mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
4efd745b5c | ||
|
|
4833e40824 | ||
|
|
e0ecf8c804 | ||
|
|
cf7022b0a0 | ||
|
|
4c5cb9e0d4 | ||
|
|
bcb9482724 | ||
|
|
70e6700eb7 | ||
|
|
884ee56730 | ||
|
|
9ca5dc798e | ||
|
|
c96283a083 | ||
|
|
b4f9bf3f21 | ||
|
|
d52d5f0ddc | ||
|
|
d38acbe347 | ||
|
|
7dae324ed6 | ||
|
|
24aadbd850 | ||
|
|
3145de15d8 | ||
|
|
6e06df3d39 | ||
|
|
f01610b397 | ||
|
|
a5ed4c5255 | ||
|
|
9866e478b9 | ||
|
|
251c8ba064 | ||
|
|
1a95cea1f2 | ||
|
|
38d5086b88 | ||
|
|
7b5a640d1f | ||
|
|
e853508192 | ||
|
|
5d32ca638b | ||
|
|
0c8f6156d2 | ||
|
|
292bdf4479 | ||
|
|
82e6bc64c2 | ||
|
|
ea0ec868e9 | ||
|
|
424d4ee968 | ||
|
|
f4bfa7a5ae | ||
|
|
568ee4669e | ||
|
|
c3a6b71023 | ||
|
|
f7a237fdee |
@@ -1,7 +1,7 @@
|
||||
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
||||
of the GNU General Public License (GPL) is appended to this file.
|
||||
|
||||
sqlmap is (C) 2006-2019 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
sqlmap is (C) 2006-2020 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||
|
||||
This program is free software; you may redistribute and/or modify it under
|
||||
the terms of the GNU General Public License as published by the Free
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
id
|
||||
@@ -474,6 +474,7 @@ module_addr
|
||||
flag
|
||||
|
||||
# spanish
|
||||
|
||||
usuario
|
||||
nombre
|
||||
contrasena
|
||||
@@ -486,6 +487,7 @@ tono
|
||||
cuna
|
||||
|
||||
# german
|
||||
|
||||
benutzername
|
||||
benutzer
|
||||
passwort
|
||||
@@ -499,6 +501,7 @@ stichwort
|
||||
schlusselwort
|
||||
|
||||
# french
|
||||
|
||||
utilisateur
|
||||
usager
|
||||
consommateur
|
||||
@@ -510,6 +513,7 @@ touche
|
||||
clef
|
||||
|
||||
# italian
|
||||
|
||||
utente
|
||||
nome
|
||||
utilizzatore
|
||||
@@ -521,17 +525,33 @@ chiavetta
|
||||
cifrario
|
||||
|
||||
# portuguese
|
||||
|
||||
usufrutuario
|
||||
chave
|
||||
cavilha
|
||||
|
||||
# slavic
|
||||
|
||||
korisnik
|
||||
sifra
|
||||
lozinka
|
||||
kljuc
|
||||
|
||||
# turkish
|
||||
|
||||
isim
|
||||
ad
|
||||
adi
|
||||
soyisim
|
||||
soyad
|
||||
soyadi
|
||||
kimlik
|
||||
kimlikno
|
||||
tckimlikno
|
||||
tckimlik
|
||||
yonetici
|
||||
sil
|
||||
silinmis
|
||||
numara
|
||||
sira
|
||||
lokasyon
|
||||
@@ -547,7 +567,9 @@ ev_adres
|
||||
is_adresi
|
||||
ev_adresi
|
||||
isadresi
|
||||
isadres
|
||||
evadresi
|
||||
evadres
|
||||
il
|
||||
ilce
|
||||
eposta
|
||||
@@ -605,6 +627,7 @@ kontak
|
||||
kontaklar
|
||||
|
||||
# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py)
|
||||
|
||||
user
|
||||
pass
|
||||
cc_number
|
||||
@@ -828,6 +851,7 @@ xar_name
|
||||
xar_pass
|
||||
|
||||
# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html
|
||||
|
||||
account
|
||||
accnts
|
||||
accnt
|
||||
@@ -897,6 +921,7 @@ user_pwd
|
||||
user_passwd
|
||||
|
||||
# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047)
|
||||
|
||||
fld_id
|
||||
fld_username
|
||||
fld_password
|
||||
@@ -1049,6 +1074,7 @@ yhmm
|
||||
yonghu
|
||||
|
||||
# site:br
|
||||
|
||||
content_id
|
||||
codigo
|
||||
geometry
|
||||
@@ -1305,6 +1331,7 @@ newssummaryauthor
|
||||
and_xevento
|
||||
|
||||
# site:de
|
||||
|
||||
rolle_nr
|
||||
standort_nr
|
||||
ja
|
||||
@@ -1467,6 +1494,7 @@ summary_id
|
||||
gameid
|
||||
|
||||
# site:es
|
||||
|
||||
catid
|
||||
dni
|
||||
prune_id
|
||||
@@ -1556,6 +1584,7 @@ time_stamp
|
||||
bannerid
|
||||
|
||||
# site:fr
|
||||
|
||||
numero
|
||||
id_auteur
|
||||
titre
|
||||
@@ -1607,6 +1636,7 @@ n_dir
|
||||
age
|
||||
|
||||
# site:ru
|
||||
|
||||
dt_id
|
||||
subdivision_id
|
||||
sub_class_id
|
||||
@@ -1812,6 +1842,7 @@ language_id
|
||||
val
|
||||
|
||||
# site:jp
|
||||
|
||||
dealer_id
|
||||
modify_date
|
||||
regist_date
|
||||
@@ -1943,6 +1974,7 @@ c_commu_topic_id
|
||||
c_diary_comment_log_id
|
||||
|
||||
# site:it
|
||||
|
||||
idcomune
|
||||
idruolo
|
||||
idtrattamento
|
||||
@@ -2446,6 +2478,7 @@ client_img
|
||||
does_repeat
|
||||
|
||||
# site:cn
|
||||
|
||||
typeid
|
||||
cronid
|
||||
advid
|
||||
@@ -2621,6 +2654,7 @@ disablepostctrl
|
||||
fieldname
|
||||
|
||||
# site:id
|
||||
|
||||
ajar
|
||||
akses
|
||||
aktif
|
||||
@@ -2672,9 +2706,23 @@ urut
|
||||
waktu
|
||||
|
||||
# WebGoat
|
||||
|
||||
cookie
|
||||
login_count
|
||||
|
||||
