper.escape("'%s'" % origValue))
|
||||
if "[ORIGINAL]" in payload:
|
||||
payload = getUnicode(payload).replace("[ORIGINAL]", origValue)
|
||||
if origValue is not None and "[ORIGVALUE]" in payload:
|
||||
payload = getUnicode(payload).replace("[ORIGVALUE]", origValue if origValue.isdigit() else unescaper.escape("'%s'" % origValue))
|
||||
|
||||
if INFERENCE_MARKER in payload:
|
||||
if "[INFERENCE]" in payload:
|
||||
if Backend.getIdentifiedDbms() is not None:
|
||||
inference = queries[Backend.getIdentifiedDbms()].inference
|
||||
|
||||
@@ -334,7 +329,7 @@ class Agent(object):
|
||||
else:
|
||||
inferenceQuery = inference.query
|
||||
|
||||
payload = payload.replace(INFERENCE_MARKER, inferenceQuery)
|
||||
payload = payload.replace("[INFERENCE]", inferenceQuery)
|
||||
elif not kb.testMode:
|
||||
errMsg = "invalid usage of inference payload without "
|
||||
errMsg += "knowledge of underlying DBMS"
|
||||
@@ -348,14 +343,7 @@ class Agent(object):
|
||||
"""
|
||||
|
||||
if payload:
|
||||
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
||||
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
||||
|
||||
for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)):
|
||||
payload = payload.replace(_, str(randomInt()))
|
||||
|
||||
for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)):
|
||||
payload = payload.replace(_, randomStr())
|
||||
payload = payload.replace("[SLEEPTIME]", str(conf.timeSec))
|
||||
|
||||
return payload
|
||||
|
||||
@@ -374,7 +362,7 @@ class Agent(object):
|
||||
rootQuery = queries[Backend.getIdentifiedDbms()]
|
||||
hexField = field
|
||||
|
||||
if "hex" in rootQuery:
|
||||
if 'hex' in rootQuery:
|
||||
hexField = rootQuery.hex.query % field
|
||||
else:
|
||||
warnMsg = "switch '--hex' is currently not supported on DBMS %s" % Backend.getIdentifiedDbms()
|
||||
@@ -463,7 +451,7 @@ class Agent(object):
|
||||
@rtype: C{str}
|
||||
"""
|
||||
|
||||
if not Backend.getIdentifiedDbms():
|
||||
if not Backend.getDbms():
|
||||
return fields
|
||||
|
||||
if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith("MID(") or re.search(r"\A'[^']+'\Z", fields):
|
||||
@@ -498,7 +486,7 @@ class Agent(object):
|
||||
@rtype: C{str}
|
||||
"""
|
||||
|
||||
prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT(?: \d+)?)\s+\d+)*"
|
||||
prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT \d+)\s+\d+)*"
|
||||
fieldsSelectTop = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I)
|
||||
fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I)
|
||||
fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I)
|
||||
@@ -519,31 +507,29 @@ class Agent(object):
|
||||
if fieldsSubstr:
|
||||
fieldsToCastStr = query
|
||||
elif fieldsMinMaxstr:
|
||||
fieldsToCastStr = fieldsMinMaxstr.group(1)
|
||||
fieldsToCastStr = fieldsMinMaxstr.groups()[0]
|
||||
elif fieldsExists:
|
||||
if fieldsSelect:
|
||||
fieldsToCastStr = fieldsSelect.group(1)
|
||||
fieldsToCastStr = fieldsSelect.groups()[0]
|
||||
elif fieldsSelectTop:
|
||||
fieldsToCastStr = fieldsSelectTop.group(1)
|
||||
fieldsToCastStr = fieldsSelectTop.groups()[0]
|
||||
elif fieldsSelectRownum:
|
||||
fieldsToCastStr = fieldsSelectRownum.group(1)
|
||||
fieldsToCastStr = fieldsSelectRownum.groups()[0]
|
||||
elif fieldsSelectDistinct:
|
||||
if Backend.getDbms() in (DBMS.HSQLDB,):
|
||||
fieldsToCastStr = fieldsNoSelect
|
||||
else:
|
||||
fieldsToCastStr = fieldsSelectDistinct.group(1)
|
||||
fieldsToCastStr = fieldsSelectDistinct.groups()[0]
|
||||
elif fieldsSelectCase:
|
||||
fieldsToCastStr = fieldsSelectCase.group(1)
|
||||
fieldsToCastStr = fieldsSelectCase.groups()[0]
|
||||
elif fieldsSelectFrom:
|
||||
fieldsToCastStr = query[:unArrayizeValue(_)] if _ else query
|
||||
fieldsToCastStr = re.sub(r"\ASELECT%s\s+" % prefixRegex, "", fieldsToCastStr)
|
||||
elif fieldsSelect:
|
||||
fieldsToCastStr = fieldsSelect.group(1)
|
||||
|
||||
fieldsToCastStr = fieldsToCastStr or ""
|
||||
fieldsToCastStr = fieldsSelect.groups()[0]
|
||||
|
||||
# Function
|
||||
if re.search(r"\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr:
|
||||
if re.search("\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr:
|
||||
fieldsToCastList = [fieldsToCastStr]
|
||||
else:
|
||||
fieldsToCastList = splitFields(fieldsToCastStr)
|
||||
@@ -624,7 +610,7 @@ class Agent(object):
|
||||
elif fieldsNoSelect:
|
||||
concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
|
||||
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2):
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB):
|
||||
if fieldsExists:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
concatenatedQuery += "||'%s'" % kb.chars.stop
|
||||
@@ -635,7 +621,7 @@ class Agent(object):
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
_ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM "))
|
||||
concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:])
|
||||
concatenatedQuery = re.sub(r"('%s'\|\|)(.+)(%s)" % (kb.chars.start, re.escape(castedFields)), r"\g<2>\g<1>\g<3>", concatenatedQuery)
|
||||
concatenatedQuery = re.sub(r"('%s'\|\|)(.+)(%s)" % (kb.chars.start, re.escape(castedFields)), "\g<2>\g<1>\g<3>", concatenatedQuery)
|
||||
elif fieldsSelect:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
concatenatedQuery += "||'%s'" % kb.chars.stop
|
||||
@@ -647,7 +633,7 @@ class Agent(object):
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1)
|
||||
concatenatedQuery += "+'%s'" % kb.chars.stop
|
||||
elif fieldsSelectTop:
|
||||
topNum = re.search(r"\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1)
|
||||
topNum = re.search("\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1)
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT TOP %s " % topNum, "TOP %s '%s'+" % (topNum, kb.chars.start), 1)
|
||||
concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1)
|
||||
elif fieldsSelectCase:
|
||||
@@ -681,23 +667,24 @@ class Agent(object):
|
||||
concatenatedQuery = "'%s'&%s&'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
|
||||
|
||||
else:
|
||||
warnMsg = "applying generic concatenation (CONCAT)"
|
||||
warnMsg = "applying generic concatenation with double pipes ('||')"
|
||||
singleTimeWarnMessage(warnMsg)
|
||||
|
||||
if fieldsExists:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
|
||||
concatenatedQuery += "),'%s')" % kb.chars.stop
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
concatenatedQuery += "||'%s'" % kb.chars.stop
|
||||
elif fieldsSelectCase:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
|
||||
concatenatedQuery += "),'%s')" % kb.chars.stop
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||(SELECT " % kb.chars.start, 1)
|
||||
concatenatedQuery += ")||'%s'" % kb.chars.stop
|
||||
elif fieldsSelectFrom:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
_ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM "))
|
||||
concatenatedQuery = "%s),'%s')%s" % (concatenatedQuery[:_].replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, concatenatedQuery[_:])
|
||||
concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:])
|
||||
elif fieldsSelect:
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1)
|
||||
concatenatedQuery += "),'%s')" % kb.chars.stop
|
||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1)
|
||||
concatenatedQuery += "||'%s'" % kb.chars.stop
|
||||
elif fieldsNoSelect:
|
||||
concatenatedQuery = "CONCAT(CONCAT('%s',%s),'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
|
||||
concatenatedQuery = "'%s'||%s||'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop)
|
||||
|
||||
return concatenatedQuery
|
||||
|
||||
@@ -759,13 +746,13 @@ class Agent(object):
|
||||
if fromTable and query.endswith(fromTable):
|
||||
query = query[:-len(fromTable)]
|
||||
|
||||
topNumRegex = re.search(r"\ATOP\s+([\d]+)\s+", query, re.I)
|
||||
topNumRegex = re.search("\ATOP\s+([\d]+)\s+", query, re.I)
|
||||
if topNumRegex:
|
||||
topNum = topNumRegex.group(1)
|
||||
query = query[len("TOP %s " % topNum):]
|
||||
unionQuery += "TOP %s " % topNum
|
||||
|
||||
intoRegExp = re.search(r"(\s+INTO (DUMP|OUT)FILE\s+'(.+?)')", query, re.I)
|
||||
intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I)
|
||||
|
||||
if intoRegExp:
|
||||
intoRegExp = intoRegExp.group(1)
|
||||
@@ -813,7 +800,7 @@ class Agent(object):
|
||||
stopLimit = None
|
||||
limitCond = True
|
||||
|
||||
topLimit = re.search(r"TOP\s+([\d]+)\s+", expression, re.I)
|
||||
topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)
|
||||
|
||||
limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I)
|
||||
|
||||
@@ -823,7 +810,7 @@ class Agent(object):
|
||||
limitRegExp2 = None
|
||||
|
||||
if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
|
||||
limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
|
||||
limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
|
||||
|
||||
@@ -868,7 +855,7 @@ class Agent(object):
|
||||
if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0:
|
||||
_ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query)
|
||||
else:
|
||||
_ = re.search(r"\bLIMIT\b", expression, re.I).start()
|
||||
_ = expression.index("LIMIT ")
|
||||
expression = expression[:_]
|
||||
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
|
||||
@@ -913,14 +900,14 @@ class Agent(object):
|
||||
fromFrom = limitedQuery[fromIndex + 1:]
|
||||
orderBy = None
|
||||
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2):
|
||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE):
|
||||
limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
|
||||
limitedQuery += " %s" % limitStr
|
||||
|
||||
elif Backend.isDbms(DBMS.HSQLDB):
|
||||
match = re.search(r"ORDER BY [^ ]+", limitedQuery)
|
||||
if match:
|
||||
limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip()
|
||||
limitedQuery = re.sub(r"\s*%s\s*" % match.group(0), " ", limitedQuery).strip()
|
||||
limitedQuery += " %s" % match.group(0)
|
||||
|
||||
if query.startswith("SELECT "):
|
||||
@@ -940,7 +927,7 @@ class Agent(object):
|
||||
limitedQuery += " %s" % limitStr
|
||||
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
|
||||
if " ORDER BY " not in limitedQuery:
|
||||
if not " ORDER BY " in limitedQuery:
|
||||
limitStr = limitStr.replace(") WHERE LIMIT", " ORDER BY 1 ASC) WHERE LIMIT")
|
||||
elif " ORDER BY " in limitedQuery and "SELECT " in limitedQuery:
|
||||
limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]
|
||||
@@ -961,7 +948,7 @@ class Agent(object):
|
||||
orderBy = limitedQuery[limitedQuery.index(" ORDER BY "):]
|
||||
limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]
|
||||
|
||||
notDistincts = re.findall(r"DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I)
|
||||
notDistincts = re.findall("DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I)
|
||||
|
||||
for notDistinct in notDistincts:
|
||||
limitedQuery = limitedQuery.replace("DISTINCT(%s)" % notDistinct, notDistinct)
|
||||
@@ -978,7 +965,7 @@ class Agent(object):
|
||||
limitedQuery = limitedQuery.replace(" (SELECT TOP %s" % startTopNums, " (SELECT TOP %d" % num)
|
||||
forgeNotIn = False
|
||||
else:
|
||||
topNum = re.search(r"TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1)
|
||||
topNum = re.search("TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1)
|
||||
limitedQuery = limitedQuery.replace("TOP %s " % topNum, "")
|
||||
|
||||
if forgeNotIn:
|
||||
@@ -994,7 +981,7 @@ class Agent(object):
|
||||
limitedQuery += "NOT IN (%s" % (limitStr % num)
|
||||
limitedQuery += "%s %s ORDER BY %s) ORDER BY %s" % (self.nullAndCastField(uniqueField or field), fromFrom, uniqueField or "1", uniqueField or "1")
|
||||
else:
|
||||
match = re.search(r" ORDER BY (\w+)\Z", query)
|
||||
match = re.search(" ORDER BY (\w+)\Z", query)
|
||||
field = match.group(1) if match else field
|
||||
|
||||
if " WHERE " in limitedQuery:
|
||||
@@ -1074,7 +1061,7 @@ class Agent(object):
|
||||
"""
|
||||
|
||||
_ = re.escape(PAYLOAD_DELIMITER)
|
||||
return extractRegexResult(r"(?s)%s(?P<result>.*?)%s" % (_, _), value)
|
||||
return extractRegexResult("(?s)%s(?P<result>.*?)%s" % (_, _), value)
|
||||
|
||||
def replacePayload(self, value, payload):
|
||||
"""
|
||||
@@ -1082,7 +1069,7 @@ class Agent(object):
|
||||
"""
|
||||
|
||||
_ = re.escape(PAYLOAD_DELIMITER)
|
||||
return re.sub(r"(?s)(%s.*?%s)" % (_, _), ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), value) if value else value
|
||||
return re.sub("(?s)(%s.*?%s)" % (_, _), ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), value) if value else value
|
||||
|
||||
def runAsDBMSUser(self, query):
|
||||
if conf.dbmsCred and "Ad Hoc Distributed Queries" not in query:
|
||||
@@ -1090,20 +1077,5 @@ class Agent(object):
|
||||
|
||||
return query
|
||||
|
||||
def whereQuery(self, query):
|
||||
if conf.dumpWhere and query:
|
||||
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
|
||||
|
||||
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
||||
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
||||
elif re.search(r"(?i)\bWHERE\b", prefix):
|
||||
prefix += " AND %s" % conf.dumpWhere
|
||||
else:
|
||||
prefix += " WHERE %s" % conf.dumpWhere
|
||||
|
||||
query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix
|
||||
|
||||
return query
|
||||
|
||||
# SQL agent
|
||||
agent = Agent()
|
||||
|
||||
+19
-32
@@ -1,16 +1,15 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
try:
|
||||
import cPickle as pickle
|
||||
import cPickle as pickle
|
||||
except:
|
||||
import pickle
|
||||
import pickle
|
||||
|
||||
import bz2
|
||||
import itertools
|
||||
import os
|
||||
import sys
|
||||
@@ -19,7 +18,6 @@ import tempfile
|
||||
from lib.core.enums import MKSTEMP_PREFIX
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.settings import BIGARRAY_CHUNK_SIZE
|
||||
from lib.core.settings import BIGARRAY_COMPRESS_LEVEL
|
||||
|
||||
DEFAULT_SIZE_OF = sys.getsizeof(object())
|
||||
|
||||
@@ -29,12 +27,10 @@ def _size_of(object_):
|
||||
"""
|
||||
|
||||
retval = sys.getsizeof(object_, DEFAULT_SIZE_OF)
|
||||
|
||||
if isinstance(object_, dict):
|
||||
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items()))
|
||||
elif hasattr(object_, "__iter__"):
|
||||
retval += sum(_size_of(_) for _ in object_)
|
||||
|
||||
return retval
|
||||
|
||||
class Cache(object):
|
||||
@@ -52,7 +48,7 @@ class BigArray(list):
|
||||
List-like class used for storing large amounts of data (disk cached)
|
||||
"""
|
||||
|
||||
def __init__(self, items=[]):
|
||||
def __init__(self):
|
||||
self.chunks = [[]]
|
||||
self.chunk_length = sys.maxint
|
||||
self.cache = None
|
||||
@@ -60,18 +56,13 @@ class BigArray(list):
|
||||
self._os_remove = os.remove
|
||||
self._size_counter = 0
|
||||
|
||||
for item in items:
|
||||
self.append(item)
|
||||
|
||||
def append(self, value):
|
||||
self.chunks[-1].append(value)
|
||||
|
||||
if self.chunk_length == sys.maxint:
|
||||
self._size_counter += _size_of(value)
|
||||
if self._size_counter >= BIGARRAY_CHUNK_SIZE:
|
||||
self.chunk_length = len(self.chunks[-1])
|
||||
self._size_counter = None
|
||||
|
||||
if len(self.chunks[-1]) >= self.chunk_length:
|
||||
filename = self._dump(self.chunks[-1])
|
||||
self.chunks[-1] = filename
|
||||
@@ -85,20 +76,18 @@ class BigArray(list):
|
||||
if len(self.chunks[-1]) < 1:
|
||||
self.chunks.pop()
|
||||
try:
|
||||
with open(self.chunks[-1], "rb") as f:
|
||||
self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
|
||||
with open(self.chunks[-1], "rb") as fp:
|
||||
self.chunks[-1] = pickle.load(fp)
|
||||
except IOError, ex:
|
||||
errMsg = "exception occurred while retrieving data "
|
||||
errMsg += "from a temporary file ('%s')" % ex.message
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
raise SqlmapSystemException, errMsg
|
||||
return self.chunks[-1].pop()
|
||||
|
||||
def index(self, value):
|
||||
for index in xrange(len(self)):
|
||||
if self[index] == value:
|
||||
return index
|
||||
|
||||
return ValueError, "%s is not in list" % value
|
||||
|
||||
def _dump(self, chunk):
|
||||
@@ -106,8 +95,8 @@ class BigArray(list):
|
||||
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.BIG_ARRAY)
|
||||
self.filenames.add(filename)
|
||||
os.close(handle)
|
||||
with open(filename, "w+b") as f:
|
||||
f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
||||
with open(filename, "w+b") as fp:
|
||||
pickle.dump(chunk, fp, pickle.HIGHEST_PROTOCOL)
|
||||
return filename
|
||||
except (OSError, IOError), ex:
|
||||
errMsg = "exception occurred while storing data "
|
||||
@@ -115,21 +104,20 @@ class BigArray(list):
|
||||
errMsg += "make sure that there is enough disk space left. If problem persists, "
|
||||
errMsg += "try to set environment variable 'TEMP' to a location "
|
||||
errMsg += "writeable by the current user"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
raise SqlmapSystemException, errMsg
|
||||
|
||||
def _checkcache(self, index):
|
||||
if (self.cache and self.cache.index != index and self.cache.dirty):
|
||||
filename = self._dump(self.cache.data)
|
||||
self.chunks[self.cache.index] = filename
|
||||
|
||||
if not (self.cache and self.cache.index == index):
|
||||
try:
|
||||
with open(self.chunks[index], "rb") as f:
|
||||
self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
|
||||
except Exception, ex:
|
||||
with open(self.chunks[index], "rb") as fp:
|
||||
self.cache = Cache(index, pickle.load(fp), False)
|
||||
except IOError, ex:
|
||||
errMsg = "exception occurred while retrieving data "
|
||||
errMsg += "from a temporary file ('%s')" % ex.message
|
||||
raise SqlmapSystemException(errMsg)
|
||||
raise SqlmapSystemException, errMsg
|
||||
|
||||
def __getstate__(self):
|
||||
return self.chunks, self.filenames
|
||||
@@ -139,19 +127,19 @@ class BigArray(list):
|
||||
self.chunks, self.filenames = state
|
||||
|
||||
def __getslice__(self, i, j):
|
||||
retval = BigArray()
|
||||
i = max(0, len(self) + i if i < 0 else i)
|
||||
j = min(len(self), len(self) + j if j < 0 else j)
|
||||
|
||||
return BigArray(self[_] for _ in xrange(i, j))
|
||||
for _ in xrange(i, j):
|
||||
retval.append(self[_])
|
||||
return retval
|
||||
|
||||
def __getitem__(self, y):
|
||||
if y < 0:
|
||||
y += len(self)
|
||||
|
||||
index = y / self.chunk_length
|
||||
offset = y % self.chunk_length
|
||||
chunk = self.chunks[index]
|
||||
|
||||
if isinstance(chunk, list):
|
||||
return chunk[offset]
|
||||
else:
|
||||
@@ -162,7 +150,6 @@ class BigArray(list):
|
||||
index = y / self.chunk_length
|
||||
offset = y % self.chunk_length
|
||||
chunk = self.chunks[index]
|
||||
|
||||
if isinstance(chunk, list):
|
||||
chunk[offset] = value
|
||||
else:
|
||||
|
||||
+387
-1005
File diff suppressed because it is too large
Load Diff
+16
-25
@@ -1,19 +1,13 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
try:
|
||||
import cPickle as pickle
|
||||
except:
|
||||
import pickle
|
||||
finally:
|
||||
import pickle as picklePy
|
||||
|
||||
import base64
|
||||
import json
|
||||
import pickle
|
||||
import re
|
||||
import StringIO
|
||||
import sys
|
||||
@@ -47,7 +41,7 @@ def base64pickle(value):
|
||||
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
|
||||
|
||||
>>> base64pickle('foobar')
|
||||
'gAJVBmZvb2JhcnEBLg=='
|
||||
'gAJVBmZvb2JhcnEALg=='
|
||||
"""
|
||||
|
||||
retVal = None
|
||||
@@ -66,11 +60,11 @@ def base64pickle(value):
|
||||
|
||||
return retVal
|
||||
|
||||
def base64unpickle(value, unsafe=False):
|
||||
def base64unpickle(value):
|
||||
"""
|
||||
Decodes value from Base64 to plain format and deserializes (with pickle) its content
|
||||
|
||||
>>> base64unpickle('gAJVBmZvb2JhcnEBLg==')
|
||||
>>> base64unpickle('gAJVBmZvb2JhcnEALg==')
|
||||
'foobar'
|
||||
"""
|
||||
|
||||
@@ -80,21 +74,18 @@ def base64unpickle(value, unsafe=False):
|
||||
if len(self.stack) > 1:
|
||||
func = self.stack[-2]
|
||||
if func not in PICKLE_REDUCE_WHITELIST:
|
||||
raise Exception("abusing reduce() is bad, Mkay!")
|
||||
raise Exception, "abusing reduce() is bad, Mkay!"
