mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
521da5e734 | ||
|
|
43fba39366 | ||
|
|
afdaba76dc | ||
|
|
d98d64504c | ||
|
|
290058451d | ||
|
|
e7372a9512 | ||
|
|
864ab597c0 | ||
|
|
e8731e1af5 | ||
|
|
df4293473d | ||
|
|
90b444c927 | ||
|
|
99f07b64c5 | ||
|
|
07ae377987 | ||
|
|
4a355b99be | ||
|
|
7008361017 | ||
|
|
a14a3d0e54 | ||
|
|
3aae1849bb |
@@ -57,6 +57,7 @@ Translations
|
|||||||
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
||||||
* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md)
|
* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md)
|
||||||
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
||||||
|
* [Georgian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ka-GE.md)
|
||||||
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
|
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
|
||||||
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
||||||
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
||||||
|
|||||||
@@ -199,6 +199,7 @@
|
|||||||
<error regexp="io\.prestosql\.jdbc"/>
|
<error regexp="io\.prestosql\.jdbc"/>
|
||||||
<error regexp="com\.simba\.presto\.jdbc"/>
|
<error regexp="com\.simba\.presto\.jdbc"/>
|
||||||
<error regexp="UNION query has different number of fields: \d+, \d+"/>
|
<error regexp="UNION query has different number of fields: \d+, \d+"/>
|
||||||
|
<error regexp="line \d+:\d+: mismatched input '[^']+'. Expecting:"/>
|
||||||
</dbms>
|
</dbms>
|
||||||
|
|
||||||
<dbms value="Altibase">
|
<dbms value="Altibase">
|
||||||
|
|||||||
@@ -0,0 +1,49 @@
|
|||||||
|
# sqlmap 
|
||||||
|
|
||||||
|
[](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
||||||
|
|
||||||
|
sqlmap არის შეღწევადობის ტესტირებისათვის განკუთვილი ინსტრუმენტი, რომლის კოდიც ღიად არის ხელმისაწვდომი. ინსტრუმენტი ახდენს SQL-ინექციის სისუსტეების აღმოჩენისა, გამოყენების და მონაცემთა ბაზათა სერვერების დაუფლების პროცესების ავტომატიზაციას. იგი აღჭურვილია მძლავრი აღმომჩენი მექანიძმით, შეღწევადობის პროფესიონალი ტესტერისათვის შესაფერისი ბევრი ფუნქციით და სკრიპტების ფართო სპექტრით, რომლებიც შეიძლება გამოყენებულ იქნეს მრავალი მიზნით, მათ შორის: მონაცემთა ბაზიდან მონაცემების შეგროვებისათვის, ძირითად საფაილო სისტემაზე წვდომისათვის და out-of-band კავშირების გზით ოპერაციულ სისტემაში ბრძანებათა შესრულებისათვის.
|
||||||
|
|
||||||
|
ეკრანის ანაბეჭდები
|
||||||
|
----
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
|
შეგიძლიათ ესტუმროთ [ეკრანის ანაბეჭდთა კოლექციას](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), სადაც დემონსტრირებულია ინსტრუმენტის ზოგიერთი ფუნქცია.
|
||||||
|
|
||||||
|
ინსტალაცია
|
||||||
|
----
|
||||||
|
|
||||||
|
თქვენ შეგიძლიათ უახლესი tar-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/tarball/master) დაწკაპუნებით, ან უახლესი zip-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/zipball/master) დაწკაპუნებით.
|
||||||
|
|
||||||
|
ასევე შეგიძლიათ (და სასურველია) sqlmap-ის ჩამოტვირთვა [Git](https://github.com/sqlmapproject/sqlmap)-საცავის (repository) კლონირებით:
|
||||||
|
|
||||||
|
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
||||||
|
|
||||||
|
sqlmap ნებისმიერ პლატფორმაზე მუშაობს [Python](https://www.python.org/download/)-ის **2.6**, **2.7** და **3.x** ვერსიებთან.