# https://sqlwiki.netspi.com/attackQueries/dataTargeting/
|
||||
|
||||
credit
|
||||
card
|
||||
pin
|
||||
cvv
|
||||
pan
|
||||
password
|
||||
social
|
||||
ssn
|
||||
account
|
||||
confidential
|
||||
|
||||
# Misc
|
||||
|
||||
u_pass
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Reference: https://gist.github.com/sckalath/78ad449346171d29241a
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
[Banners]
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
users
|
||||
@@ -1618,6 +1618,7 @@ Contributor
|
||||
flag
|
||||
|
||||
# Various Joomla tables
|
||||
|
||||
jos_vm_product_download
|
||||
jos_vm_coupons
|
||||
jos_vm_product_reviews
|
||||
@@ -1711,6 +1712,7 @@ publicusers
|
||||
cmsusers
|
||||
|
||||
# List provided by Anastasios Monachos ([email protected])
|
||||
|
||||
blacklist
|
||||
cost
|
||||
moves
|
||||
@@ -1762,6 +1764,7 @@ TBLCORPUSERS
|
||||
TBLCORPORATEUSERS
|
||||
|
||||
# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py)
|
||||
|
||||
tbladmins
|
||||
sort
|
||||
_wfspro_admin
|
||||
@@ -2048,6 +2051,7 @@ Login
|
||||
Logins
|
||||
|
||||
# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html
|
||||
|
||||
account
|
||||
accnts
|
||||
accnt
|
||||
@@ -2117,6 +2121,7 @@ user_pwd
|
||||
user_passwd
|
||||
|
||||
# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047)
|
||||
|
||||
wsop
|
||||
Admin
|
||||
Config
|
||||
@@ -2437,9 +2442,11 @@ Affichage1name
|
||||
sb_host_adminAffichage1name
|
||||
|
||||
# site:jp
|
||||
|
||||
TypesTab
|
||||
|
||||
# site:it
|
||||
|
||||
utenti
|
||||
categorie
|
||||
attivita
|
||||
@@ -2581,6 +2588,7 @@ oil_stats_agents
|
||||
SGA_XPLAN_TPL_DBA_INDEXES
|
||||
|
||||
# site:fr
|
||||
|
||||
Avion
|
||||
departement
|
||||
Compagnie
|
||||
@@ -2751,6 +2759,7 @@ spip_ortho_dico
|
||||
spip_caches
|
||||
|
||||
# site:ru
|
||||
|
||||
guestbook
|
||||
binn_forum_settings
|
||||
binn_forms_templ
|
||||
@@ -2848,6 +2857,7 @@ binn_path_temps
|
||||
order_item
|
||||
|
||||
# site:de
|
||||
|
||||
tt_content
|
||||
kunde
|
||||
medien
|
||||
@@ -3010,6 +3020,7 @@ wp_categories
|
||||
chessmessages
|
||||
|
||||
# site:br
|
||||
|
||||
endereco
|
||||
pessoa
|
||||
usuarios
|
||||
@@ -3172,6 +3183,7 @@ LT_CUSTOM2
|
||||
LT_CUSTOM3
|
||||
|
||||
# site:es
|
||||
|
||||
jos_respuestas
|
||||
DEPARTAMENTO
|
||||
EMPLEADO
|
||||
@@ -3210,6 +3222,7 @@ grupo
|
||||
facturas
|
||||
|
||||
# site:cn
|
||||
|
||||
url
|
||||
cdb_adminactions
|
||||
BlockInfo
|
||||
@@ -3355,6 +3368,7 @@ mymps_mail_sendlist
|
||||
mymps_navurl
|
||||
|
||||
# site:tr
|
||||
|
||||
kullanici
|
||||
kullanicilar
|
||||
yonetici
|
||||
@@ -3401,6 +3415,7 @@ kontak
|
||||
kontaklar
|
||||
|
||||
# List provided by Pedrito Perez ([email protected])
|
||||
|
||||
adminstbl
|
||||
admintbl
|
||||
affiliateUsers
|
||||
@@ -3415,4 +3430,69 @@ userstbl
|
||||
usertbl
|
||||
|
||||
# WebGoat
|
||||
|
||||
user_data
|
||||
|
||||
# https://laurent22.github.io/so-injections/
|
||||
|
||||
accounts
|
||||
admin
|
||||
baza_site
|
||||
benutzer
|
||||
category
|
||||
comments
|
||||
company
|
||||
credentials
|
||||
Customer
|
||||
customers
|
||||
data
|
||||
details
|
||||
dhruv_users
|
||||
dt_tb
|
||||
employees
|
||||
events
|
||||
forsale
|
||||
friends
|
||||
giorni
|
||||
images
|
||||
info
|
||||
items
|
||||
kontabankowe
|
||||
login
|
||||
logs
|
||||
markers
|
||||
members
|
||||
messages
|
||||
orders
|
||||
order_table
|
||||
photos
|
||||
player
|
||||
players
|
||||
points
|
||||
register
|
||||
reports
|
||||
rooms
|
||||
shells
|
||||
signup
|
||||
songs
|
||||
student
|
||||
students
|
||||
table
|
||||
table2
|
||||
tbl_images
|
||||
tblproduct
|
||||
testv2
|
||||
tickets
|
||||
topicinfo
|
||||
trabajo
|
||||
user
|
||||
user_auth
|
||||
userinfo
|
||||
user_info
|
||||
userregister
|
||||
users
|
||||
usuarios
|
||||
utenti
|
||||
wm_products
|
||||
wp_payout_history
|
||||
zamowienia
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml)
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Opera
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||
|
||||
sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
|
||||
sqlmap é uma ferramenta de teste de intrusão, de código aberto, que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de intrusão por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional.