|
||||
self.load_reduce()
|
||||
|
||||
def loads(str):
|
||||
f = StringIO.StringIO(str)
|
||||
if unsafe:
|
||||
unpickler = picklePy.Unpickler(f)
|
||||
unpickler.dispatch[picklePy.REDUCE] = _
|
||||
else:
|
||||
unpickler = pickle.Unpickler(f)
|
||||
file = StringIO.StringIO(str)
|
||||
unpickler = pickle.Unpickler(file)
|
||||
unpickler.dispatch[pickle.REDUCE] = _
|
||||
return unpickler.load()
|
||||
|
||||
try:
|
||||
retVal = loads(base64decode(value))
|
||||
except TypeError:
|
||||
except TypeError:
|
||||
retVal = loads(base64decode(bytes(value)))
|
||||
|
||||
return retVal
|
||||
@@ -110,7 +101,7 @@ def hexdecode(value):
|
||||
value = value.lower()
|
||||
return (value[2:] if value.startswith("0x") else value).decode("hex")
|
||||
|
||||
def hexencode(value, encoding=None):
|
||||
def hexencode(value):
|
||||
"""
|
||||
Encodes string value from plain to hex format
|
||||
|
||||
@@ -118,7 +109,7 @@ def hexencode(value, encoding=None):
|
||||
'666f6f626172'
|
||||
"""
|
||||
|
||||
return unicodeencode(value, encoding).encode("hex")
|
||||
return utf8encode(value).encode("hex")
|
||||
|
||||
def unicodeencode(value, encoding=None):
|
||||
"""
|
||||
@@ -166,7 +157,7 @@ def htmlunescape(value):
|
||||
|
||||
retVal = value
|
||||
if value and isinstance(value, basestring):
|
||||
codes = (("<", '<'), (">", '>'), (""", '"'), (" ", ' '), ("&", '&'), ("'", "'"))
|
||||
codes = (('<', '<'), ('>', '>'), ('"', '"'), (' ', ' '), ('&', '&'))
|
||||
retVal = reduce(lambda x, y: x.replace(y[0], y[1]), codes, retVal)
|
||||
try:
|
||||
retVal = re.sub(r"&#x([^ ;]+);", lambda match: unichr(int(match.group(1), 16)), retVal)
|
||||
@@ -174,7 +165,7 @@ def htmlunescape(value):
|
||||
pass
|
||||
return retVal
|
||||
|
||||
def singleTimeWarnMessage(message): # Cross-referenced function
|
||||
def singleTimeWarnMessage(message): # Cross-linked function
|
||||
sys.stdout.write(message)
|
||||
sys.stdout.write("\n")
|
||||
sys.stdout.flush()
|
||||
@@ -193,7 +184,7 @@ def stdoutencode(data):
|
||||
warnMsg = "cannot properly display Unicode characters "
|
||||
warnMsg += "inside Windows OS command prompt "
|
||||
warnMsg += "(http://bugs.python.org/issue1602). All "
|
||||
warnMsg += "unhandled occurrences will result in "
|
||||
warnMsg += "unhandled occurances will result in "
|
||||
warnMsg += "replacement with '?' character. Please, find "
|
||||
warnMsg += "proper character representation inside "
|
||||
warnMsg += "corresponding output files. "
|
||||
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.datatype import AttribDict
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import copy
|
||||
|
||||
+10
-31
@@ -1,15 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import functools
|
||||
import hashlib
|
||||
|
||||
from lib.core.threads import getCurrentThreadData
|
||||
|
||||
def cachedmethod(f, cache={}):
|
||||
"""
|
||||
Method with a cached content
|
||||
@@ -17,32 +12,16 @@ def cachedmethod(f, cache={}):
|
||||
Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/
|
||||
"""
|
||||
|
||||
@functools.wraps(f)
|
||||
def _(*args, **kwargs):
|
||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs))).hexdigest(), 16) & 0x7fffffffffffffff
|
||||
if key not in cache:
|
||||
cache[key] = f(*args, **kwargs)
|
||||
try:
|
||||
key = (f, tuple(args), frozenset(kwargs.items()))
|
||||
if key not in cache:
|
||||
cache[key] = f(*args, **kwargs)
|
||||
except:
|
||||
key = "".join(str(_) for _ in (f, args, kwargs))
|
||||
if key not in cache:
|
||||
cache[key] = f(*args, **kwargs)
|
||||
|
||||
return cache[key]
|
||||
|
||||
return _
|
||||
|
||||
def stackedmethod(f):
|
||||
"""
|
||||
Method using pushValue/popValue functions (fallback function for stack realignment)
|
||||
"""
|
||||
|
||||
@functools.wraps(f)
|
||||
def _(*args, **kwargs):
|
||||
threadData = getCurrentThreadData()
|
||||
originalLevel = len(threadData.valueStack)
|
||||
|
||||
try:
|
||||
result = f(*args, **kwargs)
|
||||
finally:
|
||||
if len(threadData.valueStack) > originalLevel:
|
||||
threadData.valueStack = threadData.valueStack[:originalLevel]
|
||||
|
||||
return result
|
||||
|
||||
return _
|
||||
|
||||
+16
-16
@@ -1,27 +1,27 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.datatype import AttribDict
|
||||
|
||||
_defaults = {
|
||||
"csvDel": ',',
|
||||
"timeSec": 5,
|
||||
"googlePage": 1,
|
||||
"verbose": 1,
|
||||
"delay": 0,
|
||||
"timeout": 30,
|
||||
"retries": 3,
|
||||
"saFreq": 0,
|
||||
"threads": 1,
|
||||
"level": 1,
|
||||
"risk": 1,
|
||||
"dumpFormat": "CSV",
|
||||
"tech": "BEUSTQ",
|
||||
"torType": "SOCKS5",
|
||||
"csvDel": ",",
|
||||
"timeSec": 5,
|
||||
"googlePage": 1,
|
||||
"verbose": 1,
|
||||
"delay": 0,
|
||||
"timeout": 30,
|
||||
"retries": 3,
|
||||
"saFreq": 0,
|
||||
"threads": 1,
|
||||
"level": 1,
|
||||
"risk": 1,
|
||||
"dumpFormat": "CSV",
|
||||
"tech": "BEUSTQ",
|
||||
"torType": "SOCKS5",
|
||||
}
|
||||
|
||||
defaults = AttribDict(_defaults)
|
||||
|
||||
+182
-275
@@ -1,11 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.enums import CONTENT_TYPE
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import OS
|
||||
from lib.core.enums import POST_HINT
|
||||
@@ -22,311 +21,219 @@ from lib.core.settings import MAXDB_ALIASES
|
||||
from lib.core.settings import SYBASE_ALIASES
|
||||
from lib.core.settings import DB2_ALIASES
|
||||
from lib.core.settings import HSQLDB_ALIASES
|
||||
from lib.core.settings import H2_ALIASES
|
||||
from lib.core.settings import INFORMIX_ALIASES
|
||||
|
||||
FIREBIRD_TYPES = {
|
||||
261: "BLOB",
|
||||
14: "CHAR",
|
||||
40: "CSTRING",
|
||||
11: "D_FLOAT",
|
||||
27: "DOUBLE",
|
||||
10: "FLOAT",
|
||||
16: "INT64",
|
||||
8: "INTEGER",
|
||||
9: "QUAD",
|
||||
7: "SMALLINT",
|
||||
12: "DATE",
|
||||
13: "TIME",
|
||||
35: "TIMESTAMP",
|
||||
37: "VARCHAR",
|
||||
}
|
||||
|
||||
INFORMIX_TYPES = {
|
||||
0: "CHAR",
|
||||
1: "SMALLINT",
|
||||
2: "INTEGER",
|
||||
3: "FLOAT",
|
||||
4: "SMALLFLOAT",
|
||||
5: "DECIMAL",
|
||||
6: "SERIAL",
|
||||
7: "DATE",
|
||||
8: "MONEY",
|
||||
9: "NULL",
|
||||
10: "DATETIME",
|
||||
11: "BYTE",
|
||||
12: "TEXT",
|
||||
13: "VARCHAR",
|
||||
14: "INTERVAL",
|
||||
15: "NCHAR",
|
||||
16: "NVARCHAR",
|
||||
17: "INT8",
|
||||
18: "SERIAL8",
|
||||
19: "SET",
|
||||
20: "MULTISET",
|
||||
21: "LIST",
|
||||
22: "ROW (unnamed)",
|
||||
23: "COLLECTION",
|
||||
40: "Variable-length opaque type",
|
||||
41: "Fixed-length opaque type",
|
||||
43: "LVARCHAR",
|
||||
45: "BOOLEAN",
|
||||
52: "BIGINT",
|
||||
53: "BIGSERIAL",
|
||||
2061: "IDSSECURITYLABEL",
|
||||
4118: "ROW (named)",
|
||||
}
|
||||
261: "BLOB",
|
||||
14: "CHAR",
|
||||
40: "CSTRING",
|
||||
11: "D_FLOAT",
|
||||
27: "DOUBLE",
|
||||
10: "FLOAT",
|
||||
16: "INT64",
|
||||
8: "INTEGER",
|
||||
9: "QUAD",
|
||||
7: "SMALLINT",
|
||||
12: "DATE",
|
||||
13: "TIME",
|
||||
35: "TIMESTAMP",
|
||||
37: "VARCHAR",
|
||||
}
|
||||
|
||||
SYBASE_TYPES = {
|
||||
14: "floatn",
|
||||
8: "float",
|
||||
15: "datetimn",
|
||||
12: "datetime",
|
||||
23: "real",
|
||||
28: "numericn",
|
||||
10: "numeric",
|
||||
27: "decimaln",
|
||||
26: "decimal",
|
||||
17: "moneyn",
|
||||
11: "money",
|
||||
21: "smallmoney",
|
||||
22: "smalldatetime",
|
||||
13: "intn",
|
||||
7: "int",
|
||||
6: "smallint",
|
||||
5: "tinyint",
|
||||
16: "bit",
|
||||
2: "varchar",
|
||||
18: "sysname",
|
||||
25: "nvarchar",
|
||||
1: "char",
|
||||
24: "nchar",
|
||||
4: "varbinary",
|
||||
80: "timestamp",
|
||||
3: "binary",
|
||||
19: "text",
|
||||
20: "image",
|
||||
}
|
||||
14: "floatn",
|
||||
8: "float",
|
||||
15: "datetimn",
|
||||
12: "datetime",
|
||||
23: "real",
|
||||
28: "numericn",
|
||||
10: "numeric",
|
||||
27: "decimaln",
|
||||
26: "decimal",
|
||||
17: "moneyn",
|
||||
11: "money",
|
||||
21: "smallmoney",
|
||||
22: "smalldatetime",
|
||||
13: "intn",
|
||||
7: "int",
|
||||
6: "smallint",
|
||||
5: "tinyint",
|
||||
16: "bit",
|
||||
2: "varchar",
|
||||
18: "sysname",
|
||||
25: "nvarchar",
|
||||
1: "char",
|
||||
24: "nchar",
|
||||
4: "varbinary",
|
||||
80: "timestamp",
|
||||
3: "binary",
|
||||
19: "text",
|
||||
20: "image",
|
||||
}
|
||||
|
||||
MYSQL_PRIVS = {
|
||||
1: "select_priv",
|
||||
2: "insert_priv",
|
||||
3: "update_priv",
|
||||
4: "delete_priv",
|
||||
5: "create_priv",
|
||||
6: "drop_priv",
|
||||
7: "reload_priv",
|
||||
8: "shutdown_priv",
|
||||
9: "process_priv",
|
||||
10: "file_priv",
|
||||
11: "grant_priv",
|
||||
12: "references_priv",
|
||||
13: "index_priv",
|
||||
14: "alter_priv",
|
||||
15: "show_db_priv",
|
||||
16: "super_priv",
|
||||
17: "create_tmp_table_priv",
|
||||
18: "lock_tables_priv",
|
||||
19: "execute_priv",
|
||||
20: "repl_slave_priv",
|
||||
21: "repl_client_priv",
|
||||
22: "create_view_priv",
|
||||
23: "show_view_priv",
|
||||
24: "create_routine_priv",
|
||||
25: "alter_routine_priv",
|
||||
26: "create_user_priv",
|
||||
}
|
||||
1: "select_priv",
|
||||
2: "insert_priv",
|
||||
3: "update_priv",
|
||||
4: "delete_priv",
|
||||
5: "create_priv",
|
||||
6: "drop_priv",
|
||||
7: "reload_priv",
|
||||
8: "shutdown_priv",
|
||||
9: "process_priv",
|
||||
10: "file_priv",
|
||||
11: "grant_priv",
|
||||
12: "references_priv",
|
||||
13: "index_priv",
|
||||
14: "alter_priv",
|
||||
15: "show_db_priv",
|
||||
16: "super_priv",
|
||||
17: "create_tmp_table_priv",
|
||||
18: "lock_tables_priv",
|
||||
19: "execute_priv",
|
||||
20: "repl_slave_priv",
|
||||
21: "repl_client_priv",
|
||||
22: "create_view_priv",
|
||||
23: "show_view_priv",
|
||||
24: "create_routine_priv",
|
||||
25: "alter_routine_priv",
|
||||
26: "create_user_priv",
|
||||
}
|
||||
|
||||
PGSQL_PRIVS = {
|
||||
1: "createdb",
|
||||
2: "super",
|
||||
3: "catupd",
|
||||
}
|
||||
1: "createdb",
|
||||
2: "super",
|
||||
3: "catupd",
|
||||
}
|
||||
|
||||
# Reference(s): http://stackoverflow.com/a/17672504
|
||||
# http://docwiki.embarcadero.com/InterBase/XE7/en/RDB$USER_PRIVILEGES
|
||||
|
||||
FIREBIRD_PRIVS = {
|
||||
"S": "SELECT",
|
||||
"I": "INSERT",
|
||||
"U": "UPDATE",
|
||||
"D": "DELETE",
|
||||
"R": "REFERENCE",
|
||||
"X": "EXECUTE",
|
||||
"A": "ALL",
|
||||
"M": "MEMBER",
|
||||
"T": "DECRYPT",
|
||||
"E": "ENCRYPT",
|
||||
"B": "SUBSCRIBE",
|
||||
}
|
||||
|
||||
# Reference(s): https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm.sqls.doc/ids_sqs_0147.htm
|
||||
# https://www.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.sqlr.doc/ids_sqr_077.htm
|
||||
|
||||
INFORMIX_PRIVS = {
|
||||
"D": "DBA (all privileges)",
|
||||
"R": "RESOURCE (create UDRs, UDTs, permanent tables and indexes)",
|
||||
"C": "CONNECT (work with existing tables)",
|
||||
"G": "ROLE",
|
||||
"U": "DEFAULT (implicit connection)",
|
||||
}
|
||||
"S": "SELECT",
|
||||
"I": "INSERT",
|
||||
"U": "UPDATE",
|
||||
"D": "DELETE",
|
||||
"R": "REFERENCE",
|
||||
"E": "EXECUTE",
|
||||
"X": "EXECUTE",
|
||||
"A": "ALL",
|
||||
"M": "MEMBER",
|
||||
"T": "DECRYPT",
|
||||
"E": "ENCRYPT",
|
||||
"B": "SUBSCRIBE",
|
||||
}
|
||||
|
||||
DB2_PRIVS = {
|
||||
1: "CONTROLAUTH",
|
||||
2: "ALTERAUTH",
|
||||
3: "DELETEAUTH",
|
||||
4: "INDEXAUTH",
|
||||
5: "INSERTAUTH",
|
||||
6: "REFAUTH",
|
||||
7: "SELECTAUTH",
|
||||
8: "UPDATEAUTH",
|
||||
}
|
||||
1: "CONTROLAUTH",
|
||||
2: "ALTERAUTH",
|
||||
3: "DELETEAUTH",
|
||||
4: "INDEXAUTH",
|
||||
5: "INSERTAUTH",
|
||||
6: "REFAUTH",
|
||||
7: "SELECTAUTH",
|
||||
8: "UPDATEAUTH",
|
||||
}
|
||||
|
||||
DUMP_REPLACEMENTS = {" ": NULL, "": BLANK}
|
||||
|
||||
DBMS_DICT = {
|
||||
DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "mssql+pymssql"),
|
||||
DBMS.MYSQL: (MYSQL_ALIASES, "python-pymysql", "https://github.com/PyMySQL/PyMySQL", "mysql"),
|
||||
DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/", "postgresql"),
|
||||
DBMS.ORACLE: (ORACLE_ALIASES, "python cx_Oracle", "https://oracle.github.io/python-cx_Oracle/", "oracle"),
|
||||
DBMS.SQLITE: (SQLITE_ALIASES, "python-sqlite", "https://docs.python.org/2/library/sqlite3.html", "sqlite"),
|
||||
DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "https://github.com/mkleehammer/pyodbc", "access"),
|
||||
DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "http://kinterbasdb.sourceforge.net/", "firebird"),
|
||||
DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"),
|
||||
DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"),
|
||||
DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None),
|
||||
DBMS.H2: (H2_ALIASES, None, None, None),
|
||||
DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"),
|
||||
}
|
||||
DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "mssql+pymssql"),
|
||||
DBMS.MYSQL: (MYSQL_ALIASES, "python pymysql", "https://github.com/petehunt/PyMySQL/", "mysql"),
|
||||
DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/", "postgresql"),
|
||||
DBMS.ORACLE: (ORACLE_ALIASES, "python cx_Oracle", "http://cx-oracle.sourceforge.net/", "oracle"),
|
||||
DBMS.SQLITE: (SQLITE_ALIASES, "python-sqlite", "http://packages.ubuntu.com/quantal/python-sqlite", "sqlite"),
|
||||
DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "http://pyodbc.googlecode.com/", "access"),
|
||||
DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "http://kinterbasdb.sourceforge.net/", "firebird"),
|
||||
DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"),
|
||||
DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "sybase"),
|
||||
DBMS.DB2: (DB2_ALIASES, "python ibm-db", "http://code.google.com/p/ibm-db/", "ibm_db_sa"),
|
||||
DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None),
|
||||
}
|
||||
|
||||
FROM_DUMMY_TABLE = {
|
||||
DBMS.ORACLE: " FROM DUAL",
|
||||
DBMS.ACCESS: " FROM MSysAccessObjects",
|
||||
DBMS.FIREBIRD: " FROM RDB$DATABASE",
|
||||
DBMS.MAXDB: " FROM VERSIONS",
|
||||
DBMS.DB2: " FROM SYSIBM.SYSDUMMY1",
|
||||
DBMS.HSQLDB: " FROM INFORMATION_SCHEMA.SYSTEM_USERS",
|
||||
DBMS.INFORMIX: " FROM SYSMASTER:SYSDUAL"
|
||||
}
|
||||
DBMS.ORACLE: " FROM DUAL",
|
||||
DBMS.ACCESS: " FROM MSysAccessObjects",
|
||||
DBMS.FIREBIRD: " FROM RDB$DATABASE",
|
||||
DBMS.MAXDB: " FROM VERSIONS",
|
||||
DBMS.DB2: " FROM SYSIBM.SYSDUMMY1",
|
||||
DBMS.HSQLDB: " FROM INFORMATION_SCHEMA.SYSTEM_USERS"
|
||||
}
|
||||
|
||||
SQL_STATEMENTS = {
|
||||
"SQL SELECT statement": (
|
||||
"select ",
|
||||
"show ",
|
||||
" top ",
|
||||
" distinct ",
|
||||
" from ",
|
||||
" from dual",
|
||||
" where ",
|
||||
" group by ",
|
||||
" order by ",
|
||||
" having ",
|
||||
" limit ",
|
||||
" offset ",
|
||||
" union all ",
|
||||
" rownum as ",
|
||||
"(case ",
|
||||
),
|
||||
"SQL SELECT statement": (
|
||||
"select ",
|
||||
"show ",
|
||||
" top ",
|
||||
" distinct ",
|
||||
" from ",
|
||||
" from dual",
|
||||
" where ",
|
||||
" group by ",
|
||||
" order by ",
|
||||
" having ",
|
||||
" limit ",
|
||||
" offset ",
|
||||
" union all ",
|
||||
" rownum as ",
|
||||
"(case ", ),
|
||||
|
||||
"SQL data definition": (
|
||||
"create ",
|
||||
"declare ",
|
||||
"drop ",
|
||||
"truncate ",
|
||||
"alter ",
|
||||
),
|
||||
"SQL data definition": (
|
||||
"create ",
|
||||
"declare ",
|
||||
"drop ",
|
||||
"truncate ",
|
||||
"alter ", ),
|
||||
|
||||
"SQL data manipulation": (
|
||||
"bulk ",
|
||||
"insert ",
|
||||
"update ",
|
||||
"delete ",
|
||||
"merge ",
|
||||
"load ",
|
||||
),
|
||||
"SQL data manipulation": (
|
||||
"bulk ",
|
||||
"insert ",
|
||||
"update ",
|
||||
"delete ",
|
||||
"merge ",
|
||||
"load ", ),
|
||||
|
||||
"SQL data control": (
|
||||
"grant ",
|
||||
"revoke ",
|
||||
),
|
||||
"SQL data control": (
|
||||
"grant ",
|
||||
"revoke ", ),
|
||||
|
||||
"SQL data execution": (
|
||||
"exec ",
|
||||
"execute ",
|
||||
"values ",
|
||||
"call ",
|
||||
),
|
||||
"SQL data execution": (
|
||||
"exec ",
|
||||
"execute ",
|
||||
"values ",
|
||||
"call ", ),
|
||||
|
||||
"SQL transaction": (
|
||||
"start transaction ",
|
||||
"begin work ",
|
||||
"begin transaction ",
|
||||
"commit ",
|
||||
"rollback ",
|
||||
),
|
||||
|
||||
"SQL administration": (
|
||||
"set ",
|
||||
),
|
||||
}
|
||||
"SQL transaction": (
|
||||
"start transaction ",
|
||||
"begin work ",
|
||||
"begin transaction ",
|
||||
"commit ",
|
||||
"rollback ", ),
|
||||
}
|
||||
|
||||
POST_HINT_CONTENT_TYPES = {
|
||||
POST_HINT.JSON: "application/json",
|
||||
POST_HINT.JSON_LIKE: "application/json",
|
||||
POST_HINT.MULTIPART: "multipart/form-data",
|
||||
POST_HINT.SOAP: "application/soap+xml",
|
||||
POST_HINT.XML: "application/xml",
|
||||
POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8",
|
||||
}
|
||||
POST_HINT.JSON: "application/json",
|
||||
POST_HINT.JSON_LIKE: "application/json",
|
||||
POST_HINT.MULTIPART: "multipart/form-data",
|
||||
POST_HINT.SOAP: "application/soap+xml",
|
||||
POST_HINT.XML: "application/xml",
|
||||
POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8",
|
||||
}
|
||||
|
||||
DEPRECATED_OPTIONS = {
|
||||
"--replicate": "use '--dump-format=SQLITE' instead",
|
||||
"--no-unescape": "use '--no-escape' instead",
|
||||
"--binary": "use '--binary-fields' instead",
|
||||
"--auth-private": "use '--auth-file' instead",
|
||||
"--ignore-401": "use '--ignore-code' instead",
|
||||
"--second-order": "use '--second-url' instead",
|
||||
"--purge-output": "use '--purge' instead",
|
||||
"--check-payload": None,
|
||||
"--check-waf": None,
|
||||
"--pickled-options": "use '--api -c ...' instead",
|
||||
}
|
||||
"--replicate": "use '--dump-format=SQLITE' instead",
|
||||
"--no-unescape": "use '--no-escape' instead",
|
||||
"--binary": "use '--binary-fields' instead",
|
||||
"--auth-private": "use '--auth-file' instead",
|
||||
"--check-payload": None,
|
||||
"--check-waf": None,
|
||||
}
|
||||
|
||||
DUMP_DATA_PREPROCESS = {
|
||||
DBMS.ORACLE: {"XMLTYPE": "(%s).getStringVal()"}, # Reference: https://www.tibcommunity.com/docs/DOC-3643
|
||||
DBMS.MSSQL: {"IMAGE": "CONVERT(VARBINARY(MAX),%s)"},
|
||||
}
|
||||
DBMS.ORACLE: {"XMLTYPE": "(%s).getStringVal()"}, # Reference: https://www.tibcommunity.com/docs/DOC-3643
|
||||
DBMS.MSSQL: {"IMAGE": "CONVERT(VARBINARY(MAX),%s)"},
|
||||
}
|
||||
|
||||
DEFAULT_DOC_ROOTS = {
|
||||
OS.WINDOWS: ("C:/xampp/htdocs/", "C:/wamp/www/", "C:/Inetpub/wwwroot/"),
|
||||
OS.LINUX: ("/var/www/", "/var/www/html", "/usr/local/apache2/htdocs", "/var/www/nginx-default", "/srv/www") # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout
|
||||
}
|
||||
|
||||
PART_RUN_CONTENT_TYPES = {
|
||||
"checkDbms": CONTENT_TYPE.TECHNIQUES,
|
||||
"getFingerprint": CONTENT_TYPE.DBMS_FINGERPRINT,
|
||||
"getBanner": CONTENT_TYPE.BANNER,
|
||||
"getCurrentUser": CONTENT_TYPE.CURRENT_USER,
|
||||
"getCurrentDb": CONTENT_TYPE.CURRENT_DB,
|
||||
"getHostname": CONTENT_TYPE.HOSTNAME,
|
||||
"isDba": CONTENT_TYPE.IS_DBA,
|
||||
"getUsers": CONTENT_TYPE.USERS,
|
||||
"getPasswordHashes": CONTENT_TYPE.PASSWORDS,
|
||||
"getPrivileges": CONTENT_TYPE.PRIVILEGES,
|
||||
"getRoles": CONTENT_TYPE.ROLES,
|
||||
"getDbs": CONTENT_TYPE.DBS,
|
||||
"getTables": CONTENT_TYPE.TABLES,
|
||||
"getColumns": CONTENT_TYPE.COLUMNS,
|
||||
"getSchema": CONTENT_TYPE.SCHEMA,
|
||||
"getCount": CONTENT_TYPE.COUNT,
|
||||
"dumpTable": CONTENT_TYPE.DUMP_TABLE,
|
||||
"search": CONTENT_TYPE.SEARCH,
|
||||
"sqlQuery": CONTENT_TYPE.SQL_QUERY,
|
||||
"tableExists": CONTENT_TYPE.COMMON_TABLES,
|
||||
"columnExists": CONTENT_TYPE.COMMON_COLUMNS,
|
||||
"readFile": CONTENT_TYPE.FILE_READ,
|
||||
"writeFile": CONTENT_TYPE.FILE_WRITE,
|
||||
"osCmd": CONTENT_TYPE.OS_CMD,
|
||||
"regRead": CONTENT_TYPE.REG_READ
|
||||
}
|
||||
OS.WINDOWS: ("C:/xampp/htdocs/", "C:/wamp/www/", "C:/Inetpub/wwwroot/"),
|
||||
OS.LINUX: ("/var/www/", "/var/www/html", "/usr/local/apache2/htdocs", "/var/www/nginx-default", "/srv/www") # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout
|
||||
}
|
||||
|
||||
+24
-27
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import cgi
|
||||
@@ -46,8 +46,6 @@ from lib.core.settings import METADB_SUFFIX
|
||||
from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE
|
||||
from lib.core.settings import TRIM_STDOUT_DUMP_SIZE
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from lib.core.settings import UNSAFE_DUMP_FILEPATH_REPLACEMENT
|
||||
from lib.core.settings import VERSION_STRING
|
||||
from lib.core.settings import WINDOWS_RESERVED_NAMES
|
||||
from thirdparty.magic import magic
|
||||
|
||||
@@ -65,7 +63,7 @@ class Dump(object):
|
||||
self._lock = threading.Lock()
|
||||
|
||||