|
||||||
|
|
||||||
|
გამოყენება
|
||||||
|
----
|
||||||
|
|
||||||
|
ძირითადი ვარიანტებისა და პარამეტრების ჩამონათვალის მისაღებად გამოიყენეთ ბრძანება:
|
||||||
|
|
||||||
|
python sqlmap.py -h
|
||||||
|
|
||||||
|
ვარიანტებისა და პარამეტრების სრული ჩამონათვალის მისაღებად გამოიყენეთ ბრძანება:
|
||||||
|
|
||||||
|
python sqlmap.py -hh
|
||||||
|
|
||||||
|
გამოყენების მარტივი მაგალითი შეგიძლიათ იხილოთ [აქ](https://asciinema.org/a/46601). sqlmap-ის შესაძლებლობათა მიმოხილვის, მხარდაჭერილი ფუნქციონალისა და ყველა ვარიანტის აღწერების მისაღებად გამოყენების მაგალითებთან ერთად, გირჩევთ, იხილოთ [მომხმარებლის სახელმძღვანელო](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
||||||
|
|
||||||
|
ბმულები
|
||||||
|
----
|
||||||
|
|
||||||
|
* საწყისი გვერდი: https://sqlmap.org
|
||||||
|
* ჩამოტვირთვა: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ან [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||||
|
* RSS არხი: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||||
|
* პრობლემებისათვის თვალყურის დევნება: https://github.com/sqlmapproject/sqlmap/issues
|
||||||
|
* მომხმარებლის სახელმძღვანელო: https://github.com/sqlmapproject/sqlmap/wiki
|
||||||
|
* ხშირად დასმული კითხვები (ხდკ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||||
|
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
||||||
|
* დემონსტრაციები: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos)
|
||||||
|
* ეკრანის ანაბეჭდები: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||||
Binary file not shown.
Binary file not shown.
+15
-16
@@ -810,7 +810,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
|
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during detection phase"
|
warnMsg = "user aborted during detection phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if conf.multipleTargets:
|
if conf.multipleTargets:
|
||||||
msg = "how do you want to proceed? [ne(X)t target/(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]"
|
msg = "how do you want to proceed? [ne(X)t target/(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]"
|
||||||
@@ -826,7 +826,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
choice = None
|
choice = None
|
||||||
while not ((choice or "").isdigit() and 0 <= int(choice) <= 6):
|
while not ((choice or "").isdigit() and 0 <= int(choice) <= 6):
|
||||||
if choice:
|
if choice:
|
||||||
logger.warn("invalid value")
|
logger.warning("invalid value")
|
||||||
msg = "enter new verbosity level: [0-6] "
|
msg = "enter new verbosity level: [0-6] "
|
||||||
choice = readInput(msg, default=str(conf.verbose), checkBatch=False)
|
choice = readInput(msg, default=str(conf.verbose), checkBatch=False)
|
||||||
conf.verbose = int(choice)
|
conf.verbose = int(choice)
|
||||||
@@ -851,7 +851,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
warnMsg = "in OR boolean-based injection cases, please consider usage "
|
warnMsg = "in OR boolean-based injection cases, please consider usage "
|
||||||
warnMsg += "of switch '--drop-set-cookie' if you experience any "
|
warnMsg += "of switch '--drop-set-cookie' if you experience any "
|
||||||
warnMsg += "problems during data retrieval"
|
warnMsg += "problems during data retrieval"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not checkFalsePositives(injection):
|
if not checkFalsePositives(injection):
|
||||||
if conf.hostname in kb.vulnHosts:
|
if conf.hostname in kb.vulnHosts:
|
||||||
@@ -976,7 +976,7 @@ def checkFalsePositives(injection):
|
|||||||
|
|
||||||
if not retVal:
|
if not retVal:
|
||||||
warnMsg = "false positive or unexploitable injection point detected"
|
warnMsg = "false positive or unexploitable injection point detected"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -1002,7 +1002,7 @@ def checkSuhosinPatch(injection):
|
|||||||
warnMsg = "parameter length constraining "
|
warnMsg = "parameter length constraining "
|
||||||
warnMsg += "mechanism detected (e.g. Suhosin patch). "
|
warnMsg += "mechanism detected (e.g. Suhosin patch). "
|
||||||
warnMsg += "Potential problems in enumeration phase can be expected"
|
warnMsg += "Potential problems in enumeration phase can be expected"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -1023,7 +1023,7 @@ def checkFilteredChars(injection):
|
|||||||
warnMsg += "filtered by the back-end server. There is a strong "
|
warnMsg += "filtered by the back-end server. There is a strong "
|
||||||
warnMsg += "possibility that sqlmap won't be able to properly "
|
warnMsg += "possibility that sqlmap won't be able to properly "
|
||||||
warnMsg += "exploit this vulnerability"
|
warnMsg += "exploit this vulnerability"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
# inference techniques depend on character '>'
|