|
||||
|
||||
Imagens
|
||||
----
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
beep.py - Make a beep sound
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
cloak.py - Simple file encryption/compression utility
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
dbgtool.py - Portable executable to ASCII debug script converter
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Removes trailing spaces from blank lines inside project files
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Stress test against Python3
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Removes duplicate entries in wordlist like files
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# sudo pip install modernize
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs py2diatra on all python files (prerequisite: pip install pydiatra)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
# Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
# See the file 'LICENSE' for copying permission
|
||||
|
||||
# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \; | grep -v "redefines '_'"
|
||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes3 '{}' \; | grep -v "redefines '_'"
|
||||
|
||||
@@ -16,7 +16,7 @@ cat > $TMP_DIR/setup.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -67,7 +67,7 @@ cat > sqlmap/__init__.py << EOF
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"""
|
||||
vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
|
||||
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -456,18 +456,18 @@ def start():
|
||||
for place in parameters:
|
||||
# Test User-Agent and Referer headers only if
|
||||
# --level >= 3
|
||||
skip = (place == PLACE.USER_AGENT and conf.level < 3)
|
||||
skip |= (place == PLACE.REFERER and conf.level < 3)
|
||||
skip = (place == PLACE.USER_AGENT and (kb.testOnlyCustom or conf.level < 3))
|
||||
skip |= (place == PLACE.REFERER and (kb.testOnlyCustom or conf.level < 3))
|
||||
|
||||
# --param-filter
|
||||
skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter)
|
||||
|
||||
# Test Host header only if
|
||||
# --level >= 5
|
||||
skip |= (place == PLACE.HOST and conf.level < 5)
|
||||
skip |= (place == PLACE.HOST and (kb.testOnlyCustom or conf.level < 5))
|
||||
|
||||
# Test Cookie header only if --level >= 2
|
||||
skip |= (place == PLACE.COOKIE and conf.level < 2)
|
||||
skip |= (place == PLACE.COOKIE and (kb.testOnlyCustom or conf.level < 2))
|
||||
|
||||
skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None))
|
||||
skip |= (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.skip, True) not in ([], None))
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -247,7 +247,7 @@ class Agent(object):
|
||||
|
||||
# If we are replacing (<where>) the parameter original value with
|
||||
# our payload do not prepend with the prefix
|
||||
if where == PAYLOAD.WHERE.REPLACE:
|
||||
if where == PAYLOAD.WHERE.REPLACE and not conf.prefix: # Note: https://github.com/sqlmapproject/sqlmap/issues/4030
|
||||
query = ""
|
||||
|
||||
# If the technique is stacked queries (<stype>) do not put a space
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+9
-4
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -1104,7 +1104,10 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
|
||||
dataToStdout("%s" % message, forceOutput=not kb.wizardMode, bold=True)
|
||||
kb.prependFlag = False
|
||||
|
||||
retVal = _input().strip() or default
|
||||
retVal = _input()
|
||||
if not retVal: # Note: Python doesn't print newline on empty input
|
||||
dataToStdout("\n")
|
||||
retVal = retVal.strip() or default
|
||||
retVal = getUnicode(retVal, encoding=sys.stdin.encoding) if retVal else retVal
|
||||
except:
|
||||
try:
|
||||
@@ -1123,8 +1126,10 @@ def readInput(message, default=None, checkBatch=True, boolean=False):
|
||||
|
||||
if boolean:
|
||||
retVal = retVal.strip().upper() == 'Y'
|
||||
else:
|
||||
retVal = retVal or ""
|
||||
|
||||
return retVal or ""
|
||||
return retVal
|
||||
|
||||
def setTechnique(technique):
|
||||
"""
|
||||
@@ -1643,7 +1648,7 @@ def parseTargetUrl():
|
||||
if '=' not in urlSplit.query:
|
||||
conf.url = "%s?%s" % (conf.url, getUnicode(urlSplit.query))
|
||||
else:
|
||||
conf.parameters[PLACE.GET] = urldecode(urlSplit.query) if urlSplit.query and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query
|
||||
conf.parameters[PLACE.GET] = urldecode(urlSplit.query, spaceplus=not conf.base64Parameter) if urlSplit.query and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query
|
||||
|
||||
if not conf.referer and (intersect(REFERER_ALIASES, conf.testParameter, True) or conf.level >= 3):
|
||||
debugMsg = "setting the HTTP Referer header to the target URL"
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+2
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -19,6 +19,7 @@ import re
|
||||
import sys
|
||||
|
||||
from lib.core.bigarray import BigArray
|
||||
from lib.core.compat import xrange
|
||||
from lib.core.data import conf
|
||||
from lib.core.data import kb
|
||||