def _write(self, data, newline=True, console=True, content_type=None):
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
dataToStdout(data, content_type=content_type, status=CONTENT_STATUS.COMPLETE)
|
||||
return
|
||||
|
||||
@@ -112,7 +110,7 @@ class Dump(object):
|
||||
def string(self, header, data, content_type=None, sort=True):
|
||||
kb.stickyLevel = None
|
||||
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(data, content_type=content_type)
|
||||
return
|
||||
|
||||
@@ -142,11 +140,11 @@ class Dump(object):
|
||||
try:
|
||||
elements = set(elements)
|
||||
elements = list(elements)
|
||||
elements.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
elements.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x)
|
||||
except:
|
||||
pass
|
||||
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(elements, content_type=content_type)
|
||||
return
|
||||
|
||||
@@ -171,7 +169,7 @@ class Dump(object):
|
||||
def currentDb(self, data):
|
||||
if Backend.isDbms(DBMS.MAXDB):
|
||||
self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2):
|
||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB):
|
||||
self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
else:
|
||||
self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB)
|
||||
@@ -193,9 +191,9 @@ class Dump(object):
|
||||
userSettings = userSettings[0]
|
||||
|
||||
users = userSettings.keys()
|
||||
users.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
users.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x)
|
||||
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(userSettings, content_type=content_type)
|
||||
return
|
||||
|
||||
@@ -229,7 +227,7 @@ class Dump(object):
|
||||
|
||||
def dbTables(self, dbTables):
|
||||
if isinstance(dbTables, dict) and len(dbTables) > 0:
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(dbTables, content_type=CONTENT_TYPE.TABLES)
|
||||
return
|
||||
|
||||
@@ -272,7 +270,7 @@ class Dump(object):
|
||||
|
||||
def dbTableColumns(self, tableColumns, content_type=None):
|
||||
if isinstance(tableColumns, dict) and len(tableColumns) > 0:
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(tableColumns, content_type=content_type)
|
||||
return
|
||||
|
||||
@@ -287,7 +285,7 @@ class Dump(object):
|
||||
colType = None
|
||||
|
||||
colList = columns.keys()
|
||||
colList.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
colList.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x)
|
||||
|
||||
for column in colList:
|
||||
colType = columns[column]
|
||||
@@ -346,7 +344,7 @@ class Dump(object):
|
||||
|
||||
def dbTablesCount(self, dbTables):
|
||||
if isinstance(dbTables, dict) and len(dbTables) > 0:
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(dbTables, content_type=CONTENT_TYPE.COUNT)
|
||||
return
|
||||
|
||||
@@ -379,7 +377,7 @@ class Dump(object):
|
||||
if count is None:
|
||||
count = "Unknown"
|
||||
|
||||
tables.sort(key=lambda _: _.lower() if isinstance(_, basestring) else _)
|
||||
tables.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x)
|
||||
|
||||
for table in tables:
|
||||
blank1 = " " * (maxlength1 - len(normalizeUnicode(table) or unicode(table)))
|
||||
@@ -405,7 +403,7 @@ class Dump(object):
|
||||
db = "All"
|
||||
table = tableValues["__infos__"]["table"]
|
||||
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(tableValues, content_type=CONTENT_TYPE.DUMP_TABLE)
|
||||
return
|
||||
|
||||
@@ -416,16 +414,16 @@ class Dump(object):
|
||||
elif conf.dumpFormat in (DUMP_FORMAT.CSV, DUMP_FORMAT.HTML):
|
||||
if not os.path.isdir(dumpDbPath):
|
||||
try:
|
||||
os.makedirs(dumpDbPath)
|
||||
os.makedirs(dumpDbPath, 0755)
|
||||
except:
|
||||
warnFile = True
|
||||
|
||||
_ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(db)))
|
||||
_ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(db)))
|
||||
dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(unicodeencode(db)).hexdigest()[:8]))
|
||||
|
||||
if not os.path.isdir(dumpDbPath):
|
||||
try:
|
||||
os.makedirs(dumpDbPath)
|
||||
os.makedirs(dumpDbPath, 0755)
|
||||
except Exception, ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
||||
@@ -443,7 +441,7 @@ class Dump(object):
|
||||
|
||||
dumpDbPath = tempDir
|
||||
|
||||
dumpFileName = os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower())))
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower()))
|
||||
if not checkFile(dumpFileName, False):
|
||||
try:
|
||||
openFile(dumpFileName, "w+b").close()
|
||||
@@ -452,9 +450,9 @@ class Dump(object):
|
||||
except:
|
||||
warnFile = True
|
||||
|
||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(table)))
|
||||
_ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(table)))
|
||||
if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES:
|
||||
_ = unicodeencode(re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table)))
|
||||
_ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(table)))
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(unicodeencode(table)).hexdigest()[:8], conf.dumpFormat.lower()))
|
||||
else:
|
||||
dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower()))
|
||||
@@ -533,7 +531,6 @@ class Dump(object):
|
||||
elif conf.dumpFormat == DUMP_FORMAT.HTML:
|
||||
dataToDumpFile(dumpFP, "<!DOCTYPE html>\n<html>\n<head>\n")
|
||||
dataToDumpFile(dumpFP, "<meta http-equiv=\"Content-type\" content=\"text/html;charset=%s\">\n" % UNICODE_ENCODING)
|
||||
dataToDumpFile(dumpFP, "<meta name=\"generator\" content=\"%s\" />\n" % VERSION_STRING)
|
||||
dataToDumpFile(dumpFP, "<title>%s</title>\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table)))
|
||||
dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE)
|
||||
dataToDumpFile(dumpFP, "\n</head>\n<body>\n<table>\n<thead>\n<tr>\n")
|
||||
@@ -614,9 +611,9 @@ class Dump(object):
|
||||
mimetype = magic.from_buffer(value, mime=True)
|
||||
if any(mimetype.startswith(_) for _ in ("application", "image")):
|
||||
if not os.path.isdir(dumpDbPath):
|
||||
os.makedirs(dumpDbPath)
|
||||
os.makedirs(dumpDbPath, 0755)
|
||||
|
||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
||||
_ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
||||
filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
|
||||
warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
|
||||
logger.warn(warnMsg)
|
||||
@@ -669,7 +666,7 @@ class Dump(object):
|
||||
logger.warn(msg)
|
||||
|
||||
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
||||
if conf.api:
|
||||
if hasattr(conf, "api"):
|
||||
self._write(dbColumnsDict, content_type=CONTENT_TYPE.COLUMNS)
|
||||
return
|
||||
|
||||
|
||||
+90
-108
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
class PRIORITY:
|
||||
@@ -22,15 +22,6 @@ class SORT_ORDER:
|
||||
FIFTH = 4
|
||||
LAST = 100
|
||||
|
||||
# Reference: https://docs.python.org/2/library/logging.html#logging-levels
|
||||
class LOGGING_LEVELS:
|
||||
NOTSET = 0
|
||||
DEBUG = 10
|
||||
INFO = 20
|
||||
WARNING = 30
|
||||
ERROR = 40
|
||||
CRITICAL = 50
|
||||
|
||||
class DBMS:
|
||||
ACCESS = "Microsoft Access"
|
||||
DB2 = "IBM DB2"
|
||||
@@ -43,8 +34,6 @@ class DBMS:
|
||||
SQLITE = "SQLite"
|
||||
SYBASE = "Sybase"
|
||||
HSQLDB = "HSQLDB"
|
||||
H2 = "H2"
|
||||
INFORMIX = "Informix"
|
||||
|
||||
class DBMS_DIRECTORY_NAME:
|
||||
ACCESS = "access"
|
||||
@@ -58,8 +47,6 @@ class DBMS_DIRECTORY_NAME:
|
||||
SQLITE = "sqlite"
|
||||
SYBASE = "sybase"
|
||||
HSQLDB = "hsqldb"
|
||||
H2 = "h2"
|
||||
INFORMIX = "informix"
|
||||
|
||||
class CUSTOM_LOGGING:
|
||||
PAYLOAD = 9
|
||||
@@ -129,30 +116,14 @@ class HASH:
|
||||
MSSQL_OLD = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{80}\Z'
|
||||
MSSQL_NEW = r'(?i)\A0x0200[0-9a-f]{8}[0-9a-f]{128}\Z'
|
||||
ORACLE = r'(?i)\As:[0-9a-f]{60}\Z'
|
||||
ORACLE_OLD = r'(?i)\A[0-9a-f]{16}\Z'
|
||||
ORACLE_OLD = r'(?i)\A[01-9a-f]{16}\Z'
|
||||
MD5_GENERIC = r'(?i)\A[0-9a-f]{32}\Z'
|
||||
SHA1_GENERIC = r'(?i)\A[0-9a-f]{40}\Z'
|
||||
SHA224_GENERIC = r'(?i)\A[0-9a-f]{56}\Z'
|
||||
SHA256_GENERIC = r'(?i)\A[0-9a-f]{64}\Z'
|
||||
SHA384_GENERIC = r'(?i)\A[0-9a-f]{96}\Z'
|
||||
SHA512_GENERIC = r'(?i)\A[0-9a-f]{128}\Z'
|
||||
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
||||
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
||||
WORDPRESS = r'\A\$P\$[./0-9a-zA-Z]{31}\Z'
|
||||
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||
VBULLETIN = r'\A[0-9a-fA-F]{32}:.{30}\Z'
|
||||
VBULLETIN_OLD = r'\A[0-9a-fA-F]{32}:.{3}\Z'
|
||||
SSHA = r'\A\{SSHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||
SSHA256 = r'\A\{SSHA256\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||
SSHA512 = r'\A\{SSHA512\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||
DJANGO_MD5 = r'\Amd5\$[^$]+\$[0-9a-f]{32}\Z'
|
||||
DJANGO_SHA1 = r'\Asha1\$[^$]+\$[0-9a-f]{40}\Z'
|
||||
MD5_BASE64 = r'\A[a-zA-Z0-9+/]{22}==\Z'
|
||||
SHA1_BASE64 = r'\A[a-zA-Z0-9+/]{27}=\Z'
|
||||
SHA256_BASE64 = r'\A[a-zA-Z0-9+/]{43}=\Z'
|
||||
SHA512_BASE64 = r'\A[a-zA-Z0-9+/]{86}==\Z'
|
||||
SHA224_GENERIC = r'(?i)\A[0-9a-f]{28}\Z'
|
||||
SHA384_GENERIC = r'(?i)\A[0-9a-f]{48}\Z'
|
||||
SHA512_GENERIC = r'(?i)\A[0-9a-f]{64}\Z'
|
||||
CRYPT_GENERIC = r'(?i)\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
||||
WORDPRESS = r'(?i)\A\$P\$[./0-9A-Za-z]{31}\Z'
|
||||
|
||||
# Reference: http://www.zytrax.com/tech/web/mobile_ids.html
|
||||
class MOBILES:
|
||||
@@ -203,7 +174,6 @@ class HTTP_HEADER:
|
||||
PROXY_CONNECTION = "Proxy-Connection"
|
||||
RANGE = "Range"
|
||||
REFERER = "Referer"
|
||||
REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794
|
||||
SERVER = "Server"
|
||||
SET_COOKIE = "Set-Cookie"
|
||||
TRANSFER_ENCODING = "Transfer-Encoding"
|
||||
@@ -211,7 +181,6 @@ class HTTP_HEADER:
|
||||
USER_AGENT = "User-Agent"
|
||||
VIA = "Via"
|
||||
X_POWERED_BY = "X-Powered-By"
|
||||
X_DATA_ORIGIN = "X-Data-Origin"
|
||||
|
||||
class EXPECTED:
|
||||
BOOL = "bool"
|
||||
@@ -244,42 +213,40 @@ class REDIRECTION:
|
||||
|
||||
class PAYLOAD:
|
||||
SQLINJECTION = {
|
||||
1: "boolean-based blind",
|
||||
2: "error-based",
|
||||
3: "inline query",
|
||||
4: "stacked queries",
|
||||
5: "AND/OR time-based blind",
|
||||
6: "UNION query",
|
||||
}
|
||||
1: "boolean-based blind",
|
||||
2: "error-based",
|
||||
3: "inline query",
|
||||
4: "stacked queries",
|
||||
5: "AND/OR time-based blind",
|
||||
6: "UNION query",
|
||||
}
|
||||
|
||||
PARAMETER = {
|
||||
1: "Unescaped numeric",
|
||||
2: "Single quoted string",
|
||||
3: "LIKE single quoted string",
|
||||
4: "Double quoted string",
|
||||
5: "LIKE double quoted string",
|
||||
6: "Identifier (e.g. column name)",
|
||||
}
|
||||
1: "Unescaped numeric",
|
||||
2: "Single quoted string",
|
||||
3: "LIKE single quoted string",
|
||||
4: "Double quoted string",
|
||||
5: "LIKE double quoted string",
|
||||
}
|
||||
|
||||
RISK = {
|
||||
0: "No risk",
|
||||
1: "Low risk",
|
||||
2: "Medium risk",
|
||||
3: "High risk",
|
||||
}
|
||||
0: "No risk",
|
||||
1: "Low risk",
|
||||
2: "Medium risk",
|
||||
3: "High risk",
|
||||
}
|
||||
|
||||
CLAUSE = {
|
||||
0: "Always",
|
||||
1: "WHERE",
|
||||
2: "GROUP BY",
|
||||
3: "ORDER BY",
|
||||
4: "LIMIT",
|
||||
5: "OFFSET",
|
||||
6: "TOP",
|
||||
7: "Table name",
|
||||
8: "Column name",
|
||||
9: "Pre-WHERE (non-query)",
|
||||
}
|
||||
0: "Always",
|
||||
1: "WHERE",
|
||||
2: "GROUP BY",
|
||||
3: "ORDER BY",
|
||||
4: "LIMIT",
|
||||
5: "OFFSET",
|
||||
6: "TOP",
|
||||
7: "Table name",
|
||||
8: "Column name",
|
||||
}
|
||||
|
||||
class METHOD:
|
||||
COMPARISON = "comparison"
|
||||
@@ -310,39 +277,66 @@ class ADJUST_TIME_DELAY:
|
||||
NO = 0
|
||||
YES = 1
|
||||
|
||||
class WEB_PLATFORM:
|
||||
class WEB_API:
|
||||
PHP = "php"
|
||||
ASP = "asp"
|
||||
ASPX = "aspx"
|
||||
JSP = "jsp"
|
||||
|
||||
class CONTENT_TYPE:
|
||||
TARGET = 0
|
||||
TECHNIQUES = 1
|
||||
DBMS_FINGERPRINT = 2
|
||||
BANNER = 3
|
||||
CURRENT_USER = 4
|
||||
CURRENT_DB = 5
|
||||
HOSTNAME = 6
|
||||
IS_DBA = 7
|
||||
USERS = 8
|
||||
PASSWORDS = 9
|
||||
PRIVILEGES = 10
|
||||
ROLES = 11
|
||||
DBS = 12
|
||||
TABLES = 13
|
||||
COLUMNS = 14
|
||||
SCHEMA = 15
|
||||
COUNT = 16
|
||||
DUMP_TABLE = 17
|
||||
SEARCH = 18
|
||||
SQL_QUERY = 19
|
||||
COMMON_TABLES = 20
|
||||
COMMON_COLUMNS = 21
|
||||
FILE_READ = 22
|
||||
FILE_WRITE = 23
|
||||
OS_CMD = 24
|
||||
REG_READ = 25
|
||||
TECHNIQUES = 0
|
||||
DBMS_FINGERPRINT = 1
|
||||
BANNER = 2
|
||||
CURRENT_USER = 3
|
||||
CURRENT_DB = 4
|
||||
HOSTNAME = 5
|
||||
IS_DBA = 6
|
||||
USERS = 7
|
||||
PASSWORDS = 8
|
||||
PRIVILEGES = 9
|
||||
ROLES = 10
|
||||
DBS = 11
|
||||
TABLES = 12
|
||||
COLUMNS = 13
|
||||
SCHEMA = 14
|
||||
COUNT = 15
|
||||
DUMP_TABLE = 16
|
||||
SEARCH = 17
|
||||
SQL_QUERY = 18
|
||||
COMMON_TABLES = 19
|
||||
COMMON_COLUMNS = 20
|
||||
FILE_READ = 21
|
||||
FILE_WRITE = 22
|
||||
OS_CMD = 23
|
||||
REG_READ = 24
|
||||
|
||||
PART_RUN_CONTENT_TYPES = {
|
||||
"checkDbms": CONTENT_TYPE.TECHNIQUES,
|
||||
"getFingerprint": CONTENT_TYPE.DBMS_FINGERPRINT,
|
||||
"getBanner": CONTENT_TYPE.BANNER,
|
||||
"getCurrentUser": CONTENT_TYPE.CURRENT_USER,
|
||||
"getCurrentDb": CONTENT_TYPE.CURRENT_DB,
|
||||
"getHostname": CONTENT_TYPE.HOSTNAME,
|
||||
"isDba": CONTENT_TYPE.IS_DBA,
|
||||
"getUsers": CONTENT_TYPE.USERS,
|
||||
"getPasswordHashes": CONTENT_TYPE.PASSWORDS,
|
||||
"getPrivileges": CONTENT_TYPE.PRIVILEGES,
|
||||
"getRoles": CONTENT_TYPE.ROLES,
|
||||
"getDbs": CONTENT_TYPE.DBS,
|
||||
"getTables": CONTENT_TYPE.TABLES,
|
||||
"getColumns": CONTENT_TYPE.COLUMNS,
|
||||
"getSchema": CONTENT_TYPE.SCHEMA,
|
||||
"getCount": CONTENT_TYPE.COUNT,
|
||||
"dumpTable": CONTENT_TYPE.DUMP_TABLE,
|
||||
"search": CONTENT_TYPE.SEARCH,
|
||||
"sqlQuery": CONTENT_TYPE.SQL_QUERY,
|
||||
"tableExists": CONTENT_TYPE.COMMON_TABLES,
|
||||
"columnExists": CONTENT_TYPE.COMMON_COLUMNS,
|
||||
"readFile": CONTENT_TYPE.FILE_READ,
|
||||
"writeFile": CONTENT_TYPE.FILE_WRITE,
|
||||
"osCmd": CONTENT_TYPE.OS_CMD,
|
||||
"regRead": CONTENT_TYPE.REG_READ
|
||||
}
|
||||
|
||||
class CONTENT_STATUS:
|
||||
IN_PROGRESS = 0
|
||||
@@ -358,7 +352,6 @@ class AUTOCOMPLETE_TYPE:
|
||||
SQL = 0
|
||||
OS = 1
|
||||
SQLMAP = 2
|
||||
API = 3
|
||||
|
||||
class NOTE:
|
||||
FALSE_POSITIVE_OR_UNEXPLOITABLE = "false positive or unexploitable"
|
||||
@@ -367,18 +360,7 @@ class MKSTEMP_PREFIX:
|
||||
HASHES = "sqlmaphashes-"
|
||||
CRAWLER = "sqlmapcrawler-"
|
||||
IPC = "sqlmapipc-"
|
||||
CONFIG = "sqlmapconfig-"
|
||||
TESTING = "sqlmaptesting-"
|
||||
RESULTS = "sqlmapresults-"
|
||||
COOKIE_JAR = "sqlmapcookiejar-"
|
||||
BIG_ARRAY = "sqlmapbigarray-"
|
||||
SPECIFIC_RESPONSE = "sqlmapresponse-"
|
||||
|
||||
class TIMEOUT_STATE:
|
||||
NORMAL = 0
|
||||
EXCEPTION = 1
|
||||
TIMEOUT = 2
|
||||
|
||||
class HINT:
|
||||
PREPEND = 0
|
||||
APPEND = 1
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
class SqlmapBaseException(Exception):
|
||||
@@ -50,9 +50,6 @@ class SqlmapUserQuitException(SqlmapBaseException):
|
||||
class SqlmapShellQuitException(SqlmapBaseException):
|
||||
pass
|
||||
|
||||
class SqlmapSkipTargetException(SqlmapBaseException):
|
||||
pass
|
||||
|
||||
class SqlmapSyntaxException(SqlmapBaseException):
|
||||
pass
|
||||
|
||||
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import logging
|
||||
|
||||
+467
-359
File diff suppressed because it is too large
Load Diff
+223
-239
@@ -1,259 +1,243 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
optDict = {
|
||||
# Family: {"parameter name": "parameter datatype"},
|
||||
# --OR--
|
||||
# Family: {"parameter name": ("parameter datatype", "category name used for common outputs feature")},
|
||||
# Format:
|
||||
# Family: { "parameter name": "parameter datatype" },
|
||||
# Or:
|
||||
# Family: { "parameter name": ("parameter datatype", "category name used for common outputs feature") },
|
||||
"Target": {
|
||||
"direct": "string",
|
||||
"url": "string",
|
||||
"logFile": "string",
|
||||
"bulkFile": "string",
|
||||
"requestFile": "string",
|
||||
"sessionFile": "string",
|
||||
"googleDork": "string",
|
||||
"configFile": "string",
|
||||
"sitemapUrl": "string",
|
||||
},
|
||||
|
||||
"Target": {
|
||||
"direct": "string",
|
||||
"url": "string",
|
||||
"logFile": "string",
|
||||
"bulkFile": "string",
|
||||
"requestFile": "string",
|
||||
"sessionFile": "string",
|
||||
"googleDork": "string",
|
||||
"configFile": "string",
|
||||
"sitemapUrl": "string",
|
||||
},
|
||||
"Request": {
|
||||
"method": "string",
|
||||
"data": "string",
|
||||
"paramDel": "string",
|
||||
"cookie": "string",
|
||||
"cookieDel": "string",
|
||||
"loadCookies": "string",
|
||||
"dropSetCookie": "boolean",
|
||||
"agent": "string",
|
||||
"randomAgent": "boolean",
|
||||
"host": "string",
|
||||
"referer": "string",
|
||||
"headers": "string",
|
||||
"authType": "string",
|
||||
"authCred": "string",
|
||||
"authFile": "string",
|
||||
"proxy": "string",
|
||||
"proxyCred": "string",
|
||||
"proxyFile": "string",
|
||||
"ignoreProxy": "boolean",
|
||||
"tor": "boolean",
|
||||
"torPort": "integer",
|
||||
"torType": "string",
|
||||
"checkTor": "boolean",
|
||||
"delay": "float",
|
||||
"timeout": "float",
|
||||
"retries": "integer",
|
||||
"rParam": "string",
|
||||
"safeUrl": "string",
|
||||
"safePost": "string",
|
||||
"safeReqFile": "string",
|
||||
"safeFreq": "integer",
|
||||
"skipUrlEncode": "boolean",
|
||||
"csrfToken": "string",
|
||||
"csrfUrl": "string",
|
||||
"forceSSL": "boolean",
|
||||
"hpp": "boolean",
|
||||
"evalCode": "string",
|
||||
},
|
||||
|
||||
"Request": {
|
||||
"method": "string",
|
||||
"data": "string",
|
||||
"paramDel": "string",
|
||||
"cookie": "string",
|
||||
"cookieDel": "string",
|
||||
"loadCookies": "string",
|
||||
"dropSetCookie": "boolean",
|
||||
"agent": "string",
|
||||
"randomAgent": "boolean",
|
||||
"host": "string",
|
||||
"referer": "string",
|
||||
"headers": "string",
|
||||
"authType": "string",
|
||||
"authCred": "string",
|
||||
"authFile": "string",
|
||||
"ignoreCode": "integer",
|
||||
"ignoreProxy": "boolean",
|
||||
"ignoreRedirects": "boolean",
|
||||
"ignoreTimeouts": "boolean",
|
||||
"proxy": "string",
|
||||
"proxyCred": "string",
|
||||
"proxyFile": "string",
|
||||
"tor": "boolean",
|
||||
"torPort": "integer",
|
||||
"torType": "string",
|
||||
"checkTor": "boolean",
|
||||
"delay": "float",
|
||||
"timeout": "float",
|
||||
"retries": "integer",
|
||||
"rParam": "string",
|
||||
"safeUrl": "string",
|
||||
"safePost": "string",
|
||||
"safeReqFile": "string",
|
||||
"safeFreq": "integer",
|
||||
"skipUrlEncode": "boolean",
|
||||
"csrfToken": "string",
|
||||
"csrfUrl": "string",
|
||||
"forceSSL": "boolean",
|
||||
"hpp": "boolean",
|
||||
"evalCode": "string",
|
||||
},
|
||||
"Optimization": {
|
||||
"optimize": "boolean",
|
||||
"predictOutput": "boolean",
|
||||
"keepAlive": "boolean",
|
||||
"nullConnection": "boolean",
|
||||
"threads": "integer",
|
||||
},
|
||||
|
||||
"Optimization": {
|
||||
"optimize": "boolean",
|
||||
"predictOutput": "boolean",
|
||||
"keepAlive": "boolean",
|
||||
"nullConnection": "boolean",
|
||||
"threads": "integer",
|
||||
},
|
||||
"Injection": {
|
||||
"testParameter": "string",
|
||||
"skip": "string",
|
||||
"skipStatic": "boolean",
|
||||
"dbms": "string",
|
||||
"dbmsCred": "string",
|
||||
"os": "string",
|
||||
"invalidBignum": "boolean",
|
||||
"invalidLogical": "boolean",
|
||||
"invalidString": "boolean",
|
||||
"noCast": "boolean",
|
||||
"noEscape": "boolean",
|
||||
"prefix": "string",
|
||||
"suffix": "string",
|
||||
"tamper": "string",
|
||||
},
|
||||
|
||||
"Injection": {
|
||||
"testParameter": "string",
|
||||
"skip": "string",
|
||||
"skipStatic": "boolean",
|
||||
"paramExclude": "string",
|
||||
"dbms": "string",
|
||||
"dbmsCred": "string",
|
||||
"os": "string",
|
||||
"invalidBignum": "boolean",
|
||||
"invalidLogical": "boolean",
|
||||
"invalidString": "boolean",
|
||||
"noCast": "boolean",
|
||||
"noEscape": "boolean",
|
||||
"prefix": "string",
|
||||
"suffix": "string",
|
||||
"tamper": "string",
|
||||
},
|
||||
"Detection": {
|
||||
"level": "integer",
|
||||
"risk": "integer",
|
||||
"string": "string",
|
||||
"notString": "string",
|
||||
"regexp": "string",
|
||||
"code": "integer",
|
||||
"textOnly": "boolean",
|
||||
"titles": "boolean",
|
||||
},
|
||||
|
||||
"Detection": {
|
||||
"level": "integer",
|
||||
"risk": "integer",
|
||||
"string": "string",
|
||||
"notString": "string",
|
||||
"regexp": "string",
|
||||