# inference techniques depend on character '>'
|
||||||
if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
|
if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
|
||||||
@@ -1031,7 +1031,7 @@ def checkFilteredChars(injection):
|
|||||||
warnMsg = "it appears that the character '>' is "
|
warnMsg = "it appears that the character '>' is "
|
||||||
warnMsg += "filtered by the back-end server. You are strongly "
|
warnMsg += "filtered by the back-end server. You are strongly "
|
||||||
warnMsg += "advised to rerun with the '--tamper=between'"
|
warnMsg += "advised to rerun with the '--tamper=between'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -1122,7 +1122,7 @@ def heuristicCheckSqlInjection(place, parameter):
|
|||||||
|
|
||||||
else:
|
else:
|
||||||
infoMsg += "not be injectable"
|
infoMsg += "not be injectable"
|
||||||
logger.warn(infoMsg)
|
logger.warning(infoMsg)
|
||||||
|
|
||||||
kb.heuristicMode = True
|
kb.heuristicMode = True
|
||||||
kb.disableHtmlDecoding = True
|
kb.disableHtmlDecoding = True
|
||||||
@@ -1230,7 +1230,7 @@ def checkDynamicContent(firstPage, secondPage):
|
|||||||
if count > conf.retries:
|
if count > conf.retries:
|
||||||
warnMsg = "target URL content appears to be too dynamic. "
|
warnMsg = "target URL content appears to be too dynamic. "
|
||||||
warnMsg += "Switching to '--text-only' "
|
warnMsg += "Switching to '--text-only' "
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.textOnly = True
|
conf.textOnly = True
|
||||||
return
|
return
|
||||||
@@ -1288,7 +1288,7 @@ def checkStability():
|
|||||||
warnMsg += "injectable parameters are detected, or in case of "
|
warnMsg += "injectable parameters are detected, or in case of "
|
||||||
warnMsg += "junk results, refer to user's manual paragraph "
|
warnMsg += "junk results, refer to user's manual paragraph "
|
||||||
warnMsg += "'Page comparison'"
|
warnMsg += "'Page comparison'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] "
|
message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] "
|
||||||
choice = readInput(message, default='C').upper()
|
choice = readInput(message, default='C').upper()
|
||||||
@@ -1367,11 +1367,10 @@ def checkWaf():
|
|||||||
retVal = False
|
retVal = False
|
||||||
payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD)
|
payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD)
|
||||||
|
|
||||||
|
place = PLACE.GET
|
||||||
if PLACE.URI in conf.parameters:
|
if PLACE.URI in conf.parameters:
|
||||||
place = PLACE.POST
|
|
||||||
value = "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
value = "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
||||||
else:
|
else:
|
||||||
place = PLACE.GET
|
|
||||||
value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER
|
value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER
|
||||||
value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
||||||
|
|
||||||
@@ -1514,7 +1513,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
warnMsg = "you provided '%s' as the string to " % conf.string
|
warnMsg = "you provided '%s' as the string to " % conf.string
|
||||||
warnMsg += "match, but such a string is not within the target "
|
warnMsg += "match, but such a string is not within the target "
|
||||||
warnMsg += "URL raw response, sqlmap will carry on anyway"
|
warnMsg += "URL raw response, sqlmap will carry on anyway"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if conf.regexp:
|
if conf.regexp:
|
||||||
infoMsg = "testing if the provided regular expression matches within "
|
infoMsg = "testing if the provided regular expression matches within "
|
||||||
@@ -1525,7 +1524,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
warnMsg = "you provided '%s' as the regular expression " % conf.regexp
|
warnMsg = "you provided '%s' as the regular expression " % conf.regexp
|
||||||
warnMsg += "which does not have any match within the target URL raw response. sqlmap "
|
warnMsg += "which does not have any match within the target URL raw response. sqlmap "
|
||||||
warnMsg += "will carry on anyway"
|
warnMsg += "will carry on anyway"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
kb.errorIsNone = False
|
kb.errorIsNone = False
|
||||||
|
|
||||||
@@ -1540,12 +1539,12 @@ def checkConnection(suppressOutput=False):
|
|||||||
elif wasLastResponseDBMSError():
|
elif wasLastResponseDBMSError():
|
||||||
warnMsg = "there is a DBMS error found in the HTTP response body "
|
warnMsg = "there is a DBMS error found in the HTTP response body "
|
||||||
warnMsg += "which could interfere with the results of the tests"
|
warnMsg += "which could interfere with the results of the tests"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
elif wasLastResponseHTTPError():