from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+5
-15
@@ -1,11 +1,10 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import cgi
|
||||
import hashlib
|
||||
import os
|
||||
import re
|
||||
@@ -70,13 +69,12 @@ class Dump(object):
|
||||
self._lock = threading.Lock()
|
||||
|
||||
def _write(self, data, newline=True, console=True, content_type=None):
|
||||
if conf.api:
|
||||
dataToStdout(data, content_type=content_type, status=CONTENT_STATUS.COMPLETE)
|
||||
return
|
||||
|
||||
text = "%s%s" % (data, "\n" if newline else " ")
|
||||
|
||||
if console:
|
||||
if conf.api:
|
||||
dataToStdout(data, content_type=content_type, status=CONTENT_STATUS.COMPLETE)
|
||||
|
||||
elif console:
|
||||
dataToStdout(text)
|
||||
|
||||
multiThreadMode = isMultiThreadMode()
|
||||
@@ -118,7 +116,6 @@ class Dump(object):
|
||||
def string(self, header, data, content_type=None, sort=True):
|
||||
if conf.api:
|
||||
self._write(data, content_type=content_type)
|
||||
return
|
||||
|
||||
if isListLike(data):
|
||||
self.lister(header, data, content_type, sort)
|
||||
@@ -150,7 +147,6 @@ class Dump(object):
|
||||
|
||||
if conf.api:
|
||||
self._write(elements, content_type=content_type)
|
||||
return
|
||||
|
||||
if elements:
|
||||
self._write("%s [%d]:" % (header, len(elements)))
|
||||
@@ -202,7 +198,6 @@ class Dump(object):
|
||||
|
||||
if conf.api:
|
||||
self._write(userSettings, content_type=content_type)
|
||||
return
|
||||
|
||||
if userSettings:
|
||||
self._write("%s:" % header)
|
||||
@@ -236,7 +231,6 @@ class Dump(object):
|
||||
if isinstance(dbTables, dict) and len(dbTables) > 0:
|
||||
if conf.api:
|
||||
self._write(dbTables, content_type=CONTENT_TYPE.TABLES)
|
||||
return
|
||||
|
||||
maxlength = 0
|
||||
|
||||
@@ -279,7 +273,6 @@ class Dump(object):
|
||||
if isinstance(tableColumns, dict) and len(tableColumns) > 0:
|
||||
if conf.api:
|
||||
self._write(tableColumns, content_type=content_type)
|
||||
return
|
||||
|
||||
for db, tables in tableColumns.items():
|
||||
if not db:
|
||||
@@ -353,7 +346,6 @@ class Dump(object):
|
||||
if isinstance(dbTables, dict) and len(dbTables) > 0:
|
||||
if conf.api:
|
||||
self._write(dbTables, content_type=CONTENT_TYPE.COUNT)
|
||||
return
|
||||
|
||||
maxlength1 = len("Table")
|
||||
maxlength2 = len("Entries")
|
||||
@@ -412,7 +404,6 @@ class Dump(object):
|
||||
|
||||
if conf.api:
|
||||
self._write(tableValues, content_type=CONTENT_TYPE.DUMP_TABLE)
|
||||
return
|
||||
|
||||
dumpDbPath = os.path.join(conf.dumpPath, unsafeSQLIdentificatorNaming(db))
|
||||
|
||||
@@ -668,7 +659,6 @@ class Dump(object):
|
||||
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
||||
if conf.api:
|
||||
self._write(dbColumnsDict, content_type=CONTENT_TYPE.COLUMNS)
|
||||
return
|
||||
|
||||
for column in dbColumnsDict.keys():
|
||||
if colConsider == "1":
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+80
-71
@@ -1,27 +1,32 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
import os
|
||||
import re
|
||||
import socket
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import threading
|
||||
import webbrowser
|
||||
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import saveConfig
|
||||
from lib.core.data import paths
|
||||
from lib.core.defaults import defaults
|
||||
from lib.core.enums import MKSTEMP_PREFIX
|
||||
from lib.core.exception import SqlmapMissingDependence
|
||||
from lib.core.settings import DEV_EMAIL_ADDRESS
|
||||
from lib.core.settings import IS_WIN
|
||||
from lib.core.settings import ISSUES_PAGE
|
||||
from lib.core.settings import GIT_PAGE
|
||||
from lib.core.settings import SITE
|
||||
from lib.core.settings import VERSION_STRING
|
||||
from lib.core.settings import WIKI_PAGE
|
||||
from thirdparty.six.moves import tkinter_messagebox as _tkinter_messagebox
|
||||
from thirdparty.six.moves import queue as _queue
|
||||
|
||||
line = ""
|
||||
@@ -30,19 +35,20 @@ queue = None
|
||||
|
||||
def runGui(parser):
|
||||
try:
|
||||
import tkinter
|
||||
import tkinter.scrolledtext
|
||||
import tkinter.ttk
|
||||
from thirdparty.six.moves import tkinter as _tkinter
|
||||
from thirdparty.six.moves import tkinter_scrolledtext as _tkinter_scrolledtext
|
||||
from thirdparty.six.moves import tkinter_ttk as _tkinter_ttk
|
||||
from thirdparty.six.moves import tkinter_messagebox as _tkinter_messagebox
|
||||
except ImportError as ex:
|
||||
raise SqlmapMissingDependence("missing dependence ('%s')" % getSafeExString(ex))
|
||||
|
||||
# Reference: https://www.reddit.com/r/learnpython/comments/985umy/limit_user_input_to_only_int_with_tkinter/e4dj9k9?utm_source=share&utm_medium=web2x
|
||||
class ConstrainedEntry(tkinter.Entry):
|
||||
class ConstrainedEntry(_tkinter.Entry):
|
||||
def __init__(self, master=None, **kwargs):
|
||||
self.var = tkinter.StringVar()
|
||||
self.var = _tkinter.StringVar()
|
||||
self.regex = kwargs["regex"]
|
||||
del kwargs["regex"]
|
||||
tkinter.Entry.__init__(self, master, textvariable=self.var, **kwargs)
|
||||
_tkinter.Entry.__init__(self, master, textvariable=self.var, **kwargs)