"code": "integer",
|
||||
"textOnly": "boolean",
|
||||
"titles": "boolean",
|
||||
},
|
||||
"Techniques": {
|
||||
"tech": "string",
|
||||
"timeSec": "integer",
|
||||
"uCols": "string",
|
||||
"uChar": "string",
|
||||
"uFrom": "string",
|
||||
"dnsName": "string",
|
||||
"secondOrder": "string",
|
||||
},
|
||||
|
||||
"Techniques": {
|
||||
"tech": "string",
|
||||
"timeSec": "integer",
|
||||
"uCols": "string",
|
||||
"uChar": "string",
|
||||
"uFrom": "string",
|
||||
"dnsDomain": "string",
|
||||
"secondUrl": "string",
|
||||
"secondReq": "string",
|
||||
},
|
||||
"Fingerprint": {
|
||||
"extensiveFp": "boolean",
|
||||
},
|
||||
|
||||
"Fingerprint": {
|
||||
"extensiveFp": "boolean",
|
||||
},
|
||||
"Enumeration": {
|
||||
"getAll": "boolean",
|
||||
"getBanner": ("boolean", "Banners"),
|
||||
"getCurrentUser": ("boolean", "Users"),
|
||||
"getCurrentDb": ("boolean", "Databases"),
|
||||
"getHostname": "boolean",
|
||||
"isDba": "boolean",
|
||||
"getUsers": ("boolean", "Users"),
|
||||
"getPasswordHashes": ("boolean", "Passwords"),
|
||||
"getPrivileges": ("boolean", "Privileges"),
|
||||
"getRoles": ("boolean", "Roles"),
|
||||
"getDbs": ("boolean", "Databases"),
|
||||
"getTables": ("boolean", "Tables"),
|
||||
"getColumns": ("boolean", "Columns"),
|
||||
"getSchema": "boolean",
|
||||
"getCount": "boolean",
|
||||
"dumpTable": "boolean",
|
||||
"dumpAll": "boolean",
|
||||
"search": "boolean",
|
||||
"getComments": "boolean",
|
||||
"db": "string",
|
||||
"tbl": "string",
|
||||
"col": "string",
|
||||
"excludeCol": "string",
|
||||
"pivotColumn": "string",
|
||||
"dumpWhere": "string",
|
||||
"user": "string",
|
||||
"excludeSysDbs": "boolean",
|
||||
"limitStart": "integer",
|
||||
"limitStop": "integer",
|
||||
"firstChar": "integer",
|
||||
"lastChar": "integer",
|
||||
"query": "string",
|
||||
"sqlShell": "boolean",
|
||||
"sqlFile": "string",
|
||||
},
|
||||
|
||||
"Enumeration": {
|
||||
"getAll": "boolean",
|
||||
"getBanner": ("boolean", "Banners"),
|
||||
"getCurrentUser": ("boolean", "Users"),
|
||||
"getCurrentDb": ("boolean", "Databases"),
|
||||
"getHostname": "boolean",
|
||||
"isDba": "boolean",
|
||||
"getUsers": ("boolean", "Users"),
|
||||
"getPasswordHashes": ("boolean", "Passwords"),
|
||||
"getPrivileges": ("boolean", "Privileges"),
|
||||
"getRoles": ("boolean", "Roles"),
|
||||
"getDbs": ("boolean", "Databases"),
|
||||
"getTables": ("boolean", "Tables"),
|
||||
"getColumns": ("boolean", "Columns"),
|
||||
"getSchema": "boolean",
|
||||
"getCount": "boolean",
|
||||
"dumpTable": "boolean",
|
||||
"dumpAll": "boolean",
|
||||
"search": "boolean",
|
||||
"getComments": "boolean",
|
||||
"db": "string",
|
||||
"tbl": "string",
|
||||
"col": "string",
|
||||
"exclude": "string",
|
||||
"pivotColumn": "string",
|
||||
"dumpWhere": "string",
|
||||
"user": "string",
|
||||
"excludeSysDbs": "boolean",
|
||||
"limitStart": "integer",
|
||||
"limitStop": "integer",
|
||||
"firstChar": "integer",
|
||||
"lastChar": "integer",
|
||||
"query": "string",
|
||||
"sqlShell": "boolean",
|
||||
"sqlFile": "string",
|
||||
},
|
||||
"Brute": {
|
||||
"commonTables": "boolean",
|
||||
"commonColumns": "boolean",
|
||||
},
|
||||
|
||||
"Brute": {
|
||||
"commonTables": "boolean",
|
||||
"commonColumns": "boolean",
|
||||
},
|
||||
"User-defined function": {
|
||||
"udfInject": "boolean",
|
||||
"shLib": "string",
|
||||
},
|
||||
|
||||
"User-defined function": {
|
||||
"udfInject": "boolean",
|
||||
"shLib": "string",
|
||||
},
|
||||
"File system": {
|
||||
"rFile": "string",
|
||||
"wFile": "string",
|
||||
"dFile": "string",
|
||||
},
|
||||
|
||||
"File system": {
|
||||
"fileRead": "string",
|
||||
"fileWrite": "string",
|
||||
"fileDest": "string",
|
||||
},
|
||||
"Takeover": {
|
||||
"osCmd": "string",
|
||||
"osShell": "boolean",
|
||||
"osPwn": "boolean",
|
||||
"osSmb": "boolean",
|
||||
"osBof": "boolean",
|
||||
"privEsc": "boolean",
|
||||
"msfPath": "string",
|
||||
"tmpPath": "string",
|
||||
},
|
||||
|
||||
"Takeover": {
|
||||
"osCmd": "string",
|
||||
"osShell": "boolean",
|
||||
"osPwn": "boolean",
|
||||
"osSmb": "boolean",
|
||||
"osBof": "boolean",
|
||||
"privEsc": "boolean",
|
||||
"msfPath": "string",
|
||||
"tmpPath": "string",
|
||||
},
|
||||
"Windows": {
|
||||
"regRead": "boolean",
|
||||
"regAdd": "boolean",
|
||||
"regDel": "boolean",
|
||||
"regKey": "string",
|
||||
"regVal": "string",
|
||||
"regData": "string",
|
||||
"regType": "string",
|
||||
},
|
||||
|
||||
"Windows": {
|
||||
"regRead": "boolean",
|
||||
"regAdd": "boolean",
|
||||
"regDel": "boolean",
|
||||
"regKey": "string",
|
||||
"regVal": "string",
|
||||
"regData": "string",
|
||||
"regType": "string",
|
||||
},
|
||||
"General": {
|
||||
#"xmlFile": "string",
|
||||
"trafficFile": "string",
|
||||
"batch": "boolean",
|
||||
"binaryFields": "string",
|
||||
"charset": "string",
|
||||
"crawlDepth": "integer",
|
||||
"crawlExclude": "string",
|
||||
"csvDel": "string",
|
||||
"dumpFormat": "string",
|
||||
"eta": "boolean",
|
||||
"flushSession": "boolean",
|
||||
"forms": "boolean",
|
||||
"freshQueries": "boolean",
|
||||
"hexConvert": "boolean",
|
||||
"outputDir": "string",
|
||||
"parseErrors": "boolean",
|
||||
"saveConfig": "string",
|
||||
"scope": "string",
|
||||
"testFilter": "string",
|
||||
"testSkip": "string",
|
||||
"updateAll": "boolean",
|
||||
},
|
||||
|
||||
"General": {
|
||||
# "xmlFile": "string",
|
||||
"trafficFile": "string",
|
||||
"batch": "boolean",
|
||||
"binaryFields": "string",
|
||||
"charset": "string",
|
||||
"checkInternet": "boolean",
|
||||
"crawlDepth": "integer",
|
||||
"crawlExclude": "string",
|
||||
"csvDel": "string",
|
||||
"dumpFormat": "string",
|
||||
"encoding": "string",
|
||||
"eta": "boolean",
|
||||
"flushSession": "boolean",
|
||||
"forms": "boolean",
|
||||
"freshQueries": "boolean",
|
||||
"harFile": "string",
|
||||
"hexConvert": "boolean",
|
||||
"outputDir": "string",
|
||||
"parseErrors": "boolean",
|
||||
"saveConfig": "string",
|
||||
"scope": "string",
|
||||
"testFilter": "string",
|
||||
"testSkip": "string",
|
||||
"updateAll": "boolean",
|
||||
},
|
||||
|
||||
"Miscellaneous": {
|
||||
"alert": "string",
|
||||
"answers": "string",
|
||||
"beep": "boolean",
|
||||
"cleanup": "boolean",
|
||||
"dependencies": "boolean",
|
||||
"disableColoring": "boolean",
|
||||
"googlePage": "integer",
|
||||
"identifyWaf": "boolean",
|
||||
"listTampers": "boolean",
|
||||
"mobile": "boolean",
|
||||
"offline": "boolean",
|
||||
"purge": "boolean",
|
||||
"skipWaf": "boolean",
|
||||
"smart": "boolean",
|
||||
"tmpDir": "string",
|
||||
"webRoot": "string",
|
||||
"wizard": "boolean",
|
||||
"verbose": "integer",
|
||||
},
|
||||
|
||||
"Hidden": {
|
||||
"dummy": "boolean",
|
||||
"disablePrecon": "boolean",
|
||||
"profile": "boolean",
|
||||
"forceDns": "boolean",
|
||||
"murphyRate": "integer",
|
||||
"smokeTest": "boolean",
|
||||
"liveTest": "boolean",
|
||||
"stopFail": "boolean",
|
||||
"runCase": "string",
|
||||
},
|
||||
|
||||
"API": {
|
||||
"api": "boolean",
|
||||
"taskid": "string",
|
||||
"database": "string",
|
||||
}
|
||||
}
|
||||
"Miscellaneous": {
|
||||
"alert": "string",
|
||||
"answers": "string",
|
||||
"beep": "boolean",
|
||||
"cleanup": "boolean",
|
||||
"dependencies": "boolean",
|
||||
"disableColoring": "boolean",
|
||||
"googlePage": "integer",
|
||||
"identifyWaf": "boolean",
|
||||
"mobile": "boolean",
|
||||
"offline": "boolean",
|
||||
"pageRank": "boolean",
|
||||
"purgeOutput": "boolean",
|
||||
"skipWaf": "boolean",
|
||||
"smart": "boolean",
|
||||
"tmpDir": "string",
|
||||
"wizard": "boolean",
|
||||
"verbose": "integer",
|
||||
},
|
||||
"Hidden": {
|
||||
"dummy": "boolean",
|
||||
"disablePrecon": "boolean",
|
||||
"profile": "boolean",
|
||||
"forceDns": "boolean",
|
||||
"ignore401": "boolean",
|
||||
"smokeTest": "boolean",
|
||||
"liveTest": "boolean",
|
||||
"stopFail": "boolean",
|
||||
"runCase": "string",
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import httplib
|
||||
|
||||
from lib.core.settings import IS_WIN
|
||||
|
||||
def dirtyPatches():
|
||||
"""
|
||||
Place for "dirty" Python related patches
|
||||
"""
|
||||
|
||||
# accept overly long result lines (e.g. SQLi results in HTTP header responses)
|
||||
httplib._MAXLINE = 1 * 1024 * 1024
|
||||
|
||||
# add support for inet_pton() on Windows OS
|
||||
if IS_WIN:
|
||||
from thirdparty.wininetpton import win_inet_pton
|
||||
|
||||
# Reference: https://github.com/nodejs/node/issues/12786#issuecomment-298652440
|
||||
codecs.register(lambda name: codecs.lookup("utf-8") if name == "cp65001" else None)
|
||||
+14
-24
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
@@ -20,9 +20,9 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
"""
|
||||
|
||||
try:
|
||||
__import__("gobject")
|
||||
from thirdparty.gprof2dot import gprof2dot
|
||||
from thirdparty.xdot import xdot
|
||||
import gobject
|
||||
import gtk
|
||||
import pydot
|
||||
except ImportError, e:
|
||||
@@ -50,7 +50,7 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
if os.path.exists(imageOutputFile):
|
||||
os.remove(imageOutputFile)
|
||||
|
||||
infoMsg = "profiling the execution into file '%s'" % profileOutputFile
|
||||
infoMsg = "profiling the execution into file %s" % profileOutputFile
|
||||
logger.info(infoMsg)
|
||||
|
||||
# Start sqlmap main function and generate a raw profile file
|
||||
@@ -75,25 +75,15 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
# Create graph image (png) by using pydot (python-pydot)
|
||||
# http://code.google.com/p/pydot/
|
||||
pydotGraph = pydot.graph_from_dot_file(dotOutputFile)
|
||||
pydotGraph.write_png(imageOutputFile)
|
||||
|
||||
# Reference: http://stackoverflow.com/questions/38176472/graph-write-pdfiris-pdf-attributeerror-list-object-has-no-attribute-writ
|
||||
if isinstance(pydotGraph, list):
|
||||
pydotGraph = pydotGraph[0]
|
||||
infoMsg = "displaying interactive graph with xdot library"
|
||||
logger.info(infoMsg)
|
||||
|
||||
try:
|
||||
pydotGraph.write_png(imageOutputFile)
|
||||
except OSError:
|
||||
errMsg = "profiling requires graphviz installed "
|
||||
errMsg += "(Hint: 'sudo apt-get install graphviz')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
infoMsg = "displaying interactive graph with xdot library"
|
||||
logger.info(infoMsg)
|
||||
|
||||
# Display interactive Graphviz dot file by using extra/xdot/xdot.py
|
||||
# http://code.google.com/p/jrfonseca/wiki/XDot
|
||||
win = xdot.DotWindow()
|
||||
win.connect('destroy', gtk.main_quit)
|
||||
win.set_filter("dot")
|
||||
win.open_file(dotOutputFile)
|
||||
gtk.main()
|
||||
# Display interactive Graphviz dot file by using extra/xdot/xdot.py
|
||||
# http://code.google.com/p/jrfonseca/wiki/XDot
|
||||
win = xdot.DotWindow()
|
||||
win.connect('destroy', gtk.main_quit)
|
||||
win.set_filter("dot")
|
||||
win.open_file(dotOutputFile)
|
||||
gtk.main()
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.data import logger
|
||||
@@ -14,11 +14,11 @@ _readline = None
|
||||
try:
|
||||
from readline import *
|
||||
import readline as _readline
|
||||
except:
|
||||
except ImportError:
|
||||
try:
|
||||
from pyreadline import *
|
||||
import pyreadline as _readline
|
||||
except:
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
if IS_WIN and _readline:
|
||||
|
||||
+6
-12
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import sqlite3
|
||||
@@ -10,7 +10,6 @@ import sqlite3
|
||||
from extra.safe2bin.safe2bin import safechardecode
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import unsafeSQLIdentificatorNaming
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapGenericException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
@@ -22,15 +21,10 @@ class Replication(object):
|
||||
"""
|
||||
|
||||
def __init__(self, dbpath):
|
||||
try:
|
||||
self.dbpath = dbpath
|
||||
self.connection = sqlite3.connect(dbpath)
|
||||
self.connection.isolation_level = None
|
||||
self.cursor = self.connection.cursor()
|
||||
except sqlite3.OperationalError, ex:
|
||||
errMsg = "error occurred while opening a replication "
|
||||
errMsg += "file '%s' ('%s')" % (self.filepath, getSafeExString(ex))
|
||||
raise SqlmapConnectionException(errMsg)
|
||||
self.dbpath = dbpath
|
||||
self.connection = sqlite3.connect(dbpath)
|
||||
self.connection.isolation_level = None
|
||||
self.cursor = self.connection.cursor()
|
||||
|
||||
class DataType:
|
||||
"""
|
||||
|
||||
@@ -1,13 +1,15 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
|
||||
from subprocess import PIPE
|
||||
from subprocess import Popen as execute
|
||||
|
||||
def getRevisionNumber():
|
||||
"""
|
||||
@@ -44,7 +46,7 @@ def getRevisionNumber():
|
||||
break
|
||||
|
||||
if not retVal:
|
||||
process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
process = execute("git rev-parse --verify HEAD", shell=True, stdout=PIPE, stderr=PIPE)
|
||||
stdout, _ = process.communicate()
|
||||
match = re.search(r"(?i)[0-9a-f]{32}", stdout or "")
|
||||
retVal = match.group(0) if match else None
|
||||
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import re
|
||||
|
||||
+119
-191
@@ -1,12 +1,11 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import random
|
||||
import re
|
||||
import subprocess
|
||||
import string
|
||||
@@ -17,39 +16,35 @@ from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import DBMS
|
||||
from lib.core.enums import DBMS_DIRECTORY_NAME
|
||||
from lib.core.enums import OS
|
||||
from lib.core.revision import getRevisionNumber
|
||||
|
||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||
VERSION = "1.3"
|
||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||
VERSION = "1.0.8.2"
|
||||
REVISION = getRevisionNumber()
|
||||
STABLE = VERSION.count('.') <= 2
|
||||
VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")
|
||||
DESCRIPTION = "automatic SQL injection and database takeover tool"
|
||||
SITE = "http://sqlmap.org"
|
||||
DEFAULT_USER_AGENT = "%s (%s)" % (VERSION_STRING, SITE)
|
||||
DEV_EMAIL_ADDRESS = "[email protected]"
|
||||
ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new"
|
||||
GIT_REPOSITORY = "https://github.com/sqlmapproject/sqlmap.git"
|
||||
GIT_REPOSITORY = "git://github.com/sqlmapproject/sqlmap.git"
|
||||
GIT_PAGE = "https://github.com/sqlmapproject/sqlmap"
|
||||
ZIPBALL_PAGE = "https://github.com/sqlmapproject/sqlmap/zipball/master"
|
||||
|
||||
# colorful banner
|
||||
BANNER = """\033[01;33m\
|
||||
___
|
||||
__H__
|
||||
___ ___[.]_____ ___ ___ \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m
|
||||
|_ -| . [.] | .'| . |
|
||||
|___|_ [.]_|_|_|__,| _|
|
||||
|_|V |_| \033[0m\033[4;37m%s\033[0m\n
|
||||
""" % (TYPE_COLORS.get(TYPE, 31), VERSION_STRING.split('/')[-1], SITE)
|
||||
BANNER = """\033[01;33m _
|
||||
___ ___| |_____ ___ ___ \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m
|
||||
|_ -| . | | | .'| . |
|
||||
|___|_ |_|_|_|_|__,| _|
|
||||
|_| |_| \033[0m\033[4;37m%s\033[0m\n
|
||||
""" % ((31 + hash(VERSION) % 6) if not STABLE else 30, VERSION_STRING.split('/')[-1], SITE)
|
||||
|
||||
# Minimum distance of ratio from kb.matchRatio to result in True
|
||||
DIFF_TOLERANCE = 0.05
|
||||
CONSTANT_RATIO = 0.9
|
||||
|
||||
# Ratio used in heuristic check for WAF/IPS protected targets
|
||||
# Ratio used in heuristic check for WAF/IDS/IPS protected targets
|
||||
IDS_WAF_CHECK_RATIO = 0.5
|
||||
|
||||
# Timeout used in heuristic check for WAF/IPS protected targets
|
||||
# Timeout used in heuristic check for WAF/IDS/IPS protected targets
|
||||
IDS_WAF_CHECK_TIMEOUT = 10
|
||||
|
||||
# Lower and upper values for match ratio in case of stable page
|
||||
@@ -66,62 +61,46 @@ URI_QUESTION_MARKER = "__QUESTION_MARK__"
|
||||
ASTERISK_MARKER = "__ASTERISK_MARK__"
|
||||
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
||||
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
||||
SAFE_VARIABLE_MARKER = "__SAFE__"
|
||||
|
||||
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
||||
RANDOM_STRING_MARKER = "[RANDSTR]"
|
||||
SLEEP_TIME_MARKER = "[SLEEPTIME]"
|
||||
INFERENCE_MARKER = "[INFERENCE]"
|
||||
SINGLE_QUOTE_MARKER = "[SINGLE_QUOTE]"
|
||||
|
||||
PAYLOAD_DELIMITER = "__PAYLOAD_DELIMITER__"
|
||||
CHAR_INFERENCE_MARK = "%c"
|
||||
PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7f-\xff]"
|
||||
|
||||
# Regular expression used for extraction of table names (useful for (e.g.) MsAccess)
|
||||
SELECT_FROM_TABLE_REGEX = r"\bSELECT\b.+?\bFROM\s+(?P<result>([\w.]|`[^`<>]+`)+)"
|
||||
SELECT_FROM_TABLE_REGEX = r"\bSELECT .+? FROM (?P<result>[\w.]+)\b"
|
||||
|
||||
# Regular expression used for recognition of textual content-type
|
||||
TEXT_CONTENT_TYPE_REGEX = r"(?i)(text|form|message|xml|javascript|ecmascript|json)"
|
||||
|
||||
# Regular expression used for recognition of generic permission messages
|
||||
PERMISSION_DENIED_REGEX = r"(?P<result>(command|permission|access)\s*(was|is)?\s*denied)"
|
||||
|
||||
# Regular expression used in recognition of generic protection mechanisms
|
||||
GENERIC_PROTECTION_REGEX = r"(?i)\b(rejected|blocked|protection|incident|denied|detected|dangerous|firewall)\b"
|
||||
PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied"
|
||||
|
||||
# Regular expression used for recognition of generic maximum connection messages
|
||||
MAX_CONNECTIONS_REGEX = r"\bmax.+?\bconnection"
|
||||
|
||||
# Maximum consecutive connection errors before asking the user if he wants to continue
|
||||
MAX_CONSECUTIVE_CONNECTION_ERRORS = 15
|
||||
MAX_CONNECTIONS_REGEX = r"max.+connections"
|
||||
|
||||
# Timeout before the pre-connection candidate is being disposed (because of high probability that the web server will reset it)
|
||||
PRECONNECT_CANDIDATE_TIMEOUT = 10
|
||||
|
||||
# Servers known to cause issue with pre-connection mechanism (because of lack of multi-threaded support)
|
||||
PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP",)
|
||||
|
||||
# Maximum sleep time in "Murphy" (testing) mode
|
||||
MAX_MURPHY_SLEEP_TIME = 3
|
||||
|
||||
# Regular expression used for extracting results from Google search
|
||||
GOOGLE_REGEX = r"webcache\.googleusercontent\.com/search\?q=cache:[^:]+:([^+]+)\+&cd=|url\?\w+=((?![^>]+webcache\.googleusercontent\.com)http[^>]+)&(sa=U|rct=j)"
|
||||
|
||||
# Regular expression used for extracting results from DuckDuckGo search
|
||||
DUCKDUCKGO_REGEX = r'"u":"([^"]+)'
|
||||
|
||||
# Regular expression used for extracting results from Bing search
|
||||
BING_REGEX = r'<h2><a href="([^"]+)" h='
|
||||
# Regular expression used for extracting results from Disconnect Search
|
||||
DISCONNECT_SEARCH_REGEX = r'<p class="url wrapword">([^<]+)</p>'
|
||||
|
||||
# Dummy user agent for search (if default one returns different results)
|
||||
DUMMY_SEARCH_USER_AGENT = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0"
|
||||
DUMMY_SEARCH_USER_AGENT = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0"
|
||||
|
||||
# Regular expression used for extracting content from "textual" tags
|
||||
TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)"
|
||||
|
||||
# Regular expression used for recognition of IP addresses
|
||||
IP_ADDRESS_REGEX = r"\b(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\b"
|
||||
IP_ADDRESS_REGEX = r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
|
||||
|
||||
# Regular expression used for recognition of generic "your ip has been blocked" messages
|
||||
BLOCKED_IP_REGEX = r"(?i)(\A|\b)ip\b.*\b(banned|blocked|block list|firewall)"
|
||||
@@ -149,7 +128,7 @@ UNION_STDEV_COEFF = 7
|
||||
TIME_DELAY_CANDIDATES = 3
|
||||
|
||||
# Default value for HTTP Accept header
|
||||
HTTP_ACCEPT_HEADER_VALUE = "*/*"
|
||||
HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
|
||||
|
||||
# Default value for HTTP Accept-Encoding header
|
||||
HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate"
|
||||
@@ -175,9 +154,6 @@ PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3
|
||||
# Minimum time response set needed for time-comparison based on standard deviation
|
||||
MIN_TIME_RESPONSES = 30
|
||||
|
||||
# Maximum time response set used during time-comparison based on standard deviation
|
||||
MAX_TIME_RESPONSES = 200
|
||||
|
||||
# Minimum comparison ratio set needed for searching valid union column number based on standard deviation
|
||||
MIN_UNION_RESPONSES = 5
|
||||
|
||||
@@ -190,9 +166,6 @@ INFERENCE_UNKNOWN_CHAR = '?'
|
||||
# Character used for operation "greater" in inference
|
||||
INFERENCE_GREATER_CHAR = ">"
|
||||
|
||||
# Character used for operation "greater or equal" in inference
|
||||
INFERENCE_GREATER_EQUALS_CHAR = ">="
|
||||
|
||||
# Character used for operation "equals" in inference
|
||||
INFERENCE_EQUALS_CHAR = "="
|
||||
|
||||
@@ -205,8 +178,8 @@ UNKNOWN_DBMS = "Unknown"
|
||||
# String used for representation of unknown DBMS version
|
||||
UNKNOWN_DBMS_VERSION = "Unknown"
|
||||
|
||||
# Dynamicity boundary length used in dynamicity removal engine
|
||||
DYNAMICITY_BOUNDARY_LENGTH = 20
|
||||
# Dynamicity mark length used in dynamicity removal engine
|
||||
DYNAMICITY_MARK_LENGTH = 32
|
||||
|
||||
# Dummy user prefix used in dictionary attack
|
||||
DUMMY_USER_PREFIX = "__dummy__"
|
||||
@@ -214,11 +187,6 @@ DUMMY_USER_PREFIX = "__dummy__"
|
||||
# Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1
|
||||
DEFAULT_PAGE_ENCODING = "iso-8859-1"
|
||||
|
||||
try:
|
||||
unicode(DEFAULT_PAGE_ENCODING, DEFAULT_PAGE_ENCODING)
|
||||
except LookupError:
|
||||
DEFAULT_PAGE_ENCODING = "utf8"
|
||||
|
||||
# URL used in dummy runs
|
||||
DUMMY_URL = "http://foo/bar?id=1"
|
||||
|
||||
@@ -231,21 +199,26 @@ PYVERSION = sys.version.split()[0]
|
||||
|
||||
# DBMS system databases
|
||||
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb")
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql", "performance_schema")
|
||||
PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast", "pgagent")
|
||||
ORACLE_SYSTEM_DBS = ('ANONYMOUS', 'APEX_030200', 'APEX_PUBLIC_USER', 'APPQOSSYS', 'BI', 'CTXSYS', 'DBSNMP', 'DIP', 'EXFSYS', 'FLOWS_%', 'FLOWS_FILES', 'HR', 'IX', 'LBACSYS', 'MDDATA', 'MDSYS', 'MGMT_VIEW', 'OC', 'OE', 'OLAPSYS', 'ORACLE_OCM', 'ORDDATA', 'ORDPLUGINS', 'ORDSYS', 'OUTLN', 'OWBSYS', 'PM', 'SCOTT', 'SH', 'SI_INFORMTN_SCHEMA', 'SPATIAL_CSW_ADMIN_USR', 'SPATIAL_WFS_ADMIN_USR', 'SYS', 'SYSMAN', 'SYSTEM', 'WKPROXY', 'WKSYS', 'WK_TEST', 'WMSYS', 'XDB', 'XS$NULL')
|
||||
MYSQL_SYSTEM_DBS = ("information_schema", "mysql") # Before MySQL 5.0 only "mysql"
|
||||
PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast")
|
||||
ORACLE_SYSTEM_DBS = ("CTXSYS", "DBSNMP", "DMSYS", "EXFSYS", "MDSYS", "OLAPSYS", "ORDSYS", "OUTLN", "SYS", "SYSAUX", "SYSMAN", "SYSTEM", "TSMSYS", "WMSYS", "XDB") # These are TABLESPACE_NAME
|
||||
SQLITE_SYSTEM_DBS = ("sqlite_master", "sqlite_temp_master")
|
||||
ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage", "MSysAccessXML", "MSysModules", "MSysModules2")
|
||||
FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE", "RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS", "RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES", "RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS", "RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS", "RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS")
|
||||
ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage",\
|
||||
"MSysAccessXML", "MSysModules", "MSysModules2")
|
||||
FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE",\
|
||||
"RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS",\
|
||||
"RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES",\
|
||||
"RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS",\
|
||||
"RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS",\
|
||||
"RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS")
|
||||
MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN")
|
||||
SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs")
|
||||
DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS", "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
|
||||
DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS",\
|
||||
"SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS")
|
||||
HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB")
|
||||
H2_SYSTEM_DBS = ("INFORMATION_SCHEMA")
|
||||
INFORMIX_SYSTEM_DBS = ("sysmaster", "sysutils", "sysuser", "sysadmin")
|
||||
|
||||
MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
|
||||
MYSQL_ALIASES = ("mysql", "my", "mariadb", "maria")
|
||||
MYSQL_ALIASES = ("mysql", "my")
|
||||
PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg")
|
||||
ORACLE_ALIASES = ("oracle", "orcl", "ora", "or")
|
||||
SQLITE_ALIASES = ("sqlite", "sqlite3")
|
||||
@@ -255,64 +228,58 @@ MAXDB_ALIASES = ("maxdb", "sap maxdb", "sap db")
|
||||
SYBASE_ALIASES = ("sybase", "sybase sql server")
|
||||
DB2_ALIASES = ("db2", "ibm db2", "ibmdb2")
|
||||
HSQLDB_ALIASES = ("hsql", "hsqldb", "hs", "hypersql")
|
||||
H2_ALIASES = ("h2",)
|
||||
INFORMIX_ALIASES = ("informix", "ibm informix", "ibminformix")
|
||||
|
||||
DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_"))
|
||||
|
||||
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES
|
||||
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES
|
||||
SUPPORTED_OS = ("linux", "windows")
|
||||
|
||||
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES))
|
||||
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES))
|
||||
|
||||
USER_AGENT_ALIASES = ("ua", "useragent", "user-agent")
|
||||
REFERER_ALIASES = ("ref", "referer", "referrer")
|
||||
HOST_ALIASES = ("host",)
|
||||
|
||||
H2_DEFAULT_SCHEMA = HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
|
||||
HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
|
||||
|
||||
# Names that can't be used to name files on Windows OS
|
||||
WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9")
|
||||
|
||||
# Items displayed in basic help (-h) output
|
||||
BASIC_HELP_ITEMS = (
|
||||
"url",
|
||||
"googleDork",
|
||||
"data",
|
||||
"cookie",
|
||||
"randomAgent",
|
||||
"proxy",
|
||||
"testParameter",
|
||||
"dbms",
|
||||
"level",
|
||||
"risk",
|
||||
"tech",
|
||||
"getAll",
|
||||
"getBanner",
|
||||
"getCurrentUser",
|
||||
"getCurrentDb",
|
||||
"getPasswordHashes",
|
||||
"getTables",
|
||||
"getColumns",
|
||||
"getSchema",
|
||||
"dumpTable",
|
||||
"dumpAll",
|
||||
"db",
|
||||
"tbl",
|
||||
"col",
|
||||
"osShell",
|
||||
"osPwn",
|
||||
"batch",
|
||||
"checkTor",
|
||||
"flushSession",
|
||||
"tor",
|
||||
"sqlmapShell",
|
||||
"wizard",
|
||||
)
|
||||
|
||||
# Tags used for value replacements inside shell scripts
|
||||
SHELL_WRITABLE_DIR_TAG = "%WRITABLE_DIR%"
|
||||
SHELL_RUNCMD_EXE_TAG = "%RUNCMD_EXE%"
|
||||
"url",
|
||||
"googleDork",
|
||||
"data",
|
||||
"cookie",
|
||||
"randomAgent",
|
||||
"proxy",
|
||||
"testParameter",
|
||||
"dbms",
|
||||
"level",
|
||||
"risk",
|
||||
"tech",
|
||||
"getAll",
|
||||
"getBanner",
|
||||
"getCurrentUser",
|
||||
"getCurrentDb",
|
||||
"getPasswordHashes",
|
||||
"getTables",
|
||||
"getColumns",
|
||||
"getSchema",
|
||||
"dumpTable",
|
||||
"dumpAll",
|
||||
"db",
|
||||
"tbl",
|
||||
"col",
|
||||
"osShell",
|
||||
"osPwn",
|
||||
"batch",
|
||||
"checkTor",
|
||||
"flushSession",
|
||||
"tor",
|
||||
"sqlmapShell",
|
||||
"wizard",
|
||||
)
|
||||
|
||||
# String representation for NULL value
|
||||
NULL = "NULL"
|
||||
@@ -323,23 +290,17 @@ BLANK = "<blank>"
|
||||
# String representation for current database
|
||||
CURRENT_DB = "CD"
|
||||
|
||||
# Name of SQLite file used for storing session data
|
||||
SESSION_SQLITE_FILE = "session.sqlite"
|
||||
|
||||
# Regular expressions used for finding file paths in error messages
|
||||
FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line \d+", r"in (?P<result>[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.~-]+)", r"href=['\"]file://(?P<result>/[^'\"]+)")
|
||||
FILE_PATH_REGEXES = (r" in (file )?<b>(?P<result>.*?)</b> on line \d+", r"in (?P<result>[^<>]+?) on line \d+", r"(?:[>(\[\s])(?P<result>[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P<result>/\w[/\w.-]+)", r"href=['\"]file://(?P<result>/[^'\"]+)")
|
||||
|
||||
# Regular expressions used for parsing error messages (--parse-errors)
|
||||
ERROR_PARSING_REGEXES = (
|
||||
r"\[Microsoft\]\[ODBC SQL Server Driver\]\[SQL Server\](?P<result>[^<]+)",
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>[^<]+)",
|
||||
r"(?m)^\s*(fatal|error|warning|exception):?\s*(?P<result>[^\n]+?)$",
|
||||
r"(?P<result>[^\n>]*SQL Syntax[^\n<]+)",
|
||||
r"<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"CDbCommand (?P<result>[^<>\n]*SQL[^<>\n]+)",
|
||||
r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P<result>[^<>]+)",
|
||||
r"\[[^\n\]]+(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P<result>[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)"
|
||||
)
|
||||
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>.+?)<br\s*/?\s*>",
|
||||
r"(?m)^(fatal|error|warning|exception):?\s*(?P<result>[^\n]+?)$",
|
||||
r"<li>Error Type:<br>(?P<result>.+?)</li>",
|
||||
r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P<result>[^<>]+)",
|
||||
r"(?m)^\s*\[[^\n]+(ODBC|JDBC)[^\n]+\](?P<result>[^\]]+in query expression[^\n]+)$"
|
||||
)
|
||||
|
||||
# Regular expression used for parsing charset info from meta html headers
|
||||
META_CHARSET_REGEX = r'(?si)<head>.*<meta[^>]+charset="?(?P<result>[^"> ]+).*</head>'
|
||||
@@ -375,10 +336,7 @@ URI_HTTP_HEADER = "URI"
|
||||
URI_INJECTABLE_REGEX = r"//[^/]*/([^\.*?]+)\Z"
|
||||
|
||||
# Regex used for masking sensitive data
|
||||
SENSITIVE_DATA_REGEX = r"(\s|=)(?P<result>[^\s=]*%s[^\s]*)\s"
|
||||
|
||||
# Options to explicitly mask in anonymous (unhandled exception) reports (along with anything carrying the <hostname> inside)
|
||||
SENSITIVE_OPTIONS = ("hostname", "answers", "data", "dnsDomain", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "fileRead", "fileWrite", "fileDest", "testParameter", "authCred")
|
||||
SENSITIVE_DATA_REGEX = "(\s|=)(?P<result>[^\s=]*%s[^\s]*)\s"
|
||||
|
||||
# Maximum number of threads (avoiding connection issues and/or DoS)
|
||||
MAX_NUMBER_OF_THREADS = 10
|
||||
@@ -392,14 +350,11 @@ MIN_RATIO = 0.0
|
||||
# Maximum value for comparison ratio
|
||||
MAX_RATIO = 1.0
|
||||
|
||||
# Minimum length of sentence for automatic choosing of --string (in case of high matching ratio)
|
||||
CANDIDATE_SENTENCE_MIN_LENGTH = 10
|
||||
|
||||
# Character used for marking injectable position inside provided data
|
||||
CUSTOM_INJECTION_MARK_CHAR = '*'
|
||||
|
||||
# Other way to declare injection position
|
||||
INJECT_HERE_REGEX = r"(?i)%INJECT[_ ]?HERE%"
|
||||
INJECT_HERE_MARK = '%INJECT HERE%'
|
||||
|
||||
# Minimum chunk length used for retrieving data over error based payloads
|
||||
MIN_ERROR_CHUNK_LENGTH = 8
|
||||
@@ -417,10 +372,7 @@ REFLECTED_VALUE_MARKER = "__REFLECTED_VALUE__"
|
||||
REFLECTED_BORDER_REGEX = r"[^A-Za-z]+"
|
||||
|
||||
# Regular expression used for replacing non-alphanum characters
|
||||
REFLECTED_REPLACEMENT_REGEX = r"[^\n]{1,100}"
|
||||
|
||||
# Maximum time (in seconds) spent per reflective value(s) replacement
|
||||
REFLECTED_REPLACEMENT_TIMEOUT = 3
|
||||
REFLECTED_REPLACEMENT_REGEX = r".+"
|
||||
|
||||
# Maximum number of alpha-numerical parts in reflected regex (for speed purposes)
|
||||
REFLECTED_MAX_REGEX_PARTS = 10
|
||||
@@ -437,20 +389,14 @@ DEFAULT_MSSQL_SCHEMA = "dbo"
|
||||
# Display hash attack info every mod number of items
|
||||
HASH_MOD_ITEM_DISPLAY = 11
|
||||
|
||||
# Display marker for (cracked) empty password
|
||||
HASH_EMPTY_PASSWORD_MARKER = "<empty>"
|
||||
|
||||
# Maximum integer value
|
||||
MAX_INT = sys.maxint
|
||||
|
||||
# Replacement for unsafe characters in dump table filenames
|
||||
UNSAFE_DUMP_FILEPATH_REPLACEMENT = '_'
|
||||
|
||||
# Options that need to be restored in multiple targets run mode
|
||||
RESTORE_MERGED_OPTIONS = ("col", "db", "dnsDomain", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user")
|
||||
RESTORE_MERGED_OPTIONS = ("col", "db", "dnsName", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user")
|
||||
|
||||
# Parameters to be ignored in detection phase (upper case)
|
||||
IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__VIEWSTATEGENERATOR", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN")
|
||||
IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN")
|
||||
|
||||
# Regular expression used for recognition of ASP.NET control parameters
|
||||
ASP_NET_CONTROL_REGEX = r"(?i)\Actl\d+\$"
|
||||
@@ -479,10 +425,10 @@ IGNORE_SAVE_OPTIONS = ("saveConfig",)
|
||||
# IP address of the localhost
|
||||
LOCALHOST = "127.0.0.1"
|
||||
|
||||
# Default SOCKS ports used by Tor
|
||||
DEFAULT_TOR_SOCKS_PORTS = (9050, 9150)
|
||||
# Default port used by Tor
|
||||
DEFAULT_TOR_SOCKS_PORT = 9050
|
||||
|
||||
# Default HTTP ports used by Tor
|
||||
# Default ports used in Tor proxy bundles
|
||||
DEFAULT_TOR_HTTP_PORTS = (8123, 8118)
|
||||
|
||||
# Percentage below which comparison engine could have problems
|
||||
@@ -492,16 +438,13 @@ LOW_TEXT_PERCENT = 20
|
||||
# Reference: http://dev.mysql.com/doc/refman/5.1/en/function-resolution.html
|
||||
IGNORE_SPACE_AFFECTED_KEYWORDS = ("CAST", "COUNT", "EXTRACT", "GROUP_CONCAT", "MAX", "MID", "MIN", "SESSION_USER", "SUBSTR", "SUBSTRING", "SUM", "SYSTEM_USER", "TRIM")
|
||||
|
||||
# Keywords expected to be in UPPERCASE in getValue()
|
||||
GET_VALUE_UPPERCASE_KEYWORDS = ("SELECT", "FROM", "WHERE", "DISTINCT", "COUNT")
|
||||
|
||||
LEGAL_DISCLAIMER = "Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program"
|
||||
|
||||
# After this number of misses reflective removal mechanism is turned off (for speed up reasons)
|
||||
REFLECTIVE_MISS_THRESHOLD = 20
|
||||
|
||||
# Regular expression used for extracting HTML title
|
||||
HTML_TITLE_REGEX = r"<title>(?P<result>[^<]+)</title>"
|
||||
HTML_TITLE_REGEX = "<title>(?P<result>[^<]+)</title>"
|
||||
|
||||
# Table used for Base64 conversion in WordPress hash cracking routine
|
||||
ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
||||
@@ -512,12 +455,12 @@ PICKLE_REDUCE_WHITELIST = (types.BooleanType, types.DictType, types.FloatType, t
|
||||
DUMMY_SQL_INJECTION_CHARS = ";()'"
|
||||
|
||||
# Simple check against dummy users
|
||||
DUMMY_USER_INJECTION = r"(?i)[^\w](AND|OR)\s+[^\s]+[=><]|\bUNION\b.+\bSELECT\b|\bSELECT\b.+\bFROM\b|\b(CONCAT|information_schema|SLEEP|DELAY|FLOOR\(RAND)\b"
|
||||
DUMMY_USER_INJECTION = r"(?i)[^\w](AND|OR)\s+[^\s]+[=><]|\bUNION\b.+\bSELECT\b|\bSELECT\b.+\bFROM\b|\b(CONCAT|information_schema|SLEEP|DELAY)\b"
|
||||
|
||||
# Extensions skipped by crawler
|
||||
CRAWL_EXCLUDE_EXTENSIONS = ("3ds", "3g2", "3gp", "7z", "DS_Store", "a", "aac", "adp", "ai", "aif", "aiff", "apk", "ar", "asf", "au", "avi", "bak", "bin", "bk", "bmp", "btif", "bz2", "cab", "caf", "cgm", "cmx", "cpio", "cr2", "dat", "deb", "djvu", "dll", "dmg", "dmp", "dng", "doc", "docx", "dot", "dotx", "dra", "dsk", "dts", "dtshd", "dvb", "dwg", "dxf", "ear", "ecelp4800", "ecelp7470", "ecelp9600", "egg", "eol", "eot", "epub", "exe", "f4v", "fbs", "fh", "fla", "flac", "fli", "flv", "fpx", "fst", "fvt", "g3", "gif", "gz", "h261", "h263", "h264", "ico", "ief", "image", "img", "ipa", "iso", "jar", "jpeg", "jpg", "jpgv", "jpm", "jxr", "ktx", "lvp", "lz", "lzma", "lzo", "m3u", "m4a", "m4v", "mar", "mdi", "mid", "mj2", "mka", "mkv", "mmr", "mng", "mov", "movie", "mp3", "mp4", "mp4a", "mpeg", "mpg", "mpga", "mxu", "nef", "npx", "o", "oga", "ogg", "ogv", "otf", "pbm", "pcx", "pdf", "pea", "pgm", "pic", "png", "pnm", "ppm", "pps", "ppt", "pptx", "ps", "psd", "pya", "pyc", "pyo", "pyv", "qt", "rar", "ras", "raw", "rgb", "rip", "rlc", "rz", "s3m", "s7z", "scm", "scpt", "sgi", "shar", "sil", "smv", "so", "sub", "swf", "tar", "tbz2", "tga", "tgz", "tif", "tiff", "tlz", "ts", "ttf", "uvh", "uvi", "uvm", "uvp", "uvs", "uvu", "viv", "vob", "war", "wav", "wax", "wbmp", "wdp", "weba", "webm", "webp", "whl", "wm", "wma", "wmv", "wmx", "woff", "woff2", "wvx", "xbm", "xif", "xls", "xlsx", "xlt", "xm", "xpi", "xpm", "xwd", "xz", "z", "zip", "zipx")
|
||||
CRAWL_EXCLUDE_EXTENSIONS = ('3ds', '3g2', '3gp', '7z', 'DS_Store', 'a', 'aac', 'adp', 'ai', 'aif', 'aiff', 'apk', 'ar', 'asf', 'au', 'avi', 'bak', 'bin', 'bk', 'bmp', 'btif', 'bz2', 'cab', 'caf', 'cgm', 'cmx', 'cpio', 'cr2', 'dat', 'deb', 'djvu', 'dll', 'dmg', 'dmp', 'dng', 'doc', 'docx', 'dot', 'dotx', 'dra', 'dsk', 'dts', 'dtshd', 'dvb', 'dwg', 'dxf', 'ear', 'ecelp4800', 'ecelp7470', 'ecelp9600', 'egg', 'eol', 'eot', 'epub', 'exe', 'f4v', 'fbs', 'fh', 'fla', 'flac', 'fli', 'flv', 'fpx', 'fst', 'fvt', 'g3', 'gif', 'gz', 'h261', 'h263', 'h264', 'ico', 'ief', 'image', 'img', 'ipa', 'iso', 'jar', 'jpeg', 'jpg', 'jpgv', 'jpm', 'jxr', 'ktx', 'lvp', 'lz', 'lzma', 'lzo', 'm3u', 'm4a', 'm4v', 'mar', 'mdi', 'mid', 'mj2', 'mka', 'mkv', 'mmr', 'mng', 'mov', 'movie', 'mp3', 'mp4', 'mp4a', 'mpeg', 'mpg', 'mpga', 'mxu', 'nef', 'npx', 'o', 'oga', 'ogg', 'ogv', 'otf', 'pbm', 'pcx', 'pdf', 'pea', 'pgm', 'pic', 'png', 'pnm', 'ppm', 'pps', 'ppt', 'pptx', 'ps', 'psd', 'pya', 'pyc', 'pyo', 'pyv', 'qt', 'rar', 'ras', 'raw', 'rgb', 'rip', 'rlc', 'rz', 's3m', 's7z', 'scm', 'scpt', 'sgi', 'shar', 'sil', 'smv', 'so', 'sub', 'swf', 'tar', 'tbz2', 'tga', 'tgz', 'tif', 'tiff', 'tlz', 'ts', 'ttf', 'uvh', 'uvi', 'uvm', 'uvp', 'uvs', 'uvu', 'viv', 'vob', 'war', 'wav', 'wax', 'wbmp', 'wdp', 'weba', 'webm', 'webp', 'whl', 'wm', 'wma', 'wmv', 'wmx', 'woff', 'woff2', 'wvx', 'xbm', 'xif', 'xls', 'xlsx', 'xlt', 'xm', 'xpi', 'xpm', 'xwd', 'xz', 'z', 'zip', 'zipx')
|
||||
|
||||
# Patterns often seen in HTTP headers containing custom injection marking character '*'
|
||||
# Patterns often seen in HTTP headers containing custom injection marking character
|
||||
PROBLEMATIC_CUSTOM_INJECTION_PATTERNS = r"(;q=[^;']+)|(\*/\*)"
|
||||
|
||||
# Template used for common table existence check
|
||||
@@ -532,20 +475,14 @@ IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")
|
||||
# Data inside shellcodeexec to be filled with random string
|
||||
SHELLCODEEXEC_RANDOM_STRING_MARKER = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
||||
|
||||
# Generic address for checking the Internet connection while using switch --check-internet
|
||||
CHECK_INTERNET_ADDRESS = "https://ipinfo.io/"
|
||||
|
||||
# Value to look for in response to CHECK_INTERNET_ADDRESS
|
||||
CHECK_INTERNET_VALUE = "IP Address Details"
|
||||
|
||||
# Vectors used for provoking specific WAF/IPS behavior(s)
|
||||
# Vectors used for provoking specific WAF/IDS/IPS behavior(s)
|
||||
WAF_ATTACK_VECTORS = (
|
||||
"", # NIL
|
||||
"search=<script>alert(1)</script>",
|
||||
"file=../../../../etc/passwd",
|
||||
"q=<invalid>foobar",
|
||||
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
|
||||
)
|
||||
"", # NIL
|
||||
"search=<script>alert(1)</script>",
|
||||
"file=../../../../etc/passwd",
|
||||
"q=<invalid>foobar",
|
||||
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
|
||||
)
|
||||
|
||||
# Used for status representation in dictionary attack phase
|
||||
ROTATING_CHARS = ('\\', '|', '|', '/', '-')
|
||||
@@ -553,9 +490,6 @@ ROTATING_CHARS = ('\\', '|', '|', '/', '-')
|
||||
# Approximate chunk length (in bytes) used by BigArray objects (only last chunk and cached one are held in memory)
|
||||
BIGARRAY_CHUNK_SIZE = 1024 * 1024
|
||||
|
||||
# Compress level used for storing BigArray chunks to disk (0-9)
|
||||
BIGARRAY_COMPRESS_LEVEL = 9
|
||||
|
||||
# Maximum number of socket pre-connects
|
||||
SOCKET_PRE_CONNECT_QUEUE_SIZE = 3
|
||||
|
||||
@@ -572,20 +506,20 @@ PARSE_HEADERS_LIMIT = 3
|
||||
# Step used in ORDER BY technique used for finding the right number of columns in UNION query injections
|
||||
ORDER_BY_STEP = 10
|
||||
|
||||
# Maximum number of times for revalidation of a character in inference (as required)
|
||||
MAX_REVALIDATION_STEPS = 5
|
||||
# Maximum number of times for revalidation of a character in time-based injections
|
||||
MAX_TIME_REVALIDATION_STEPS = 5
|
||||
|
||||
# Characters that can be used to split parameter values in provided command line (e.g. in --tamper)
|
||||
PARAMETER_SPLITTING_REGEX = r"[,|;]"
|
||||
PARAMETER_SPLITTING_REGEX = r'[,|;]'
|
||||
|
||||
# Regular expression describing possible union char value (e.g. used in --union-char)
|
||||
UNION_CHAR_REGEX = r"\A\w+\Z"
|
||||
UNION_CHAR_REGEX = r'\A\w+\Z'
|
||||
|
||||
# Attribute used for storing original parameter value in special cases (e.g. POST)
|
||||
UNENCODED_ORIGINAL_VALUE = "original"
|
||||
UNENCODED_ORIGINAL_VALUE = 'original'
|
||||
|
||||
# Common column names containing usernames (used for hash cracking in some cases)
|
||||
COMMON_USER_COLUMNS = ("login", "user", "username", "user_name", "user_login", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "utilizator", "utilizador", "usufrutuario", "korisnik", "uporabnik", "usuario", "consumidor", "client", "cuser")
|
||||
COMMON_USER_COLUMNS = ('user', 'username', 'user_name', 'benutzername', 'benutzer', 'utilisateur', 'usager', 'consommateur', 'utente', 'utilizzatore', 'usufrutuario', 'korisnik', 'usuario', 'consumidor')
|
||||
|
||||
# Default delimiter in GET/POST values
|
||||
DEFAULT_GET_POST_DELIMITER = '&'
|
||||
@@ -597,7 +531,7 @@ DEFAULT_COOKIE_DELIMITER = ';'
|
||||
FORCE_COOKIE_EXPIRATION_TIME = "9999999999"
|
||||
|
||||
# Github OAuth token used for creating an automatic Issue for unhandled exceptions
|
||||
GITHUB_REPORT_OAUTH_TOKEN = "NTYzYjhmZWJjYzc0Njg2ODJhNzhmNDg1YzM0YzlkYjk3N2JiMzE3Nw=="
|
||||
GITHUB_REPORT_OAUTH_TOKEN = "YzNkYTgyMTdjYzdjNjZjMjFjMWE5ODI5OGQyNzk2ODM1M2M0MzUyOA=="
|
||||
|
||||
# Skip unforced HashDB flush requests below the threshold number of cached items
|
||||
HASHDB_FLUSH_THRESHOLD = 32
|
||||
@@ -605,14 +539,11 @@ HASHDB_FLUSH_THRESHOLD = 32
|
||||
# Number of retries for unsuccessful HashDB flush attempts
|
||||
HASHDB_FLUSH_RETRIES = 3
|
||||
|
||||
# Number of retries for unsuccessful HashDB retrieve attempts
|
||||
HASHDB_RETRIEVE_RETRIES = 3
|
||||
|
||||
# Number of retries for unsuccessful HashDB end transaction attempts
|
||||
HASHDB_END_TRANSACTION_RETRIES = 3
|
||||
|
||||
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
|
||||
HASHDB_MILESTONE_VALUE = "BZzRotigLX" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
HASHDB_MILESTONE_VALUE = "baFJusZrel" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
|
||||
|
||||
# Warn user of possible delay due to large page dump in full UNION query injections
|
||||
LARGE_OUTPUT_THRESHOLD = 1024 ** 2
|
||||
@@ -633,19 +564,16 @@ MAX_TOTAL_REDIRECTIONS = 10
|
||||
MAX_DNS_LABEL = 63
|
||||
|
||||
# Alphabet used for prefix and suffix strings of name resolution requests in DNS technique (excluding hexadecimal chars for not mixing with inner content)
|
||||
DNS_BOUNDARIES_ALPHABET = re.sub(r"[a-fA-F]", "", string.ascii_letters)
|
||||
DNS_BOUNDARIES_ALPHABET = re.sub("[a-fA-F]", "", string.ascii_letters)
|
||||
|
||||
# Alphabet used for heuristic checks
|
||||
HEURISTIC_CHECK_ALPHABET = ('"', '\'', ')', '(', ',', '.')
|
||||
|
||||
# Minor artistic touch
|
||||
BANNER = re.sub(r"\[.\]", lambda _: "[\033[01;41m%s\033[01;49m]" % random.sample(HEURISTIC_CHECK_ALPHABET, 1)[0], BANNER)
|
||||
|
||||
# String used for dummy non-SQLi (e.g. XSS) heuristic checks of a tested parameter value
|
||||
DUMMY_NON_SQLI_CHECK_APPENDIX = "<'\">"
|
||||
|
||||
# Regular expression used for recognition of file inclusion errors
|
||||
FI_ERROR_REGEX = r"(?i)[^\n]{0,100}(no such file|failed (to )?open)[^\n]{0,100}"
|
||||
FI_ERROR_REGEX = "(?i)[^\n]*(no such file|failed (to )?open)[^\n]*"
|
||||
|
||||
# Length of prefix and suffix used in non-SQLI heuristic checks
|
||||
NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH = 6
|
||||
@@ -675,7 +603,7 @@ VALID_TIME_CHARS_RUN_THRESHOLD = 100
|
||||
CHECK_ZERO_COLUMNS_THRESHOLD = 10
|
||||
|
||||
# Boldify all logger messages containing these "patterns"
|
||||
BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "does not seem to be", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CAPTCHA", "specific response", "NULL connection is supported", "PASSED", "FAILED")
|
||||
BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CAPTCHA")
|
||||
|
||||
# Generic www root directory names
|
||||
GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "httpdocs", "public", "wwwroot", "www")
|
||||
@@ -687,7 +615,7 @@ MAX_HELP_OPTION_LENGTH = 18
|
||||
MAX_CONNECT_RETRIES = 100
|
||||
|
||||
# Strings for detecting formatting errors
|
||||
FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Please enter a", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "TypeMismatchException", "CF_SQL_INTEGER", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
|
||||
FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "DataTypeMismatchException", "CF_SQL_INTEGER", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "is not of type numeric", "<cfif Not IsNumeric(", "invalid input syntax for integer", "invalid input syntax for type", "invalid number", "character to number conversion error", "unable to interpret text value", "String was not recognized as a valid", "Convert.ToInt", "cannot be converted to a ", "InvalidDataException")
|
||||
|
||||
# Regular expression used for extracting ASP.NET view state values
|
||||
VIEWSTATE_REGEX = r'(?i)(?P<name>__VIEWSTATE[^"]*)[^>]+value="(?P<result>[^"]+)'
|
||||
@@ -714,7 +642,7 @@ INVALID_UNICODE_CHAR_FORMAT = r"\x%02x"
|
||||
XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z"
|
||||
|
||||
# Regular expression used for detecting JSON POST data
|
||||
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null).*\}\s*(\]\s*)*\Z'
|
||||
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]+"|\d+).*\}\s*(\]\s*)*\Z'
|
||||
|
||||
# Regular expression used for detecting JSON-like POST data
|
||||
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
|
||||
@@ -750,7 +678,7 @@ MAX_HISTORY_LENGTH = 1000
|
||||
MIN_ENCODED_LEN_CHECK = 5
|
||||
|
||||
# Timeout in seconds in which Metasploit remote session has to be initialized
|
||||
METASPLOIT_SESSION_TIMEOUT = 120
|
||||
METASPLOIT_SESSION_TIMEOUT = 300
|
||||
|
||||
# Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html
|
||||
LOBLKSIZE = 2048
|
||||
@@ -762,7 +690,7 @@ EVALCODE_KEYWORD_SUFFIX = "_KEYWORD"
|
||||
NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File."