|
||||
self.old_value = ''
|
||||
self.var.trace('w', self.check)
|
||||
self.get, self.set = self.var.get, self.var.set
|
||||
@@ -54,23 +60,23 @@ def runGui(parser):
|
||||
self.set(self.old_value)
|
||||
|
||||
# Reference: https://code.activestate.com/recipes/580726-tkinter-notebook-that-fits-to-the-height-of-every-/
|
||||
class AutoresizableNotebook(tkinter.ttk.Notebook):
|
||||
class AutoresizableNotebook(_tkinter_ttk.Notebook):
|
||||
def __init__(self, master=None, **kw):
|
||||
tkinter.ttk.Notebook.__init__(self, master, **kw)
|
||||
_tkinter_ttk.Notebook.__init__(self, master, **kw)
|
||||
self.bind("<<NotebookTabChanged>>", self._on_tab_changed)
|
||||
|
||||
def _on_tab_changed(self,event):
|
||||
def _on_tab_changed(self, event):
|
||||
event.widget.update_idletasks()
|
||||
|
||||
tab = event.widget.nametowidget(event.widget.select())
|
||||
event.widget.configure(height=tab.winfo_reqheight())
|
||||
|
||||
window = tkinter.Tk()
|
||||
window = _tkinter.Tk()
|
||||
window.title(VERSION_STRING)
|
||||
|
||||
# Reference: https://www.holadevs.com/pregunta/64750/change-selected-tab-color-in-ttknotebook
|
||||
style = tkinter.ttk.Style()
|
||||
settings = {"TNotebook.Tab": {"configure": {"padding": [5, 1], "background": "#fdd57e" }, "map": {"background": [("selected", "#C70039"), ("active", "#fc9292")], "foreground": [("selected", "#ffffff"), ("active", "#000000")]}}}
|
||||
style = _tkinter_ttk.Style()
|
||||
settings = {"TNotebook.Tab": {"configure": {"padding": [5, 1], "background": "#fdd57e"}, "map": {"background": [("selected", "#C70039"), ("active", "#fc9292")], "foreground": [("selected", "#ffffff"), ("active", "#000000")]}}}
|
||||
style.theme_create("custom", parent="alt", settings=settings)
|
||||
style.theme_use("custom")
|
||||
|
||||
@@ -110,48 +116,19 @@ def runGui(parser):
|
||||
line = ""
|
||||
event.widget.master.master.destroy()
|
||||
return "break"
|
||||
except:
|
||||
return
|
||||
|
||||
event.widget.insert(tkinter.END, "\n")
|
||||
|
||||
counter = 0
|
||||
while True:
|
||||
line = ""
|
||||
try:
|
||||
#line = queue.get_nowait()
|
||||
line = queue.get(timeout=.1)
|
||||
event.widget.insert(tkinter.END, line)
|
||||
counter = 0
|
||||
except _queue.Empty:
|
||||
event.widget.see(tkinter.END)
|
||||
event.widget.update_idletasks()
|
||||
if counter > 3:
|
||||
break
|
||||
else:
|
||||
counter += 1
|
||||
event.widget.insert(_tkinter.END, "\n")
|
||||
|
||||
return "break"
|
||||
|
||||
def run():
|
||||
global alive
|
||||
global process
|
||||
global queue
|
||||
|
||||
ON_POSIX = "posix" in sys.builtin_module_names
|
||||
|
||||
def enqueue(stream, queue):
|
||||
for line in iter(stream.readline, b''):
|
||||
queue.put(line)
|
||||
stream.close()
|
||||
|
||||
process = subprocess.Popen("/bin/bash", shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, bufsize=1, close_fds=ON_POSIX)
|
||||
|
||||
# Reference: https://stackoverflow.com/a/4896288
|
||||
queue = _queue.Queue()
|
||||
thread = threading.Thread(target=enqueue, args=(process.stdout, queue))
|
||||
thread.daemon = True
|
||||
thread.start()
|
||||
|
||||
|
||||
options = {}
|
||||
config = {}
|
||||
|
||||
for key in window._widgets:
|
||||
dest, type = key
|
||||
@@ -168,18 +145,40 @@ def runGui(parser):
|
||||
else:
|
||||
value = bool(widget.var.get())
|
||||
|
||||
options[dest] = value
|
||||
config[dest] = value
|
||||
|
||||
for option in parser.option_list:
|
||||
options[option.dest] = defaults.get(option.dest, None)
|
||||
config[option.dest] = defaults.get(option.dest, None)
|
||||
|
||||
parser._args = options
|
||||
handle, configFile = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.CONFIG, text=True)
|
||||
os.close(handle)
|
||||
|
||||
top = tkinter.Toplevel()
|
||||
saveConfig(config, configFile)
|
||||
|
||||
def enqueue(stream, queue):
|
||||
global alive
|
||||
|
||||
for line in iter(stream.readline, b''):
|
||||
queue.put(line)
|
||||
|
||||
alive = False
|
||||
stream.close()
|
||||
|
||||
alive = True
|
||||
|
||||
process = subprocess.Popen([sys.executable or "python", os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap.py"), "-c", configFile], shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, bufsize=1, close_fds=not IS_WIN)
|
||||
|
||||
# Reference: https://stackoverflow.com/a/4896288
|
||||
queue = _queue.Queue()
|
||||
thread = threading.Thread(target=enqueue, args=(process.stdout, queue))
|
||||
thread.daemon = True
|
||||
thread.start()
|
||||
|
||||
top = _tkinter.Toplevel()
|
||||
top.title("Console")
|
||||
|
||||
# Reference: https://stackoverflow.com/a/13833338
|
||||
text = tkinter.scrolledtext.ScrolledText(top, undo=True)
|
||||
text = _tkinter_scrolledtext.ScrolledText(top, undo=True)
|
||||
text.bind("<Key>", onKeyPress)
|
||||
text.bind("<Return>", onReturnPress)
|
||||
text.pack()
|
||||
@@ -187,24 +186,34 @@ def runGui(parser):
|
||||
|
||||
center(top)
|
||||
|
||||
menubar = tkinter.Menu(window)
|
||||
while alive:
|
||||
line = ""
|
||||
try:
|
||||
# line = queue.get_nowait()
|
||||