|
||||
|
||||
# Infixes used for automatic recognition of parameters carrying anti-CSRF tokens
|
||||
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf", "token")
|
||||
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf")
|
||||
|
||||
# Prefixes used in brute force search for web server document root
|
||||
BRUTE_DOC_ROOT_PREFIXES = {
|
||||
@@ -800,9 +728,9 @@ tr:nth-child(even) {
|
||||
background-color: #D3DFEE
|
||||
}
|
||||
td{
|
||||
font-size:12px;
|
||||
font-size:10px;
|
||||
}
|
||||
th{
|
||||
font-size:12px;
|
||||
font-size:10px;
|
||||
}
|
||||
</style>"""
|
||||
|
||||
+31
-38
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import atexit
|
||||
@@ -53,34 +53,29 @@ def clearHistory():
|
||||
readline.clear_history()
|
||||
|
||||
def saveHistory(completion=None):
|
||||
if not readlineAvailable():
|
||||
return
|
||||
|
||||
if completion == AUTOCOMPLETE_TYPE.SQL:
|
||||
historyPath = paths.SQL_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.OS:
|
||||
historyPath = paths.OS_SHELL_HISTORY
|
||||
else:
|
||||
historyPath = paths.SQLMAP_SHELL_HISTORY
|
||||
|
||||
try:
|
||||
if not readlineAvailable():
|
||||
return
|
||||
|
||||
if completion == AUTOCOMPLETE_TYPE.SQL:
|
||||
historyPath = paths.SQL_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.OS:
|
||||
historyPath = paths.OS_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.API:
|
||||
historyPath = paths.API_SHELL_HISTORY
|
||||
else:
|
||||
historyPath = paths.SQLMAP_SHELL_HISTORY
|
||||
|
||||
try:
|
||||
with open(historyPath, "w+"):
|
||||
pass
|
||||
except:
|
||||
with open(historyPath, "w+"):
|
||||
pass
|
||||
|
||||
readline.set_history_length(MAX_HISTORY_LENGTH)
|
||||
try:
|
||||
readline.write_history_file(historyPath)
|
||||
except IOError, msg:
|
||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg)
|
||||
logger.warn(warnMsg)
|
||||
except KeyboardInterrupt:
|
||||
except:
|
||||
pass
|
||||
|
||||
readline.set_history_length(MAX_HISTORY_LENGTH)
|
||||
try:
|
||||
readline.write_history_file(historyPath)
|
||||
except IOError, msg:
|
||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
def loadHistory(completion=None):
|
||||
if not readlineAvailable():
|
||||
return
|
||||
@@ -91,8 +86,6 @@ def loadHistory(completion=None):
|
||||
historyPath = paths.SQL_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.OS:
|
||||
historyPath = paths.OS_SHELL_HISTORY
|
||||
elif completion == AUTOCOMPLETE_TYPE.API:
|
||||
historyPath = paths.API_SHELL_HISTORY
|
||||
else:
|
||||
historyPath = paths.SQLMAP_SHELL_HISTORY
|
||||
|
||||
@@ -111,20 +104,20 @@ def autoCompletion(completion=None, os=None, commands=None):
|
||||
if os == OS.WINDOWS:
|
||||
# Reference: http://en.wikipedia.org/wiki/List_of_DOS_commands
|
||||
completer = CompleterNG({
|
||||
"copy": None, "del": None, "dir": None,
|
||||
"echo": None, "md": None, "mem": None,
|
||||
"move": None, "net": None, "netstat -na": None,
|
||||
"ver": None, "xcopy": None, "whoami": None,
|
||||
})
|
||||
"copy": None, "del": None, "dir": None,
|
||||
"echo": None, "md": None, "mem": None,
|
||||
"move": None, "net": None, "netstat -na": None,
|
||||
"ver": None, "xcopy": None, "whoami": None,
|
||||
})
|
||||
|
||||
else:
|
||||
# Reference: http://en.wikipedia.org/wiki/List_of_Unix_commands
|
||||
completer = CompleterNG({
|
||||
"cp": None, "rm": None, "ls": None,
|
||||
"echo": None, "mkdir": None, "free": None,
|
||||
"mv": None, "ifconfig": None, "netstat -natu": None,
|
||||
"pwd": None, "uname": None, "id": None,
|
||||
})
|
||||
"cp": None, "rm": None, "ls": None,
|
||||
"echo": None, "mkdir": None, "free": None,
|
||||
"mv": None, "ifconfig": None, "netstat -natu": None,
|
||||
"pwd": None, "uname": None, "id": None,
|
||||
})
|
||||
|
||||
readline.set_completer(completer.complete)
|
||||
readline.parse_and_bind("tab: complete")
|
||||
|
||||
@@ -1,13 +1,14 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import errno
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
from lib.core.settings import IS_WIN
|
||||
@@ -23,6 +24,11 @@ else:
|
||||
import select
|
||||
import fcntl
|
||||
|
||||
if (sys.hexversion >> 16) >= 0x202:
|
||||
FCNTL = fcntl
|
||||
else:
|
||||
import FCNTL
|
||||
|
||||
def blockingReadFromFD(fd):
|
||||
# Quick twist around original Twisted function
|
||||
# Blocking read from a non-blocking file descriptor
|
||||
|
||||
+158
-199
@@ -1,15 +1,14 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
import functools
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
import urlparse
|
||||
@@ -19,7 +18,6 @@ from lib.core.common import getSafeExString
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.common import hashDBRetrieve
|
||||
from lib.core.common import intersect
|
||||
from lib.core.common import isNumPosStrValue
|
||||
from lib.core.common import normalizeUnicode
|
||||
from lib.core.common import openFile
|
||||
from lib.core.common import paramToDict
|
||||
@@ -44,7 +42,6 @@ from lib.core.enums import POST_HINT
|
||||
from lib.core.exception import SqlmapFilePathException
|
||||
from lib.core.exception import SqlmapGenericException
|
||||
from lib.core.exception import SqlmapMissingPrivileges
|
||||
from lib.core.exception import SqlmapNoneDataException
|
||||
from lib.core.exception import SqlmapSystemException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.option import _setDBMS
|
||||
@@ -56,7 +53,6 @@ from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
|
||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||
from lib.core.settings import HOST_ALIASES
|
||||
from lib.core.settings import ARRAY_LIKE_RECOGNITION_REGEX
|
||||
from lib.core.settings import INJECT_HERE_REGEX
|
||||
from lib.core.settings import JSON_RECOGNITION_REGEX
|
||||
from lib.core.settings import JSON_LIKE_RECOGNITION_REGEX
|
||||
from lib.core.settings import MULTIPART_RECOGNITION_REGEX
|
||||
@@ -64,7 +60,6 @@ from lib.core.settings import PROBLEMATIC_CUSTOM_INJECTION_PATTERNS
|
||||
from lib.core.settings import REFERER_ALIASES
|
||||
from lib.core.settings import RESTORE_MERGED_OPTIONS
|
||||
from lib.core.settings import RESULTS_FILE_FORMAT
|
||||
from lib.core.settings import SESSION_SQLITE_FILE
|
||||
from lib.core.settings import SUPPORTED_DBMS
|
||||
from lib.core.settings import UNENCODED_ORIGINAL_VALUE
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
@@ -73,6 +68,7 @@ from lib.core.settings import URI_INJECTABLE_REGEX
|
||||
from lib.core.settings import USER_AGENT_ALIASES
|
||||
from lib.core.settings import XML_RECOGNITION_REGEX
|
||||
from lib.utils.hashdb import HashDB
|
||||
from lib.core.xmldump import dumper as xmldumper
|
||||
from thirdparty.odict.odict import OrderedDict
|
||||
|
||||
def _setRequestParams():
|
||||
@@ -85,7 +81,6 @@ def _setRequestParams():
|
||||
conf.parameters[None] = "direct connection"
|
||||
return
|
||||
|
||||
hintNames = []
|
||||
testableParameters = False
|
||||
|
||||
# Perform checks on GET parameters
|
||||
@@ -104,6 +99,7 @@ def _setRequestParams():
|
||||
|
||||
if conf.data is not None:
|
||||
conf.method = HTTPMETHOD.POST if not conf.method or conf.method == HTTPMETHOD.GET else conf.method
|
||||
hintNames = []
|
||||
|
||||
def process(match, repl):
|
||||
retVal = match.group(0)
|
||||
@@ -116,108 +112,92 @@ def _setRequestParams():
|
||||
retVal = retVal.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
|
||||
else:
|
||||
break
|
||||
if kb.customInjectionMark in retVal:
|
||||
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name")))
|
||||
if CUSTOM_INJECTION_MARK_CHAR in retVal:
|
||||
hintNames.append((retVal.split(CUSTOM_INJECTION_MARK_CHAR)[0], match.group("name")))
|
||||
return retVal
|
||||
|
||||
if kb.processUserMarks is None and kb.customInjectionMark in conf.data:
|
||||
message = "custom injection marker ('%s') found in option " % kb.customInjectionMark
|
||||
if kb.processUserMarks is None and CUSTOM_INJECTION_MARK_CHAR in conf.data:
|
||||
message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR
|
||||
message += "'--data'. Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
kb.processUserMarks = choice == 'Y'
|
||||
kb.processUserMarks = not test or test[0] not in ("n", "N")
|
||||
|
||||
if kb.processUserMarks:
|
||||
kb.testOnlyCustom = True
|
||||
|
||||
if re.search(JSON_RECOGNITION_REGEX, conf.data):
|
||||
message = "JSON data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
if not (kb.processUserMarks and CUSTOM_INJECTION_MARK_CHAR in conf.data):
|
||||
if re.search(JSON_RECOGNITION_REGEX, conf.data):
|
||||
message = "JSON data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif test[0] not in ("n", "N"):
|
||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r'("(?P<name>[^"]+)"\s*:\s*".+?)"(?<!\\")', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data)
|
||||
conf.data = re.sub(r'("(?P<name>[^"]+)"\s*:\s*)(-?\d[\d\.]*)\b', functools.partial(process, repl=r'\g<1>\g<3>%s' % kb.customInjectionMark), conf.data)
|
||||
conf.data = re.sub(r'("(?P<name>[^"]+)"\s*:\s*)((true|false|null))\b', functools.partial(process, repl=r'\g<1>\g<3>%s' % kb.customInjectionMark), conf.data)
|
||||
conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r'("(?P<name>[^"]+)"\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
conf.data = re.sub(r'("(?P<name>[^"]+)"\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
match = re.search(r'(?P<name>[^"]+)"\s*:\s*\[([^\]]+)\]', conf.data)
|
||||
if match and not (conf.testParameter and match.group("name") not in conf.testParameter):
|
||||
_ = match.group(2)
|
||||
_ = re.sub(r'("[^"]+)"', r'\g<1>%s"' % kb.customInjectionMark, _)
|
||||
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
||||
_ = re.sub(r'("[^"]+)"', '\g<1>%s"' % CUSTOM_INJECTION_MARK_CHAR, _)
|
||||
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', '\g<0>%s' % CUSTOM_INJECTION_MARK_CHAR, _)
|
||||
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
||||
kb.postHint = POST_HINT.JSON
|
||||
|
||||
kb.postHint = POST_HINT.JSON
|
||||
|
||||
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
||||
message = "JSON-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
||||
message = "JSON-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif test[0] not in ("n", "N"):
|
||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
||||
conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
kb.postHint = POST_HINT.JSON_LIKE
|
||||
|
||||
kb.postHint = POST_HINT.JSON_LIKE
|
||||
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
||||
message = "Array-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif test[0] not in ("n", "N"):
|
||||
conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % CUSTOM_INJECTION_MARK_CHAR, conf.data)
|
||||
kb.postHint = POST_HINT.ARRAY_LIKE
|
||||
|
||||
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
||||
message = "Array-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
||||
|
||||
kb.postHint = POST_HINT.ARRAY_LIKE
|
||||
|
||||
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
||||
message = "SOAP/XML data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
||||
message = "SOAP/XML data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif test[0] not in ("n", "N"):
|
||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
||||
conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
||||
|
||||
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
||||
|
||||
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
||||
message = "Multipart-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
||||
message = "Multipart-like data found in %s data. " % conf.method
|
||||
message += "Do you want to process it? [Y/n/q] "
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif test[0] not in ("n", "N"):
|
||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)(((\r)?\n)+--)", functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||
|
||||
kb.postHint = POST_HINT.MULTIPART
|
||||
conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER)
|
||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"'](?P<name>[^\n]+?)[\"']).+?)(((\r)?\n)+--)", functools.partial(process, repl=r"\g<1>%s\g<4>" % CUSTOM_INJECTION_MARK_CHAR), conf.data)
|
||||
kb.postHint = POST_HINT.MULTIPART
|
||||
|
||||
if not kb.postHint:
|
||||
if kb.customInjectionMark in conf.data: # later processed
|
||||
if CUSTOM_INJECTION_MARK_CHAR in conf.data: # later processed
|
||||
pass
|
||||
else:
|
||||
place = PLACE.POST
|
||||
@@ -229,12 +209,12 @@ def _setRequestParams():
|
||||
conf.paramDict[place] = paramDict
|
||||
testableParameters = True
|
||||
else:
|
||||
if kb.customInjectionMark not in conf.data: # in case that no usable parameter values has been found
|
||||
if CUSTOM_INJECTION_MARK_CHAR not in conf.data: # in case that no usable parameter values has been found
|
||||
conf.parameters[PLACE.POST] = conf.data
|
||||
|
||||
kb.processUserMarks = True if (kb.postHint and kb.customInjectionMark in (conf.data or "")) else kb.processUserMarks
|
||||
kb.processUserMarks = True if (kb.postHint and CUSTOM_INJECTION_MARK_CHAR in conf.data) else kb.processUserMarks
|
||||
|
||||
if re.search(URI_INJECTABLE_REGEX, conf.url, re.I) and not any(place in conf.parameters for place in (PLACE.GET, PLACE.POST)) and not kb.postHint and kb.customInjectionMark not in (conf.data or "") and conf.url.startswith("http"):
|
||||
if re.search(URI_INJECTABLE_REGEX, conf.url, re.I) and not any(place in conf.parameters for place in (PLACE.GET, PLACE.POST)) and not kb.postHint and not CUSTOM_INJECTION_MARK_CHAR in (conf.data or "") and conf.url.startswith("http"):
|
||||
warnMsg = "you've provided target URL without any GET "
|
||||
warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') "
|
||||
warnMsg += "and without providing any POST parameters "
|
||||
@@ -243,32 +223,31 @@ def _setRequestParams():
|
||||
|
||||
message = "do you want to try URI injections "
|
||||
message += "in the target URL itself? [Y/n/q] "
|
||||
choice = readInput(message, default='Y').upper()
|
||||
test = readInput(message, default="Y")
|
||||
|
||||
if choice == 'Q':
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
elif choice == 'Y':
|
||||
conf.url = "%s%s" % (conf.url, kb.customInjectionMark)
|
||||
elif not test or test[0] not in ("n", "N"):
|
||||
conf.url = "%s%s" % (conf.url, CUSTOM_INJECTION_MARK_CHAR)
|
||||
kb.processUserMarks = True
|
||||
|
||||
for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data), (PLACE.CUSTOM_HEADER, str(conf.httpHeaders))):
|
||||
_ = re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or "") if place == PLACE.CUSTOM_HEADER else value or ""
|
||||
if kb.customInjectionMark in _:
|
||||
if CUSTOM_INJECTION_MARK_CHAR in _:
|
||||
if kb.processUserMarks is None:
|
||||
lut = {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data', PLACE.CUSTOM_HEADER: '--headers/--user-agent/--referer/--cookie'}
|
||||
message = "custom injection marker ('%s') found in option " % kb.customInjectionMark
|
||||
message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR
|
||||
message += "'%s'. Do you want to process it? [Y/n/q] " % lut[place]
|
||||
choice = readInput(message, default='Y').upper()
|
||||
|
||||
if choice == 'Q':
|
||||
test = readInput(message, default="Y")
|
||||
if test and test[0] in ("q", "Q"):
|
||||
raise SqlmapUserQuitException
|
||||
else:
|
||||
kb.processUserMarks = choice == 'Y'
|
||||
kb.processUserMarks = not test or test[0] not in ("n", "N")
|
||||
|
||||
if kb.processUserMarks:
|
||||
kb.testOnlyCustom = True
|
||||
|
||||
if "=%s" % kb.customInjectionMark in _:
|
||||
if "=%s" % CUSTOM_INJECTION_MARK_CHAR in _:
|
||||
warnMsg = "it seems that you've provided empty parameter value(s) "
|
||||
warnMsg += "for testing. Please, always use only valid parameter values "
|
||||
warnMsg += "so sqlmap could be able to run properly"
|
||||
@@ -300,13 +279,13 @@ def _setRequestParams():
|
||||
if place == PLACE.CUSTOM_HEADER:
|
||||
for index in xrange(len(conf.httpHeaders)):
|
||||
header, value = conf.httpHeaders[index]
|
||||
if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value):
|
||||
parts = value.split(kb.customInjectionMark)
|
||||
if CUSTOM_INJECTION_MARK_CHAR in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value):
|
||||
parts = value.split(CUSTOM_INJECTION_MARK_CHAR)
|
||||
for i in xrange(len(parts) - 1):
|
||||
conf.paramDict[place]["%s #%d%s" % (header, i + 1, kb.customInjectionMark)] = "%s,%s" % (header, "".join("%s%s" % (parts[j], kb.customInjectionMark if i == j else "") for j in xrange(len(parts))))
|
||||
conf.httpHeaders[index] = (header, value.replace(kb.customInjectionMark, ""))
|
||||
conf.paramDict[place]["%s #%d%s" % (header, i + 1, CUSTOM_INJECTION_MARK_CHAR)] = "%s,%s" % (header, "".join("%s%s" % (parts[j], CUSTOM_INJECTION_MARK_CHAR if i == j else "") for j in xrange(len(parts))))
|
||||
conf.httpHeaders[index] = (header, value.replace(CUSTOM_INJECTION_MARK_CHAR, ""))
|
||||
else:
|
||||
parts = value.split(kb.customInjectionMark)
|
||||
parts = value.split(CUSTOM_INJECTION_MARK_CHAR)
|
||||
|
||||
for i in xrange(len(parts) - 1):
|
||||
name = None
|
||||
@@ -316,8 +295,8 @@ def _setRequestParams():
|
||||
name = "%s %s" % (kb.postHint, _)
|
||||
break
|
||||
if name is None:
|
||||
name = "%s#%s%s" % (("%s " % kb.postHint) if kb.postHint else "", i + 1, kb.customInjectionMark)
|
||||
conf.paramDict[place][name] = "".join("%s%s" % (parts[j], kb.customInjectionMark if i == j else "") for j in xrange(len(parts)))
|
||||
name = "%s#%s%s" % (("%s " % kb.postHint) if kb.postHint else "", i + 1, CUSTOM_INJECTION_MARK_CHAR)
|
||||
conf.paramDict[place][name] = "".join("%s%s" % (parts[j], CUSTOM_INJECTION_MARK_CHAR if i == j else "") for j in xrange(len(parts)))
|
||||
|
||||
if place == PLACE.URI and PLACE.GET in conf.paramDict:
|
||||
del conf.paramDict[PLACE.GET]
|
||||
@@ -329,7 +308,7 @@ def _setRequestParams():
|
||||
if kb.processUserMarks:
|
||||
for item in ("url", "data", "agent", "referer", "cookie"):
|
||||
if conf.get(item):
|
||||
conf[item] = conf[item].replace(kb.customInjectionMark, "")
|
||||
conf[item] = conf[item].replace(CUSTOM_INJECTION_MARK_CHAR, "")
|
||||
|
||||
# Perform checks on Cookie parameters
|
||||
if conf.cookie:
|
||||
@@ -346,7 +325,7 @@ def _setRequestParams():
|
||||
# Url encoding of the header values should be avoided
|
||||
# Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value
|
||||
|
||||
if httpHeader.upper() == HTTP_HEADER.USER_AGENT.upper():
|
||||
if httpHeader.title() == HTTP_HEADER.USER_AGENT:
|
||||
conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES, True)))
|
||||
@@ -355,7 +334,7 @@ def _setRequestParams():
|
||||
conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue}
|
||||
testableParameters = True
|
||||
|
||||
elif httpHeader.upper() == HTTP_HEADER.REFERER.upper():
|
||||
elif httpHeader.title() == HTTP_HEADER.REFERER:
|
||||
conf.parameters[PLACE.REFERER] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES, True)))
|
||||
@@ -364,7 +343,7 @@ def _setRequestParams():
|
||||
conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue}
|
||||
testableParameters = True
|
||||
|
||||
elif httpHeader.upper() == HTTP_HEADER.HOST.upper():
|
||||
elif httpHeader.title() == HTTP_HEADER.HOST:
|
||||
conf.parameters[PLACE.HOST] = urldecode(headerValue)
|
||||
|
||||
condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES, True)))
|
||||
@@ -378,8 +357,8 @@ def _setRequestParams():
|
||||
|
||||
if condition:
|
||||
conf.parameters[PLACE.CUSTOM_HEADER] = str(conf.httpHeaders)
|
||||
conf.paramDict[PLACE.CUSTOM_HEADER] = {httpHeader: "%s,%s%s" % (httpHeader, headerValue, kb.customInjectionMark)}
|
||||
conf.httpHeaders = [(_[0], _[1].replace(kb.customInjectionMark, "")) for _ in conf.httpHeaders]
|
||||
conf.paramDict[PLACE.CUSTOM_HEADER] = {httpHeader: "%s,%s%s" % (httpHeader, headerValue, CUSTOM_INJECTION_MARK_CHAR)}
|
||||
conf.httpHeaders = [(header, value.replace(CUSTOM_INJECTION_MARK_CHAR, "")) for header, value in conf.httpHeaders]
|
||||
testableParameters = True
|
||||
|
||||
if not conf.parameters:
|
||||
@@ -393,26 +372,20 @@ def _setRequestParams():
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
if conf.csrfToken:
|
||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not re.search(r"\b%s\b" % re.escape(conf.csrfToken), conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
||||
if not any(conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not re.search(r"\b%s\b" % re.escape(conf.csrfToken), conf.data or "") and not conf.csrfToken in set(_[0].lower() for _ in conf.httpHeaders) and not conf.csrfToken in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken
|
||||
errMsg += "found in provided GET, POST, Cookie or header values"
|
||||
raise SqlmapGenericException(errMsg)
|
||||
else:
|
||||
for place in (PLACE.GET, PLACE.POST, PLACE.COOKIE):
|
||||
if conf.csrfToken:
|
||||
break
|
||||
|
||||
for parameter in conf.paramDict.get(place, {}):
|
||||
if any(parameter.lower().count(_) for _ in CSRF_TOKEN_PARAMETER_INFIXES):
|
||||
message = "%s parameter '%s' appears to hold anti-CSRF token. " % (place, parameter)
|
||||
message += "Do you want sqlmap to automatically update it in further requests? [y/N] "
|
||||
|
||||
if readInput(message, default='N', boolean=True):
|
||||
class _(unicode):
|
||||
pass
|
||||
conf.csrfToken = _(re.escape(getUnicode(parameter)))
|
||||
conf.csrfToken._original = getUnicode(parameter)
|
||||
break
|
||||
test = readInput(message, default="N")
|
||||
if test and test[0] in ("y", "Y"):
|
||||
conf.csrfToken = parameter
|
||||
break
|
||||
|
||||
def _setHashDB():
|
||||
"""
|
||||
@@ -420,7 +393,7 @@ def _setHashDB():
|
||||
"""
|
||||
|
||||
if not conf.hashDBFile:
|
||||
conf.hashDBFile = conf.sessionFile or os.path.join(conf.outputPath, SESSION_SQLITE_FILE)
|
||||
conf.hashDBFile = conf.sessionFile or os.path.join(conf.outputPath, "session.sqlite")
|
||||
|
||||
if os.path.exists(conf.hashDBFile):
|
||||
if conf.flushSession:
|
||||
@@ -446,7 +419,7 @@ def _resumeHashDBValues():
|
||||
kb.xpCmdshellAvailable = hashDBRetrieve(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE) or kb.xpCmdshellAvailable
|
||||
|
||||
kb.errorChunkLength = hashDBRetrieve(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH)
|
||||
if isNumPosStrValue(kb.errorChunkLength):
|
||||
if kb.errorChunkLength and kb.errorChunkLength.isdigit():
|
||||
kb.errorChunkLength = int(kb.errorChunkLength)
|
||||
else:
|
||||
kb.errorChunkLength = None
|
||||
@@ -454,10 +427,13 @@ def _resumeHashDBValues():
|
||||
conf.tmpPath = conf.tmpPath or hashDBRetrieve(HASHDB_KEYS.CONF_TMP_PATH)
|
||||
|
||||
for injection in hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) or []:
|
||||
if isinstance(injection, InjectionDict) and injection.place in conf.paramDict and injection.parameter in conf.paramDict[injection.place]:
|
||||
if isinstance(injection, InjectionDict) and injection.place in conf.paramDict and \
|
||||
injection.parameter in conf.paramDict[injection.place]:
|
||||
|
||||
if not conf.tech or intersect(conf.tech, injection.data.keys()):
|
||||
if intersect(conf.tech, injection.data.keys()):
|
||||
injection.data = dict(_ for _ in injection.data.items() if _[0] in conf.tech)
|
||||
injection.data = dict(filter(lambda (key, item): key in conf.tech, injection.data.items()))
|
||||
|
||||
if injection not in kb.injections:
|
||||
kb.injections.append(injection)
|
||||
|
||||
@@ -472,13 +448,7 @@ def _resumeDBMS():
|
||||
value = hashDBRetrieve(HASHDB_KEYS.DBMS)
|
||||
|
||||
if not value:
|
||||
if conf.offline:
|
||||
errMsg = "unable to continue in offline mode "
|
||||
errMsg += "because of lack of usable "
|
||||
errMsg += "session data"
|
||||
raise SqlmapNoneDataException(errMsg)
|
||||
else:
|
||||
return
|
||||
return
|
||||
|
||||
dbms = value.lower()
|
||||
dbmsVersion = [UNKNOWN_DBMS_VERSION]
|
||||
@@ -502,8 +472,9 @@ def _resumeDBMS():
|
||||
message += "sqlmap assumes the back-end DBMS is '%s'. " % dbms
|
||||
message += "Do you really want to force the back-end "
|
||||
message += "DBMS value? [y/N] "
|
||||
test = readInput(message, default="N")
|
||||
|
||||
if not readInput(message, default='N', boolean=True):
|
||||
if not test or test[0] in ("n", "N"):
|
||||
conf.dbms = None
|
||||
Backend.setDbms(dbms)
|
||||
Backend.setVersionList(dbmsVersion)
|
||||
@@ -537,8 +508,9 @@ def _resumeOS():
|
||||
message += "operating system is %s. " % os
|
||||
message += "Do you really want to force the back-end DBMS "
|
||||
message += "OS value? [y/N] "
|
||||
test = readInput(message, default="N")
|
||||
|
||||
if not readInput(message, default='N', boolean=True):
|
||||
if not test or test[0] in ("n", "N"):
|
||||
conf.os = os
|
||||
else:
|
||||
conf.os = os
|
||||
@@ -557,12 +529,11 @@ def _setResultsFile():
|
||||
if not conf.resultsFP:
|
||||
conf.resultsFilename = os.path.join(paths.SQLMAP_OUTPUT_PATH, time.strftime(RESULTS_FILE_FORMAT).lower())
|
||||
try:
|
||||
conf.resultsFP = openFile(conf.resultsFilename, "a", UNICODE_ENCODING, buffering=0)
|
||||
conf.resultsFP = openFile(conf.resultsFilename, "w+", UNICODE_ENCODING, buffering=0)
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
warnMsg = "unable to create results file '%s' ('%s'). " % (conf.resultsFilename, getUnicode(ex))
|
||||
handle, conf.resultsFilename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.RESULTS, suffix=".csv")
|
||||
os.close(handle)
|
||||
conf.resultsFilename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.RESULTS, suffix=".csv")[1]
|
||||
conf.resultsFP = openFile(conf.resultsFilename, "w+", UNICODE_ENCODING, buffering=0)
|
||||
warnMsg += "Using temporary file '%s' instead" % conf.resultsFilename
|
||||
logger.warn(warnMsg)
|
||||
@@ -582,14 +553,14 @@ def _createFilesDir():
|
||||
Create the file directory.