line = queue.get(timeout=.1)
|
||||
text.insert(_tkinter.END, line)
|
||||
except _queue.Empty:
|
||||
text.see(_tkinter.END)
|
||||
text.update_idletasks()
|
||||
|
||||
filemenu = tkinter.Menu(menubar, tearoff=0)
|
||||
filemenu.add_command(label="Open", state=tkinter.DISABLED)
|
||||
filemenu.add_command(label="Save", state=tkinter.DISABLED)
|
||||
menubar = _tkinter.Menu(window)
|
||||
|
||||
filemenu = _tkinter.Menu(menubar, tearoff=0)
|
||||
filemenu.add_command(label="Open", state=_tkinter.DISABLED)
|
||||
filemenu.add_command(label="Save", state=_tkinter.DISABLED)
|
||||
filemenu.add_separator()
|
||||
filemenu.add_command(label="Exit", command=window.quit)
|
||||
menubar.add_cascade(label="File", menu=filemenu)
|
||||
|
||||
menubar.add_command(label="Run", command=run)
|
||||
|
||||
helpmenu = tkinter.Menu(menubar, tearoff=0)
|
||||
helpmenu = _tkinter.Menu(menubar, tearoff=0)
|
||||
helpmenu.add_command(label="Official site", command=lambda: webbrowser.open(SITE))
|
||||
helpmenu.add_command(label="Github pages", command=lambda: webbrowser.open(GIT_PAGE))
|
||||
helpmenu.add_command(label="Wiki pages", command=lambda: webbrowser.open(WIKI_PAGE))
|
||||
helpmenu.add_command(label="Report issue", command=lambda: webbrowser.open(ISSUES_PAGE))
|
||||
helpmenu.add_separator()
|
||||
helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "Copyright (c) 2006-2019\n\n (%s)" % DEV_EMAIL_ADDRESS))
|
||||
helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "Copyright (c) 2006-2020\n\n (%s)" % DEV_EMAIL_ADDRESS))
|
||||
menubar.add_cascade(label="Help", menu=helpmenu)
|
||||
|
||||
window.config(menu=menubar)
|
||||
@@ -216,33 +225,33 @@ def runGui(parser):
|
||||
frames = {}
|
||||
|
||||
for group in parser.option_groups:
|
||||
frame = frames[group.title] = tkinter.Frame(notebook, width=200, height=200)
|
||||
frame = frames[group.title] = _tkinter.Frame(notebook, width=200, height=200)
|
||||
notebook.add(frames[group.title], text=group.title)
|
||||
|
||||
tkinter.Label(frame).grid(column=0, row=0, sticky=tkinter.W)
|
||||
_tkinter.Label(frame).grid(column=0, row=0, sticky=_tkinter.W)
|
||||
|
||||
row = 1
|
||||
if group.get_description():
|
||||
tkinter.Label(frame, text="%s:" % group.get_description()).grid(column=0, row=1, columnspan=3, sticky=tkinter.W)
|
||||
tkinter.Label(frame).grid(column=0, row=2, sticky=tkinter.W)
|
||||
_tkinter.Label(frame, text="%s:" % group.get_description()).grid(column=0, row=1, columnspan=3, sticky=_tkinter.W)
|
||||
_tkinter.Label(frame).grid(column=0, row=2, sticky=_tkinter.W)
|
||||
row += 2
|
||||
|
||||
for option in group.option_list:
|
||||
tkinter.Label(frame, text="%s " % parser.formatter._format_option_strings(option)).grid(column=0, row=row, sticky=tkinter.W)
|
||||
_tkinter.Label(frame, text="%s " % parser.formatter._format_option_strings(option)).grid(column=0, row=row, sticky=_tkinter.W)
|
||||
|
||||
if option.type == "string":
|
||||
widget = tkinter.Entry(frame)
|
||||
widget = _tkinter.Entry(frame)
|
||||
elif option.type == "float":
|
||||
widget = ConstrainedEntry(frame, regex=r"\A\d*\.?\d*\Z")
|
||||
elif option.type == "int":
|
||||
widget = ConstrainedEntry(frame, regex=r"\A\d*\Z")
|
||||
else:
|
||||
var = tkinter.IntVar()
|
||||
widget = tkinter.Checkbutton(frame, variable=var)
|
||||
var = _tkinter.IntVar()
|
||||
widget = _tkinter.Checkbutton(frame, variable=var)
|
||||
widget.var = var
|
||||
|
||||
first = first or widget
|
||||
widget.grid(column=1, row=row, sticky=tkinter.W)
|
||||
widget.grid(column=1, row=row, sticky=_tkinter.W)
|
||||
|
||||
window._widgets[(option.dest, option.type)] = widget
|
||||
|
||||
@@ -251,15 +260,15 @@ def runGui(parser):
|
||||
if hasattr(widget, "insert"):
|
||||
widget.insert(0, default)
|
||||
|
||||
tkinter.Label(frame, text=" %s" % option.help).grid(column=2, row=row, sticky=tkinter.W)
|
||||
_tkinter.Label(frame, text=" %s" % option.help).grid(column=2, row=row, sticky=_tkinter.W)
|
||||
|
||||
row += 1
|
||||
|
||||
tkinter.Label(frame).grid(column=0, row=row, sticky=tkinter.W)
|
||||
_tkinter.Label(frame).grid(column=0, row=row, sticky=_tkinter.W)
|
||||
|
||||
notebook.pack(expand=1, fill="both")
|
||||
notebook.enable_traversal()
|
||||
|
||||
first.focus()
|
||||
|
||||
window.mainloop()
|
||||
window.mainloop()
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+13
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -995,7 +995,7 @@ def _setHTTPHandlers():
|
||||
errMsg = "invalid proxy address '%s' ('%s')" % (conf.proxy, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
hostnamePort = _.netloc.split(":")
|
||||
hostnamePort = _.netloc.rsplit(":", 1)
|
||||
|
||||
scheme = _.scheme.upper()
|
||||
hostname = hostnamePort[0]
|
||||
@@ -2466,6 +2466,10 @@ def _basicOptionValidation():
|
||||
errMsg = "invalid regular expression '%s' ('%s')" % (conf.paramExclude, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.cookieDel and len(conf.cookieDel):
|
||||
errMsg = "option '--cookie-del' should contain a single character (e.g. ';')"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.crawlExclude:
|
||||
try:
|
||||
re.compile(conf.crawlExclude)
|
||||
@@ -2473,6 +2477,13 @@ def _basicOptionValidation():
|
||||
errMsg = "invalid regular expression '%s' ('%s')" % (conf.crawlExclude, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.scope:
|
||||
try:
|
||||
re.compile(conf.scope)
|
||||
except Exception as ex:
|
||||
errMsg = "invalid regular expression '%s' ('%s')" % (conf.scope, getSafeExString(ex))
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
if conf.dumpTable and conf.dumpAll:
|
||||
errMsg = "switch '--dump' is incompatible with switch '--dump-all'"
|
||||
raise SqlmapSyntaxException(errMsg)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -27,7 +27,7 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
import pydot
|
||||
except ImportError as ex:
|
||||
errMsg = "profiling requires third-party libraries ('%s') " % getSafeExString(ex)
|
||||
errMsg += "(Hint: 'sudo apt-get install python-pydot python-pyparsing python-profiler graphviz')"
|
||||
errMsg += "(Hint: 'sudo apt install python-pydot python-pyparsing python-profiler graphviz')"
|
||||
logger.error(errMsg)
|
||||
|
||||
return
|
||||
@@ -84,7 +84,7 @@ def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None):
|
||||
pydotGraph.write_png(imageOutputFile)
|
||||
except OSError:
|
||||
errMsg = "profiling requires graphviz installed "
|
||||
errMsg += "(Hint: 'sudo apt-get install graphviz')"
|
||||
errMsg += "(Hint: 'sudo apt install graphviz')"
|
||||
logger.error(errMsg)
|
||||
else:
|
||||
infoMsg = "displaying interactive graph with xdot library"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -18,7 +18,7 @@ from lib.core.enums import OS
|
||||
from thirdparty.six import unichr as _unichr
|
||||
|
||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||
VERSION = "1.3.12.0"
|
||||
VERSION = "1.4"
|
||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -401,7 +401,7 @@ def _setRequestParams():
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
if conf.csrfToken:
|
||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
||||
errMsg += "found in provided GET, POST, Cookie or header values"
|
||||
raise SqlmapGenericException(errMsg)
|
||||
|
||||
+4
-4
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -69,14 +69,14 @@ def vulnTest():
|
||||
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape", (u": '\u0161u\u0107uraj'",)),
|
||||
("--list-tampers", ("between", "MySQL", "xforwardedfor")),
|
||||
("-r <request> --flush-session -v 5", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar")),
|
||||
("-l <log> --flush-session --skip-waf -v 3 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell")),
|
||||
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
||||
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
||||
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
||||
("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
||||
("-u <url> --flush-session -H 'Foo: Bar' -H 'Sna: Fu' --data='<root><param name=\"id\" value=\"1*\"/></root>' --union-char=1 --mobile --answers='smartphone=3' --banner --smart -v 5", ("might be injectable", "Payload: <root><param name=\"id\" value=\"1", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.", "Nexus", "Sna: Fu", "Foo: Bar")),
|
||||
("-u <url> --flush-session --method=PUT --data='a=1&b=2&c=3&id=1' --skip-static --dump -T users --start=1 --stop=2", ("might be injectable", "Parameter: id (PUT)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "2 entries")),
|
||||
("-u <url> --flush-session -H 'id: 1*' --tables", ("might be injectable", "Parameter: id #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
||||
("-u <url> --flush-session --banner --invalid-logical --technique=B --test-filter='OR boolean' --tamper=space2dash", ("banner: '3.", " LIKE ")),
|
||||
("-u <url> --flush-session --banner --invalid-logical --technique=B --predict-output --test-filter='OR boolean' --tamper=space2dash", ("banner: '3.", " LIKE ")),
|
||||
("-u <url> --flush-session --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e; id=1*; id2=2\" --tables --union-cols=3", ("might be injectable", "Cookie #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
||||
("-u <url> --flush-session --null-connection --technique=B --tamper=between,randomcase --banner", ("NULL connection is supported with HEAD method", "banner: '3.")),
|
||||
("-u <url> --flush-session --parse-errors --test-filter=\"subquery\" --eval=\"import hashlib; id2=2; id3=hashlib.md5(id.encode()).hexdigest()\" --referer=\"localhost\"", ("might be injectable", ": syntax error", "back-end DBMS: SQLite", "WHERE or HAVING clause (subquery")),
|
||||
@@ -208,7 +208,7 @@ def smokeTest():
|
||||
continue
|
||||
|
||||
for filename in files:
|
||||
if os.path.splitext(filename)[1].lower() == ".py" and filename != "__init__.py":
|
||||
if os.path.splitext(filename)[1].lower() == ".py" and filename not in ("__init__.py", "gui.py"):
|
||||
path = os.path.join(root, os.path.splitext(filename)[0])
|
||||
path = path.replace(paths.SQLMAP_ROOT_PATH, '.')
|
||||
path = path.replace(os.sep, '.').lstrip('.')
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -136,6 +136,6 @@ def update():
|
||||
infoMsg += "https://github.com/sqlmapproject/sqlmap/downloads"
|
||||
else:
|
||||
infoMsg = "for Linux platform it's recommended "
|
||||
infoMsg += "to install a standard 'git' package (e.g.: 'sudo apt-get install git')"
|
||||
infoMsg += "to install a standard 'git' package (e.g.: 'sudo apt install git')"
|
||||
|
||||
logger.info(infoMsg)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -78,6 +78,7 @@ from lib.core.defaults import defaults
|
||||
from lib.core.dicts import DEPRECATED_OPTIONS
|
||||
from lib.core.enums import AUTOCOMPLETE_TYPE
|
||||
from lib.core.exception import SqlmapShellQuitException
|
||||
from lib.core.exception import SqlmapSilentQuitException
|
||||
from lib.core.exception import SqlmapSyntaxException
|
||||
from lib.core.option import _createHomeDirectories
|
||||
from lib.core.settings import BASIC_HELP_ITEMS
|
||||
@@ -863,10 +864,10 @@ def cmdLineParser(argv=None):
|
||||
|
||||
if "--gui" in argv:
|
||||
from lib.core.gui import runGui
|
||||
|
||||
runGui(parser)
|
||||
|
||||
if hasattr(parser, "_args"):
|
||||
return parser._args
|
||||
raise SqlmapSilentQuitException
|
||||
|
||||
elif "--sqlmap-shell" in argv:
|
||||
_createHomeDirectories()
|
||||
@@ -941,6 +942,8 @@ def cmdLineParser(argv=None):
|
||||
elif argv[i] == "-H":
|
||||
if i + 1 < len(argv):
|
||||
extraHeaders.append(argv[i + 1])
|
||||
elif argv[i] == "--deps":
|
||||
argv[i] = "--dependencies"
|
||||
elif argv[i] == "-r":
|
||||
for j in xrange(i + 2, len(argv)):
|
||||
value = argv[j]
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -1054,11 +1054,11 @@ class Connect(object):
|
||||
|
||||
match = re.search(r"%s=[^&]*" % re.escape(parameter), paramString, re.I)
|
||||
if match:
|
||||
retVal = re.sub("(?i)%s" % re.escape(match.group(0)), ("%s=%s" % (parameter, newValue)).replace('\\', r'\\'), paramString)
|
||||
retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), ("%s=%s" % (parameter, newValue)).replace('\\', r'\\'), paramString)
|
||||
else:
|
||||
match = re.search(r"(%s[\"']:[\"'])([^\"']+)" % re.escape(parameter), paramString, re.I)
|
||||
if match:
|
||||
retVal = re.sub("(?i)%s" % re.escape(match.group(0)), "%s%s" % (match.group(1), newValue), paramString)
|
||||
retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), "%s%s" % (match.group(1), newValue), paramString)
|
||||
|
||||
return retVal
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
@@ -10,6 +10,7 @@ import time
|
||||
import types
|
||||
|
||||
from lib.core.common import getHostHeader
|
||||
from lib.core.common import getSafeExString
|
||||
from lib.core.common import logHTTPTraffic
|
||||
from lib.core.common import readInput
|
||||
from lib.core.convert import getUnicode
|
||||
@@ -139,6 +140,14 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
||||
except _urllib.error.HTTPError as ex:
|
||||
result = ex
|
||||
|
||||
# Dirty hack for https://github.com/sqlmapproject/sqlmap/issues/4046
|
||||
try:
|
||||
hasattr(result, "read")
|
||||
except KeyError:
|
||||
class _(object):
|
||||
pass
|
||||
result = _()
|
||||
|
||||
# Dirty hack for http://bugs.python.org/issue15701
|
||||
try:
|
||||
result.info()
|
||||
@@ -149,7 +158,12 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
||||
|
||||
if not hasattr(result, "read"):
|
||||
def _(self, length=None):
|
||||
return ex.msg
|
||||
try:
|
||||
retVal = getSafeExString(ex)
|
||||
except:
|
||||
retVal = ""
|
||||
finally:
|
||||
return retVal
|
||||
result.read = types.MethodType(_, result)
|
||||
|
||||
if not getattr(result, "url", None):
|
||||
@@ -160,7 +174,7 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
||||
except:
|
||||
redurl = None
|
||||
result = fp
|
||||
fp.read = io.BytesIO("").read
|
||||
fp.read = io.BytesIO(b"").read
|
||||
else:
|
||||
result = fp
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
"""
|
||||
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
||||
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||
See the file 'LICENSE' for copying permission
|
||||
"""
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user