|
||||
"""
|
||||
|
||||
if not conf.fileRead:
|
||||
if not conf.rFile:
|
||||
return
|
||||
|
||||
conf.filePath = paths.SQLMAP_FILES_PATH % conf.hostname
|
||||
|
||||
if not os.path.isdir(conf.filePath):
|
||||
try:
|
||||
os.makedirs(conf.filePath)
|
||||
os.makedirs(conf.filePath, 0755)
|
||||
except OSError, ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapfiles")
|
||||
warnMsg = "unable to create files directory "
|
||||
@@ -611,7 +582,7 @@ def _createDumpDir():
|
||||
|
||||
if not os.path.isdir(conf.dumpPath):
|
||||
try:
|
||||
os.makedirs(conf.dumpPath)
|
||||
os.makedirs(conf.dumpPath, 0755)
|
||||
except OSError, ex:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdump")
|
||||
warnMsg = "unable to create dump directory "
|
||||
@@ -622,7 +593,11 @@ def _createDumpDir():
|
||||
conf.dumpPath = tempDir
|
||||
|
||||
def _configureDumper():
|
||||
conf.dumper = dumper
|
||||
if hasattr(conf, 'xmlFile') and conf.xmlFile:
|
||||
conf.dumper = xmldumper
|
||||
else:
|
||||
conf.dumper = dumper
|
||||
|
||||
conf.dumper.setOutputFile()
|
||||
|
||||
def _createTargetDirs():
|
||||
@@ -630,42 +605,18 @@ def _createTargetDirs():
|
||||
Create the output directory.
|
||||
"""
|
||||
|
||||
for context in "output", "history":
|
||||
directory = paths["SQLMAP_%s_PATH" % context.upper()]
|
||||
try:
|
||||
if not os.path.isdir(directory):
|
||||
os.makedirs(directory)
|
||||
|
||||
_ = os.path.join(directory, randomStr())
|
||||
open(_, "w+b").close()
|
||||
os.remove(_)
|
||||
|
||||
if conf.outputDir and context == "output":
|
||||
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
||||
logger.warn(warnMsg)
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
||||
except Exception, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
||||
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
||||
|
||||
conf.outputPath = os.path.join(getUnicode(paths.SQLMAP_OUTPUT_PATH), normalizeUnicode(getUnicode(conf.hostname)))
|
||||
|
||||
try:
|
||||
if not os.path.isdir(conf.outputPath):
|
||||
os.makedirs(conf.outputPath)
|
||||
except (OSError, IOError, TypeError), ex:
|
||||
if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH):
|
||||
os.makedirs(paths.SQLMAP_OUTPUT_PATH, 0755)
|
||||
|
||||
_ = os.path.join(paths.SQLMAP_OUTPUT_PATH, randomStr())
|
||||
open(_, "w+b").close()
|
||||
os.remove(_)
|
||||
|
||||
if conf.outputDir:
|
||||
warnMsg = "using '%s' as the output directory" % paths.SQLMAP_OUTPUT_PATH
|
||||
logger.warn(warnMsg)
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapoutput")
|
||||
except Exception, _:
|
||||
@@ -675,20 +626,39 @@ def _createTargetDirs():
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to create output directory "
|
||||
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
||||
warnMsg = "unable to %s output directory " % ("create" if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH) else "write to the")
|
||||
warnMsg += "'%s' (%s). " % (paths.SQLMAP_OUTPUT_PATH, getUnicode(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
conf.outputPath = tempDir
|
||||
paths.SQLMAP_OUTPUT_PATH = tempDir
|
||||
|
||||
conf.outputPath = getUnicode(conf.outputPath)
|
||||
conf.outputPath = os.path.join(getUnicode(paths.SQLMAP_OUTPUT_PATH), normalizeUnicode(getUnicode(conf.hostname)))
|
||||
|
||||
if not os.path.isdir(conf.outputPath):
|
||||
try:
|
||||
os.makedirs(conf.outputPath, 0755)
|
||||
except (OSError, IOError), ex:
|
||||
try:
|
||||
tempDir = tempfile.mkdtemp(prefix="sqlmapoutput")
|
||||
except Exception, _:
|
||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||
errMsg += "Please make sure that your disk is not full and "
|
||||
errMsg += "that you have sufficient write permissions to "
|
||||
errMsg += "create temporary files and/or directories"
|
||||
raise SqlmapSystemException(errMsg)
|
||||
|
||||
warnMsg = "unable to create output directory "
|
||||
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||
logger.warn(warnMsg)
|
||||
|
||||
conf.outputPath = tempDir
|
||||
|
||||
try:
|
||||
with openFile(os.path.join(conf.outputPath, "target.txt"), "w+") as f:
|
||||
with codecs.open(os.path.join(conf.outputPath, "target.txt"), "w+", UNICODE_ENCODING) as f:
|
||||
f.write(kb.originalUrls.get(conf.url) or conf.url or conf.hostname)
|
||||
f.write(" (%s)" % (HTTPMETHOD.POST if conf.data else HTTPMETHOD.GET))
|
||||
f.write(" # %s" % getUnicode(subprocess.list2cmdline(sys.argv), encoding=sys.stdin.encoding))
|
||||
if conf.data:
|
||||
f.write("\n\n%s" % getUnicode(conf.data))
|
||||
except IOError, ex:
|
||||
@@ -704,13 +674,6 @@ def _createTargetDirs():
|
||||
_createFilesDir()
|
||||
_configureDumper()
|
||||
|
||||
def _setAuxOptions():
|
||||
"""
|
||||
Setup auxiliary (host-dependent) options
|
||||
"""
|
||||
|
||||
kb.aliasName = randomStr(seed=hash(conf.hostname or ""))
|
||||
|
||||
def _restoreMergedOptions():
|
||||
"""
|
||||
Restore merged options (command line, configuration file and default values)
|
||||
@@ -757,9 +720,6 @@ def initTargetEnv():
|
||||
setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original)
|
||||
kb.postSpaceToPlus = '+' in original
|
||||
|
||||
match = re.search(INJECT_HERE_REGEX, conf.data or "") or re.search(INJECT_HERE_REGEX, conf.url or "")
|
||||
kb.customInjectionMark = match.group(0) if match else CUSTOM_INJECTION_MARK_CHAR
|
||||
|
||||
def setupTargetEnv():
|
||||
_createTargetDirs()
|
||||
_setRequestParams()
|
||||
@@ -767,4 +727,3 @@ def setupTargetEnv():
|
||||
_resumeHashDBValues()
|
||||
_setResultsFile()
|
||||
_setAuthCred()
|
||||
_setAuxOptions()
|
||||
+48
-55
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import codecs
|
||||
@@ -17,7 +17,6 @@ import traceback
|
||||
|
||||
from extra.beep.beep import beep
|
||||
from lib.controller.controller import start
|
||||
from lib.core.common import checkIntegrity
|
||||
from lib.core.common import clearConsoleLine
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getUnicode
|
||||
@@ -42,8 +41,6 @@ class Failures(object):
|
||||
failedParseOn = None
|
||||
failedTraceBack = None
|
||||
|
||||
_failures = Failures()
|
||||
|
||||
def smokeTest():
|
||||
"""
|
||||
Runs the basic smoke testing of a program
|
||||
@@ -52,44 +49,40 @@ def smokeTest():
|
||||
retVal = True
|
||||
count, length = 0, 0
|
||||
|
||||
if not checkIntegrity():
|
||||
retVal = False
|
||||
else:
|
||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
||||
continue
|
||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
||||
continue
|
||||
|
||||
for filename in files:
|
||||
if os.path.splitext(filename)[1].lower() == ".py" and filename != "__init__.py":
|
||||
length += 1
|
||||
for ifile in files:
|
||||
length += 1
|
||||
|
||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
||||
continue
|
||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
||||
continue
|
||||
|
||||
for filename in files:
|
||||
if os.path.splitext(filename)[1].lower() == ".py" and filename != "__init__.py":
|
||||
path = os.path.join(root, os.path.splitext(filename)[0])
|
||||
path = path.replace(paths.SQLMAP_ROOT_PATH, '.')
|
||||
path = path.replace(os.sep, '.').lstrip('.')
|
||||
try:
|
||||
__import__(path)
|
||||
module = sys.modules[path]
|
||||
except Exception, msg:
|
||||
for ifile in files:
|
||||
if os.path.splitext(ifile)[1].lower() == ".py" and ifile != "__init__.py":
|
||||
path = os.path.join(root, os.path.splitext(ifile)[0])
|
||||
path = path.replace(paths.SQLMAP_ROOT_PATH, '.')
|
||||
path = path.replace(os.sep, '.').lstrip('.')
|
||||
try:
|
||||
__import__(path)
|
||||
module = sys.modules[path]
|
||||
except Exception, msg:
|
||||
retVal = False
|
||||
dataToStdout("\r")
|
||||
errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, ifile), msg)
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
# Run doc tests
|
||||
# Reference: http://docs.python.org/library/doctest.html
|
||||
(failure_count, test_count) = doctest.testmod(module)
|
||||
if failure_count > 0:
|
||||
retVal = False
|
||||
dataToStdout("\r")
|
||||
errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, filename), msg)
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
# Run doc tests
|
||||
# Reference: http://docs.python.org/library/doctest.html
|
||||
(failure_count, test_count) = doctest.testmod(module)
|
||||
if failure_count > 0:
|
||||
retVal = False
|
||||
|
||||
count += 1
|
||||
status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length))
|
||||
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
||||
count += 1
|
||||
status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length))
|
||||
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
||||
|
||||
clearConsoleLine()
|
||||
if retVal:
|
||||
@@ -199,11 +192,11 @@ def liveTest():
|
||||
else:
|
||||
errMsg = "test failed"
|
||||
|
||||
if _failures.failedItems:
|
||||
errMsg += " at parsing items: %s" % ", ".join(i for i in _failures.failedItems)
|
||||
if Failures.failedItems:
|
||||
errMsg += " at parsing items: %s" % ", ".join(i for i in Failures.failedItems)
|
||||
|
||||
errMsg += " - scan folder: %s" % paths.SQLMAP_OUTPUT_PATH
|
||||
errMsg += " - traceback: %s" % bool(_failures.failedTraceBack)
|
||||
errMsg += " - traceback: %s" % bool(Failures.failedTraceBack)
|
||||
|
||||
if not vulnerable:
|
||||
errMsg += " - SQL injection not detected"
|
||||
@@ -211,14 +204,14 @@ def liveTest():
|
||||
logger.error(errMsg)
|
||||
test_case_fd.write("%s\n" % errMsg)
|
||||
|
||||
if _failures.failedParseOn:
|
||||
if Failures.failedParseOn:
|
||||
console_output_fd = codecs.open(os.path.join(paths.SQLMAP_OUTPUT_PATH, "console_output"), "wb", UNICODE_ENCODING)
|
||||
console_output_fd.write(_failures.failedParseOn)
|
||||
console_output_fd.write(Failures.failedParseOn)
|
||||
console_output_fd.close()
|
||||
|
||||
if _failures.failedTraceBack:
|
||||
if Failures.failedTraceBack:
|
||||
traceback_fd = codecs.open(os.path.join(paths.SQLMAP_OUTPUT_PATH, "traceback"), "wb", UNICODE_ENCODING)
|
||||
traceback_fd.write(_failures.failedTraceBack)
|
||||
traceback_fd.write(Failures.failedTraceBack)
|
||||
traceback_fd.close()
|
||||
|
||||
beep()
|
||||
@@ -239,9 +232,9 @@ def liveTest():
|
||||
return retVal
|
||||
|
||||
def initCase(switches, count):
|
||||
_failures.failedItems = []
|
||||
_failures.failedParseOn = None
|
||||
_failures.failedTraceBack = None
|
||||
Failures.failedItems = []
|
||||
Failures.failedParseOn = None
|
||||
Failures.failedTraceBack = None
|
||||
|
||||
paths.SQLMAP_OUTPUT_PATH = tempfile.mkdtemp(prefix="%s%d-" % (MKSTEMP_PREFIX.TESTING, count))
|
||||
paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
|
||||
@@ -285,10 +278,10 @@ def runCase(parse):
|
||||
LOGGER_HANDLER.stream = sys.stdout = sys.__stdout__
|
||||
|
||||
if unhandled_exception:
|
||||
_failures.failedTraceBack = "unhandled exception: %s" % str(traceback.format_exc())
|
||||
Failures.failedTraceBack = "unhandled exception: %s" % str(traceback.format_exc())
|
||||
retVal = None
|
||||
elif handled_exception:
|
||||
_failures.failedTraceBack = "handled exception: %s" % str(traceback.format_exc())
|
||||
Failures.failedTraceBack = "handled exception: %s" % str(traceback.format_exc())
|
||||
retVal = None
|
||||
elif result is False: # this means no SQL injection has been detected - if None, ignore
|
||||
retVal = False
|
||||
@@ -305,17 +298,17 @@ def runCase(parse):
|
||||
if item.startswith("r'") and item.endswith("'"):
|
||||
if not re.search(item[2:-1], parse_on, re.DOTALL):
|
||||
retVal = None
|
||||
_failures.failedItems.append(item)
|
||||
Failures.failedItems.append(item)
|
||||
|
||||
elif item not in parse_on:
|
||||
retVal = None
|
||||
_failures.failedItems.append(item)
|
||||
Failures.failedItems.append(item)
|
||||
|
||||
if _failures.failedItems:
|
||||
_failures.failedParseOn = console
|
||||
if Failures.failedItems:
|
||||
Failures.failedParseOn = console
|
||||
|
||||
elif retVal is False:
|
||||
_failures.failedParseOn = console
|
||||
Failures.failedParseOn = console
|
||||
|
||||
return retVal
|
||||
|
||||
|
||||
+15
-21
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import difflib
|
||||
@@ -11,6 +11,8 @@ import threading
|
||||
import time
|
||||
import traceback
|
||||
|
||||
from thread import error as ThreadError
|
||||
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
@@ -18,7 +20,6 @@ from lib.core.datatype import AttribDict
|
||||
from lib.core.enums import PAYLOAD
|
||||
from lib.core.exception import SqlmapConnectionException
|
||||
from lib.core.exception import SqlmapThreadException
|
||||
from lib.core.exception import SqlmapUserQuitException
|
||||
from lib.core.exception import SqlmapValueException
|
||||
from lib.core.settings import MAX_NUMBER_OF_THREADS
|
||||
from lib.core.settings import PYVERSION
|
||||
@@ -41,11 +42,9 @@ class _ThreadData(threading.local):
|
||||
self.disableStdOut = False
|
||||
self.hashDBCursor = None
|
||||
self.inTransaction = False
|
||||
self.lastCode = None
|
||||
self.lastComparisonPage = None
|
||||
self.lastComparisonHeaders = None
|
||||
self.lastComparisonCode = None
|
||||
self.lastComparisonRatio = None
|
||||
self.lastErrorPage = None
|
||||
self.lastHTTPError = None
|
||||
self.lastRedirectMsg = None
|
||||
@@ -59,12 +58,14 @@ class _ThreadData(threading.local):
|
||||
self.retriesCount = 0
|
||||
self.seqMatcher = difflib.SequenceMatcher(None)
|
||||
self.shared = shared
|
||||
self.validationRun = 0
|
||||
self.valueStack = []
|
||||
|
||||
ThreadData = _ThreadData()
|
||||
|
||||
def readInput(message, default=None, checkBatch=True, boolean=False):
|
||||
def getCurrentThreadUID():
|
||||
return hash(threading.currentThread())
|
||||
|
||||
def readInput(message, default=None):
|
||||
# It will be overwritten by original from lib.core.common
|
||||
pass
|
||||
|
||||
@@ -84,7 +85,7 @@ def getCurrentThreadName():
|
||||
|
||||
return threading.current_thread().getName()
|
||||
|
||||
def exceptionHandledFunction(threadFunction, silent=False):
|
||||
def exceptionHandledFunction(threadFunction):
|
||||
try:
|
||||
threadFunction()
|
||||
except KeyboardInterrupt:
|
||||
@@ -92,11 +93,8 @@ def exceptionHandledFunction(threadFunction, silent=False):
|
||||
kb.threadException = True
|
||||
raise
|
||||
except Exception, ex:
|
||||
if not silent and kb.get("threadContinue"):
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
|
||||
|
||||
if conf.get("verbose") > 1:
|
||||
traceback.print_exc()
|
||||
# thread is just going to be silently killed
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
|
||||
|
||||
def setDaemon(thread):
|
||||
# Reference: http://stackoverflow.com/questions/190010/daemon-threads-explanation
|
||||
@@ -150,7 +148,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
|
||||
try:
|
||||
thread.start()
|
||||
except Exception, ex:
|
||||
except ThreadError, ex:
|
||||
errMsg = "error occurred while starting new thread ('%s')" % ex.message
|
||||
logger.critical(errMsg)
|
||||
break
|
||||
@@ -166,14 +164,13 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
alive = True
|
||||
time.sleep(0.1)
|
||||
|
||||
except (KeyboardInterrupt, SqlmapUserQuitException), ex:
|
||||
except KeyboardInterrupt:
|
||||
print
|
||||
kb.prependFlag = False
|
||||
kb.threadContinue = False
|
||||
kb.threadException = True
|
||||
|
||||
if numThreads > 1:
|
||||
logger.info("waiting for threads to finish%s" % (" (Ctrl+C was pressed)" if isinstance(ex, KeyboardInterrupt) else ""))
|
||||
logger.info("waiting for threads to finish (Ctrl+C was pressed)")
|
||||
try:
|
||||
while (threading.activeCount() > 1):
|
||||
pass
|
||||
@@ -189,9 +186,6 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
kb.threadException = True
|
||||
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
|
||||
|
||||
if conf.get("verbose") > 1:
|
||||
traceback.print_exc()
|
||||
|
||||
except:
|
||||
from lib.core.common import unhandledExceptionMessage
|
||||
|
||||
@@ -211,7 +205,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
||||
if lock.locked():
|
||||
try:
|
||||
lock.release()
|
||||
except:
|
||||
except thread.error:
|
||||
pass
|
||||
|
||||
if conf.get("hashDB"):
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
from lib.core.common import Backend
|
||||
|
||||
+16
-76
@@ -1,34 +1,27 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import glob
|
||||
import locale
|
||||
import os
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
import urllib
|
||||
import zipfile
|
||||
|
||||
from subprocess import PIPE
|
||||
from subprocess import Popen as execute
|
||||
|
||||
from lib.core.common import dataToStdout
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import getLatestRevision
|
||||
from lib.core.common import pollProcess
|
||||
from lib.core.common import readInput
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import logger
|
||||
from lib.core.data import paths
|
||||
from lib.core.revision import getRevisionNumber
|
||||
from lib.core.settings import GIT_REPOSITORY
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import VERSION
|
||||
from lib.core.settings import ZIPBALL_PAGE
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
|
||||
def update():
|
||||
if not conf.updateAll:
|
||||
@@ -37,66 +30,11 @@ def update():
|
||||
success = False
|
||||
|
||||
if not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
||||
warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository "
|
||||
warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
||||
logger.warn(warnMsg)
|
||||
|
||||
if VERSION == getLatestRevision():
|
||||
logger.info("already at the latest revision '%s'" % getRevisionNumber())
|
||||
return
|
||||
|
||||
message = "do you want to try to fetch the latest 'zipball' from repository and extract it (experimental) ? [y/N]"
|
||||
if readInput(message, default='N', boolean=True):
|
||||
directory = os.path.abspath(paths.SQLMAP_ROOT_PATH)
|
||||
|
||||
try:
|
||||
open(os.path.join(directory, "sqlmap.py"), "w+b")
|
||||
except Exception, ex:
|
||||
errMsg = "unable to update content of directory '%s' ('%s')" % (directory, getSafeExString(ex))
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
attrs = os.stat(os.path.join(directory, "sqlmap.py")).st_mode
|
||||
for wildcard in ('*', ".*"):
|
||||
for _ in glob.glob(os.path.join(directory, wildcard)):
|
||||
try:
|
||||
if os.path.isdir(_):
|
||||
shutil.rmtree(_)
|
||||
else:
|
||||
os.remove(_)
|
||||
except:
|
||||
pass
|
||||
|
||||
if glob.glob(os.path.join(directory, '*')):
|
||||
errMsg = "unable to clear the content of directory '%s'" % directory
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
try:
|
||||
archive = urllib.urlretrieve(ZIPBALL_PAGE)[0]
|
||||
|
||||
with zipfile.ZipFile(archive) as f:
|
||||
for info in f.infolist():
|
||||
info.filename = re.sub(r"\Asqlmap[^/]+", "", info.filename)
|
||||
if info.filename:
|
||||
f.extract(info, directory)
|
||||
|
||||
filepath = os.path.join(paths.SQLMAP_ROOT_PATH, "lib", "core", "settings.py")
|
||||
if os.path.isfile(filepath):
|
||||
with open(filepath, "rb") as f:
|
||||
version = re.search(r"(?m)^VERSION\s*=\s*['\"]([^'\"]+)", f.read()).group(1)
|
||||
logger.info("updated to the latest version '%s#dev'" % version)
|
||||
success = True
|
||||
except Exception, ex:
|
||||
logger.error("update could not be completed ('%s')" % getSafeExString(ex))
|
||||
else:
|
||||
if not success:
|
||||
logger.error("update could not be completed")
|
||||
else:
|
||||
try:
|
||||
os.chmod(os.path.join(directory, "sqlmap.py"), attrs)
|
||||
except OSError:
|
||||
logger.warning("could not set the file attributes of '%s'" % os.path.join(directory, "sqlmap.py"))
|
||||
errMsg = "not a git repository. Please checkout the 'sqlmapproject/sqlmap' repository "
|
||||
errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
infoMsg = "updating sqlmap to the latest development revision from the "
|
||||
infoMsg = "updating sqlmap to the latest development version from the "
|
||||
infoMsg += "GitHub repository"
|
||||
logger.info(infoMsg)
|
||||
|
||||
@@ -106,7 +44,7 @@ def update():
|
||||
dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X"))
|
||||
|
||||
try:
|
||||
process = subprocess.Popen("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(sys.getfilesystemencoding() or UNICODE_ENCODING))
|
||||
process = execute("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=PIPE, stderr=PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(locale.getpreferredencoding())) # Reference: http://blog.stastnarodina.com/honza-en/spot/python-unicodeencodeerror/
|
||||
pollProcess(process, True)
|
||||
stdout, stderr = process.communicate()
|
||||
success = not process.returncode
|
||||
@@ -115,11 +53,13 @@ def update():
|
||||
stderr = getSafeExString(ex)
|
||||
|
||||
if success:
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", getRevisionNumber()))
|
||||
import lib.core.settings
|
||||
_ = lib.core.settings.REVISION = getRevisionNumber()
|
||||
logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", _))
|
||||
else:
|
||||
if "Not a git repository" in stderr:
|
||||
errMsg = "not a valid git repository. Please checkout the 'sqlmapproject/sqlmap' repository "
|
||||
errMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
||||
errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", stderr).strip())
|
||||
@@ -132,7 +72,7 @@ def update():
|
||||
infoMsg += "download the latest snapshot from "
|
||||
infoMsg += "https://github.com/sqlmapproject/sqlmap/downloads"
|
||||
else:
|
||||
infoMsg = "for Linux platform it's recommended "
|
||||
infoMsg = "for Linux platform it's required "
|
||||
infoMsg += "to install a standard 'git' package (e.g.: 'sudo apt-get install git')"
|
||||
|
||||
logger.info(infoMsg)
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
@@ -47,7 +47,7 @@ class Wordlist(object):
|
||||
errMsg = "something appears to be wrong with "
|
||||
errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex))
|
||||
errMsg += "sure that you haven't made any changes to it"
|
||||
raise SqlmapInstallationException(errMsg)
|
||||
raise SqlmapInstallationException, errMsg
|
||||
if len(_.namelist()) == 0:
|
||||
errMsg = "no file(s) inside '%s'" % self.current
|
||||
raise SqlmapDataException(errMsg)
|
||||
@@ -73,7 +73,7 @@ class Wordlist(object):
|
||||
errMsg = "something appears to be wrong with "
|
||||
errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex))
|
||||
errMsg += "sure that you haven't made any changes to it"
|
||||
raise SqlmapInstallationException(errMsg)
|
||||
raise SqlmapInstallationException, errMsg
|
||||
except StopIteration:
|
||||
self.adjust()
|
||||
retVal = self.iter.next().rstrip()
|
||||
|
||||
@@ -0,0 +1,536 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
import codecs
|
||||
import os
|
||||
import re
|
||||
import xml
|
||||
|
||||
import xml.sax.saxutils as saxutils
|
||||
|
||||
from lib.core.common import getUnicode
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.data import logger
|
||||
from lib.core.exception import SqlmapFilePathException
|
||||
from lib.core.settings import UNICODE_ENCODING
|
||||
from thirdparty.prettyprint import prettyprint
|
||||
from xml.dom.minidom import Document
|
||||
from xml.parsers.expat import ExpatError
|
||||
|
||||
TECHNIC_ELEM_NAME = "Technic"
|
||||
TECHNICS_ELEM_NAME = "Technics"
|
||||
BANNER_ELEM_NAME = "Banner"
|
||||
COLUMNS_ELEM_NAME = "DatabaseColumns"
|
||||
COLUMN_ELEM_NAME = "Column"
|
||||
CELL_ELEM_NAME = "Cell"
|
||||
COLUMN_ATTR = "column"
|
||||
ROW_ELEM_NAME = "Row"
|
||||
TABLES_ELEM_NAME = "tables"
|
||||
DATABASE_COLUMNS_ELEM = "DB"
|
||||
DB_TABLES_ELEM_NAME = "DBTables"
|
||||
DB_TABLE_ELEM_NAME = "DBTable"
|
||||
IS_DBA_ELEM_NAME = "isDBA"
|
||||
FILE_CONTENT_ELEM_NAME = "FileContent"
|
||||
DB_ATTR = "db"
|
||||
UNKNOWN_COLUMN_TYPE = "unknown"
|
||||
USER_SETTINGS_ELEM_NAME = "UserSettings"
|
||||
USER_SETTING_ELEM_NAME = "UserSetting"
|
||||
USERS_ELEM_NAME = "Users"
|
||||
USER_ELEM_NAME = "User"
|
||||
DB_USER_ELEM_NAME = "DBUser"
|
||||
SETTINGS_ELEM_NAME = "Settings"
|
||||
DBS_ELEM_NAME = "DBs"
|
||||
DB_NAME_ELEM_NAME = "DBName"
|
||||
DATABASE_ELEM_NAME = "Database"
|
||||
TABLE_ELEM_NAME = "Table"
|
||||
DB_TABLE_VALUES_ELEM_NAME = "DBTableValues"
|
||||
DB_VALUES_ELEM = "DBValues"
|
||||
QUERIES_ELEM_NAME = "Queries"
|
||||
QUERY_ELEM_NAME = "Query"
|
||||
REGISTERY_ENTRIES_ELEM_NAME = "RegistryEntries"
|
||||
REGISTER_DATA_ELEM_NAME = "RegisterData"
|
||||
DEFAULT_DB = "All"
|
||||
MESSAGE_ELEM = "Message"
|
||||
MESSAGES_ELEM_NAME = "Messages"
|
||||
ERROR_ELEM_NAME = "Error"
|
||||
LST_ELEM_NAME = "List"
|
||||
LSTS_ELEM_NAME = "Lists"
|
||||
CURRENT_USER_ELEM_NAME = "CurrentUser"
|
||||
CURRENT_DB_ELEM_NAME = "CurrentDB"
|
||||
MEMBER_ELEM = "Member"
|
||||
ADMIN_USER = "Admin"
|
||||
REGULAR_USER = "User"
|
||||
STATUS_ELEM_NAME = "Status"
|
||||
RESULTS_ELEM_NAME = "Results"
|
||||
UNHANDLED_PROBLEM_TYPE = "Unhandled"
|
||||
NAME_ATTR = "name"
|
||||
TYPE_ATTR = "type"
|
||||
VALUE_ATTR = "value"
|
||||
SUCESS_ATTR = "success"
|
||||
NAME_SPACE_ATTR = 'http://www.w3.org/2001/XMLSchema-instance'
|
||||
XMLNS_ATTR = "xmlns:xsi"
|
||||
SCHEME_NAME = "sqlmap.xsd"
|
||||
SCHEME_NAME_ATTR = "xsi:noNamespaceSchemaLocation"
|
||||
CHARACTERS_TO_ENCODE = range(32) + range(127, 256)
|
||||
ENTITIES = {'"': '"', "'": "'"}
|
||||
|
||||
class XMLDump(object):
|
||||
'''
|
||||
This class purpose is to dump the data into an xml Format.
|
||||
The format of the xml file is described in the scheme file xml/sqlmap.xsd
|
||||
'''
|
||||
|
||||
def __init__(self):
|
||||
self._outputFile = None
|
||||
self._outputFP = None
|
||||
self.__root = None
|
||||
self.__doc = Document()
|
||||
|
||||
def _addToRoot(self, element):
|
||||
'''
|
||||
Adds element to the root element
|
||||
'''
|
||||
self.__root.appendChild(element)
|
||||
|
||||
def __write(self, data, n=True):
|
||||
'''
|
||||
Writes the data into the file
|
||||
'''
|
||||
if n:
|
||||
self._outputFP.write("%s\n" % data)
|
||||
else:
|
||||
self._outputFP.write("%s " % data)
|
||||
|
||||
self._outputFP.flush()
|
||||
|
||||
kb.dataOutputFlag = True
|
||||
|
||||
def _getRootChild(self, elemName):
|
||||
'''
|
||||
Returns the child of the root with the described name
|
||||
'''
|
||||
elements = self.__root.getElementsByTagName(elemName)
|
||||
if elements:
|
||||
return elements[0]
|
||||
|
||||
return elements
|
||||
|
||||
def _createTextNode(self, data):
|
||||
'''
|
||||
Creates a text node with utf8 data inside.
|
||||
The text is escaped to an fit the xml text Format.
|
||||
'''
|
||||
if data is None:
|
||||
return self.__doc.createTextNode(u'')
|
||||
else:
|
||||
escaped_data = saxutils.escape(data, ENTITIES)
|
||||
return self.__doc.createTextNode(escaped_data)
|
||||
|
||||
def _createAttribute(self, attrName, attrValue):
|
||||
'''
|
||||
Creates an attribute node with utf8 data inside.
|
||||
The text is escaped to an fit the xml text Format.
|
||||
'''
|
||||
attr = self.__doc.createAttribute(attrName)
|
||||
if attrValue is None:
|
||||
attr.nodeValue = u''
|
||||
else:
|
||||
attr.nodeValue = getUnicode(attrValue)
|
||||
return attr
|
||||
|
||||
def string(self, header, data, sort=True):
|
||||
'''
|
||||
Adds string element to the xml.
|
||||
'''
|
||||
if isinstance(data, (list, tuple, set)):
|
||||
self.lister(header, data, sort)
|
||||
return
|
||||
|
||||
messagesElem = self._getRootChild(MESSAGES_ELEM_NAME)
|
||||
if (not(messagesElem)):
|
||||
messagesElem = self.__doc.createElement(MESSAGES_ELEM_NAME)
|
||||
self._addToRoot(messagesElem)
|
||||
|
||||
if data:
|
||||
data = self._formatString(data)
|
||||
else:
|
||||
data = ""
|
||||
|
||||
elem = self.__doc.createElement(MESSAGE_ELEM)
|
||||
elem.setAttributeNode(self._createAttribute(TYPE_ATTR, header))
|
||||
elem.appendChild(self._createTextNode(data))
|
||||
messagesElem.appendChild(elem)
|
||||
|
||||
def lister(self, header, elements, sort=True):
|
||||
'''
|
||||
Adds information formatted as list element
|
||||
'''
|
||||
lstElem = self.__doc.createElement(LST_ELEM_NAME)
|
||||
lstElem.setAttributeNode(self._createAttribute(TYPE_ATTR, header))
|
||||
if elements:
|
||||
if sort:
|
||||
try:
|
||||
elements = set(elements)
|
||||
elements = list(elements)
|
||||
elements.sort(key=lambda x: x.lower())
|
||||
except:
|
||||
pass
|
||||
|
||||
for element in elements:
|
||||
memberElem = self.__doc.createElement(MEMBER_ELEM)
|
||||
lstElem.appendChild(memberElem)
|
||||
if isinstance(element, basestring):
|
||||
memberElem.setAttributeNode(self._createAttribute(TYPE_ATTR, "string"))
|
||||
memberElem.appendChild(self._createTextNode(element))
|
||||
elif isinstance(element, (list, tuple, set)):
|
||||
memberElem.setAttributeNode(self._createAttribute(TYPE_ATTR, "list"))
|
||||
for e in element:
|
||||
memberElemStr = self.__doc.createElement(MEMBER_ELEM)
|
||||
memberElemStr.setAttributeNode(self._createAttribute(TYPE_ATTR, "string"))
|
||||
memberElemStr.appendChild(self._createTextNode(getUnicode(e)))
|
||||
memberElem.appendChild(memberElemStr)
|
||||
listsElem = self._getRootChild(LSTS_ELEM_NAME)
|
||||
if not(listsElem):
|
||||
listsElem = self.__doc.createElement(LSTS_ELEM_NAME)
|
||||
self._addToRoot(listsElem)
|
||||
listsElem.appendChild(lstElem)
|
||||
|
||||
def technic(self, technicType, data):
|
||||
'''
|
||||
Adds information about the technic used to extract data from the db
|
||||
'''
|
||||
technicElem = self.__doc.createElement(TECHNIC_ELEM_NAME)
|
||||
technicElem.setAttributeNode(self._createAttribute(TYPE_ATTR, technicType))
|
||||
textNode = self._createTextNode(data)
|
||||
technicElem.appendChild(textNode)
|
||||
technicsElem = self._getRootChild(TECHNICS_ELEM_NAME)
|
||||
if not(technicsElem):
|
||||
technicsElem = self.__doc.createElement(TECHNICS_ELEM_NAME)
|
||||
self._addToRoot(technicsElem)
|
||||
technicsElem.appendChild(technicElem)
|
||||
|
||||
def banner(self, data):
|
||||
'''
|
||||
Adds information about the database banner to the xml.
|
||||
The banner contains information about the type and the version of the database.
|
||||
'''
|
||||
bannerElem = self.__doc.createElement(BANNER_ELEM_NAME)
|
||||
bannerElem.appendChild(self._createTextNode(data))
|
||||
self._addToRoot(bannerElem)
|
||||
|
||||
def currentUser(self, data):
|
||||
'''
|
||||
Adds information about the current database user to the xml
|
||||
'''
|
||||
currentUserElem = self.__doc.createElement(CURRENT_USER_ELEM_NAME)
|
||||
textNode = self._createTextNode(data)
|
||||
currentUserElem.appendChild(textNode)
|
||||
self._addToRoot(currentUserElem)
|
||||
|
||||
def currentDb(self, data):
|
||||
'''
|
||||
Adds information about the current database is use to the xml
|
||||
'''
|
||||
currentDBElem = self.__doc.createElement(CURRENT_DB_ELEM_NAME)
|
||||
textNode = self._createTextNode(data)
|
||||
currentDBElem.appendChild(textNode)
|
||||
self._addToRoot(currentDBElem)
|
||||
|
||||
def dba(self, isDBA):
|
||||
'''
|
||||
Adds information to the xml that indicates whether the user has DBA privileges
|
||||
'''
|
||||
isDBAElem = self.__doc.createElement(IS_DBA_ELEM_NAME)
|
||||
isDBAElem.setAttributeNode(self._createAttribute(VALUE_ATTR, getUnicode(isDBA)))
|
||||
self._addToRoot(isDBAElem)
|
||||
|
||||
def users(self, users):
|
||||
'''
|
||||
Adds a list of the existing users to the xml
|
||||
'''
|
||||
usersElem = self.__doc.createElement(USERS_ELEM_NAME)
|
||||
if isinstance(users, basestring):
|
||||
users = [users]
|
||||
if users:
|
||||
for user in users:
|
||||
userElem = self.__doc.createElement(DB_USER_ELEM_NAME)
|
||||
usersElem.appendChild(userElem)
|
||||
userElem.appendChild(self._createTextNode(user))
|
||||
self._addToRoot(usersElem)
|
||||
|
||||
def dbs(self, dbs):
|
||||
'''
|
||||
Adds a list of the existing databases to the xml
|
||||
'''
|
||||
dbsElem = self.__doc.createElement(DBS_ELEM_NAME)
|
||||
if dbs:
|
||||
for db in dbs:
|
||||
dbElem = self.__doc.createElement(DB_NAME_ELEM_NAME)
|
||||
dbsElem.appendChild(dbElem)
|
||||
dbElem.appendChild(self._createTextNode(db))
|
||||
self._addToRoot(dbsElem)
|
||||
|
||||
def userSettings(self, header, userSettings, subHeader):
|
||||
'''
|
||||
Adds information about the user's settings to the xml.
|
||||
The information can be user's passwords, privileges and etc..
|
||||
'''
|
||||
self._areAdmins = set()
|
||||
userSettingsElem = self._getRootChild(USER_SETTINGS_ELEM_NAME)
|
||||
if (not(userSettingsElem)):
|
||||
userSettingsElem = self.__doc.createElement(USER_SETTINGS_ELEM_NAME)
|
||||
self._addToRoot(userSettingsElem)
|
||||
|
||||
userSettingElem = self.__doc.createElement(USER_SETTING_ELEM_NAME)
|
||||
userSettingElem.setAttributeNode(self._createAttribute(TYPE_ATTR, header))
|
||||
|
||||
if isinstance(userSettings, (tuple, list, set)):
|
||||
self._areAdmins = userSettings[1]
|
||||
userSettings = userSettings[0]
|
||||
|
||||
users = userSettings.keys()
|
||||
users.sort(key=lambda x: x.lower())
|
||||
|
||||
for user in users:
|
||||
userElem = self.__doc.createElement(USER_ELEM_NAME)
|
||||
userSettingElem.appendChild(userElem)
|
||||
if user in self._areAdmins:
|
||||
userElem.setAttributeNode(self._createAttribute(TYPE_ATTR, ADMIN_USER))
|
||||
else:
|
||||
userElem.setAttributeNode(self._createAttribute(TYPE_ATTR, REGULAR_USER))
|
||||
|
||||
settings = userSettings[user]
|
||||
|
||||
settings.sort()
|
||||
|
||||
for setting in settings:
|
||||
settingsElem = self.__doc.createElement(SETTINGS_ELEM_NAME)
|
||||
settingsElem.setAttributeNode(self._createAttribute(TYPE_ATTR, subHeader))
|
||||
settingTextNode = self._createTextNode(setting)
|
||||
settingsElem.appendChild(settingTextNode)
|
||||
userElem.appendChild(settingsElem)
|
||||
userSettingsElem.appendChild(userSettingElem)
|
||||
|
||||
def dbTables(self, dbTables):
|
||||
'''
|
||||
Adds information of the existing db tables to the xml
|
||||
'''
|
||||
if not isinstance(dbTables, dict):
|
||||
self.string(TABLES_ELEM_NAME, dbTables)
|
||||
return
|
||||
|
||||
dbTablesElem = self.__doc.createElement(DB_TABLES_ELEM_NAME)
|
||||
|
||||
for db, tables in dbTables.items():
|
||||
tables.sort(key=lambda x: x.lower())
|
||||
dbElem = self.__doc.createElement(DATABASE_ELEM_NAME)
|
||||
dbElem.setAttributeNode(self._createAttribute(NAME_ATTR, db))
|
||||
dbTablesElem.appendChild(dbElem)
|
||||
for table in tables:
|
||||
tableElem = self.__doc.createElement(DB_TABLE_ELEM_NAME)
|
||||
tableElem.appendChild(self._createTextNode(table))
|
||||
dbElem.appendChild(tableElem)
|
||||
self._addToRoot(dbTablesElem)
|
||||
|
||||
def dbTableColumns(self, tableColumns):
|
||||
'''
|
||||
Adds information about the columns of the existing tables to the xml
|
||||
'''
|
||||
|
||||
columnsElem = self._getRootChild(COLUMNS_ELEM_NAME)
|
||||
if not(columnsElem):
|
||||
columnsElem = self.__doc.createElement(COLUMNS_ELEM_NAME)
|
||||
|
||||
for db, tables in tableColumns.items():
|
||||
if not db:
|
||||
db = DEFAULT_DB
|
||||
dbElem = self.__doc.createElement(DATABASE_COLUMNS_ELEM)
|
||||
dbElem.setAttributeNode(self._createAttribute(NAME_ATTR, db))
|
||||
columnsElem.appendChild(dbElem)
|
||||
|
||||
for table, columns in tables.items():
|
||||
tableElem = self.__doc.createElement(TABLE_ELEM_NAME)
|
||||
tableElem.setAttributeNode(self._createAttribute(NAME_ATTR, table))
|
||||
|
||||
colList = columns.keys()
|
||||
colList.sort(key=lambda x: x.lower())
|
||||
|
||||
for column in colList:
|
||||
colType = columns[column]
|
||||
colElem = self.__doc.createElement(COLUMN_ELEM_NAME)
|
||||
if colType is not None:
|
||||
colElem.setAttributeNode(self._createAttribute(TYPE_ATTR, colType))
|
||||
else:
|
||||
colElem.setAttributeNode(self._createAttribute(TYPE_ATTR, UNKNOWN_COLUMN_TYPE))
|
||||
colElem.appendChild(self._createTextNode(column))
|
||||
tableElem.appendChild(colElem)
|
||||
|
||||
self._addToRoot(columnsElem)
|
||||
|
||||
def dbTableValues(self, tableValues):
|
||||
'''
|
||||
Adds the values of specific table to the xml.
|
||||
The values are organized according to the relevant row and column.
|
||||
'''
|
||||
tableElem = self.__doc.createElement(DB_TABLE_VALUES_ELEM_NAME)
|
||||
if (tableValues is not None):
|
||||
db = tableValues["__infos__"]["db"]
|
||||
if not db:
|
||||
db = "All"
|
||||
table = tableValues["__infos__"]["table"]
|
||||
|
||||
count = int(tableValues["__infos__"]["count"])
|
||||
columns = tableValues.keys()
|
||||
columns.sort(key=lambda x: x.lower())
|
||||
|
||||
tableElem.setAttributeNode(self._createAttribute(DB_ATTR, db))
|
||||
tableElem.setAttributeNode(self._createAttribute(NAME_ATTR, table))
|
||||
|
||||
for i in range(count):
|
||||
rowElem = self.__doc.createElement(ROW_ELEM_NAME)
|
||||
tableElem.appendChild(rowElem)
|
||||
for column in columns:
|
||||
if column != "__infos__":
|
||||
info = tableValues[column]
|
||||
value = info["values"][i]
|
||||
|
||||
if re.search("^[\ *]*$", value):
|
||||
value = "NULL"
|
||||
|
||||
cellElem = self.__doc.createElement(CELL_ELEM_NAME)
|
||||
cellElem.setAttributeNode(self._createAttribute(COLUMN_ATTR, column))
|
||||
cellElem.appendChild(self._createTextNode(value))
|
||||
rowElem.appendChild(cellElem)
|
||||
|
||||
dbValuesElem = self._getRootChild(DB_VALUES_ELEM)
|
||||
if (not(dbValuesElem)):
|
||||
dbValuesElem = self.__doc.createElement(DB_VALUES_ELEM)
|
||||
self._addToRoot(dbValuesElem)
|
||||
|
||||
dbValuesElem.appendChild(tableElem)
|
||||
|
||||
logger.info("Table '%s.%s' dumped to XML file" % (db, table))
|
||||
|
||||
def dbColumns(self, dbColumns, colConsider, dbs):
|
||||
'''
|
||||
Adds information about the columns
|
||||
'''
|
||||
for column in dbColumns.keys():
|
||||
printDbs = {}
|
||||
for db, tblData in dbs.items():
|
||||
for tbl, colData in tblData.items():
|
||||
for col, dataType in colData.items():
|
||||
if column in col:
|
||||
if db in printDbs:
|
||||
if tbl in printDbs[db]:
|
||||
printDbs[db][tbl][col] = dataType
|
||||
else:
|
||||
printDbs[db][tbl] = {col: dataType}
|
||||
else:
|
||||
printDbs[db] = {}
|
||||
printDbs[db][tbl] = {col: dataType}
|
||||
|
||||
continue
|
||||
|
||||
self.dbTableColumns(printDbs)
|
||||
|
||||
def query(self, query, queryRes):
|
||||
'''
|
||||
Adds details of an executed query to the xml.
|
||||
The query details are the query itself and its results.
|
||||
'''
|
||||
queryElem = self.__doc.createElement(QUERY_ELEM_NAME)
|
||||
queryElem.setAttributeNode(self._createAttribute(VALUE_ATTR, query))
|
||||
queryElem.appendChild(self._createTextNode(queryRes))
|
||||
queriesElem = self._getRootChild(QUERIES_ELEM_NAME)
|
||||
if (not(queriesElem)):
|
||||
queriesElem = self.__doc.createElement(QUERIES_ELEM_NAME)
|
||||
self._addToRoot(queriesElem)
|
||||
queriesElem.appendChild(queryElem)
|
||||
|
||||
def registerValue(self, registerData):
|
||||
'''
|
||||
Adds information about an extracted registry key to the xml
|
||||
'''
|
||||
registerElem = self.__doc.createElement(REGISTER_DATA_ELEM_NAME)
|
||||
registerElem.appendChild(self._createTextNode(registerData))
|
||||
registriesElem = self._getRootChild(REGISTERY_ENTRIES_ELEM_NAME)
|
||||
if (not(registriesElem)):
|
||||
registriesElem = self.__doc.createElement(REGISTERY_ENTRIES_ELEM_NAME)
|
||||
self._addToRoot(registriesElem)
|
||||
registriesElem.appendChild(registerElem)
|
||||
|
||||
def rFile(self, filePath, data):
|
||||
'''
|
||||
Adds an extracted file's content to the xml
|
||||
'''
|
||||
fileContentElem = self.__doc.createElement(FILE_CONTENT_ELEM_NAME)
|
||||
fileContentElem.setAttributeNode(self._createAttribute(NAME_ATTR, filePath))
|
||||
fileContentElem.appendChild(self._createTextNode(data))
|
||||
self._addToRoot(fileContentElem)
|
||||
|
||||
def setOutputFile(self):
|
||||
'''
|
||||
Initiates the xml file from the configuration.
|
||||
'''
|
||||
if (conf.xmlFile):
|
||||
try:
|
||||
self._outputFile = conf.xmlFile
|
||||
self.__root = None
|
||||
|
||||
if os.path.exists(self._outputFile):
|
||||
try:
|
||||
self.__doc = xml.dom.minidom.parse(self._outputFile)
|
||||
self.__root = self.__doc.childNodes[0]
|
||||
except ExpatError:
|
||||
self.__doc = Document()
|
||||
|
||||
self._outputFP = codecs.open(self._outputFile, "w+", UNICODE_ENCODING)
|
||||
|
||||
if self.__root is None:
|
||||
self.__root = self.__doc.createElementNS(NAME_SPACE_ATTR, RESULTS_ELEM_NAME)
|
||||
self.__root.setAttributeNode(self._createAttribute(XMLNS_ATTR, NAME_SPACE_ATTR))
|
||||
self.__root.setAttributeNode(self._createAttribute(SCHEME_NAME_ATTR, SCHEME_NAME))
|
||||
self.__doc.appendChild(self.__root)
|
||||
except IOError:
|
||||
raise SqlmapFilePathException("Wrong filename provided for saving the xml file: %s" % conf.xmlFile)
|
||||
|
||||
def getOutputFile(self):
|
||||
return self._outputFile
|
||||
|
||||
def finish(self, resultStatus, resultMsg=""):
|
||||
'''
|
||||
Finishes the dumper operation:
|
||||
1. Adds the session status to the xml
|
||||
2. Writes the xml to the file
|
||||
3. Closes the xml file
|
||||
'''
|
||||
if ((self._outputFP is not None) and not(self._outputFP.closed)):
|
||||
statusElem = self.__doc.createElement(STATUS_ELEM_NAME)
|
||||
statusElem.setAttributeNode(self._createAttribute(SUCESS_ATTR, getUnicode(resultStatus)))
|
||||
|
||||
if not resultStatus:
|
||||
errorElem = self.__doc.createElement(ERROR_ELEM_NAME)
|
||||
|
||||
if isinstance(resultMsg, Exception):
|
||||
errorElem.setAttributeNode(self._createAttribute(TYPE_ATTR, type(resultMsg).__name__))
|
||||
else:
|
||||
errorElem.setAttributeNode(self._createAttribute(TYPE_ATTR, UNHANDLED_PROBLEM_TYPE))
|
||||
|
||||
errorElem.appendChild(self._createTextNode(getUnicode(resultMsg)))
|
||||
statusElem.appendChild(errorElem)
|
||||
|
||||
self._addToRoot(statusElem)
|
||||
self.__write(prettyprint.formatXML(self.__doc, encoding=UNICODE_ENCODING))
|
||||
self._outputFP.close()
|
||||
|
||||
|
||||
def closeDumper(status, msg=""):
|
||||
"""
|
||||
Closes the dumper of the session
|
||||
"""
|
||||
|
||||
if hasattr(conf, "dumper") and hasattr(conf.dumper, "finish"):
|
||||
conf.dumper.finish(status, msg)
|
||||
|
||||
dumper = XMLDump()
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'doc/COPYING' for copying permission
|
||||
"""
|
||||
|
||||
pass
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user