|
elif wasLastResponseHTTPError():
|
||||||
if getLastRequestHTTPError() not in (conf.ignoreCode or []):
|
if getLastRequestHTTPError() not in (conf.ignoreCode or []):
|
||||||
warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError()
|
warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError()
|
||||||
warnMsg += "which could interfere with the results of the tests"
|
warnMsg += "which could interfere with the results of the tests"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
kb.errorIsNone = True
|
kb.errorIsNone = True
|
||||||
|
|
||||||
|
|||||||
@@ -186,12 +186,12 @@ def _showInjections():
|
|||||||
if conf.tamper:
|
if conf.tamper:
|
||||||
warnMsg = "changes made by tampering scripts are not "
|
warnMsg = "changes made by tampering scripts are not "
|
||||||
warnMsg += "included in shown payload content(s)"
|
warnMsg += "included in shown payload content(s)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if conf.hpp:
|
if conf.hpp:
|
||||||
warnMsg = "changes made by HTTP parameter pollution are not "
|
warnMsg = "changes made by HTTP parameter pollution are not "
|
||||||
warnMsg += "included in shown payload content(s)"
|
warnMsg += "included in shown payload content(s)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def _randomFillBlankFields(value):
|
def _randomFillBlankFields(value):
|
||||||
retVal = value
|
retVal = value
|
||||||
@@ -556,7 +556,7 @@ def start():
|
|||||||
|
|
||||||
if not check:
|
if not check:
|
||||||
warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if conf.skipStatic:
|
if conf.skipStatic:
|
||||||
infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
@@ -612,7 +612,7 @@ def start():
|
|||||||
|
|
||||||
if not injectable:
|
if not injectable:
|
||||||
warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter)
|
warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
if place == PLACE.COOKIE:
|
if place == PLACE.COOKIE:
|
||||||
@@ -709,7 +709,7 @@ def start():
|
|||||||
|
|
||||||
if conf.multipleTargets:
|
if conf.multipleTargets:
|
||||||
warnMsg = "user aborted in multiple target mode"
|
warnMsg = "user aborted in multiple target mode"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "do you want to skip to the next target in list? [Y/n/q]"
|
message = "do you want to skip to the next target in list? [Y/n/q]"
|
||||||
choice = readInput(message, default='Y').upper()
|
choice = readInput(message, default='Y').upper()
|
||||||
@@ -749,7 +749,7 @@ def start():
|
|||||||
warnMsg = "it appears that the target "
|
warnMsg = "it appears that the target "
|
||||||
warnMsg += "has a maximum connections "
|
warnMsg += "has a maximum connections "
|
||||||
warnMsg += "constraint"
|
warnMsg += "constraint"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if kb.dataOutputFlag and not conf.multipleTargets:
|
if kb.dataOutputFlag and not conf.multipleTargets:
|
||||||
logger.info("fetched data logged to text files under '%s'" % conf.outputPath)
|
logger.info("fetched data logged to text files under '%s'" % conf.outputPath)
|
||||||
|
|||||||
+1
-1
@@ -134,7 +134,7 @@ class Agent(object):
|
|||||||
origValue = extractRegexResult(r"%s\s*:\s*(?P<result>\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P<result>[^%s]*)\Z" % quote, origValue)
|
origValue = extractRegexResult(r"%s\s*:\s*(?P<result>\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P<result>[^%s]*)\Z" % quote, origValue)
|
||||||
else:
|
else:
|
||||||
_ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
|
_ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
|
||||||
origValue = _.split('=', 1)[1] if '=' in _ else ""
|
origValue = _.split('=', 1)[1] if '=' in _ else _
|
||||||
elif place == PLACE.CUSTOM_HEADER:
|
elif place == PLACE.CUSTOM_HEADER:
|
||||||
paramString = origValue
|
paramString = origValue
|
||||||
origValue = origValue[origValue.find(',') + 1:]
|
origValue = origValue[origValue.find(',') + 1:]
|
||||||
|
|||||||
+22
-22
@@ -351,7 +351,7 @@ class Backend(object):
|
|||||||
elif kb.dbms is not None and kb.dbms != dbms:
|
elif kb.dbms is not None and kb.dbms != dbms:
|
||||||
warnMsg = "there appears to be a high probability that "
|
warnMsg = "there appears to be a high probability that "
|
||||||
warnMsg += "this could be a false positive case"
|
warnMsg += "this could be a false positive case"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
msg = "sqlmap previously fingerprinted back-end DBMS as "
|
msg = "sqlmap previously fingerprinted back-end DBMS as "
|
||||||
msg += "%s. However now it has been fingerprinted " % kb.dbms
|
msg += "%s. However now it has been fingerprinted " % kb.dbms
|
||||||
@@ -371,7 +371,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value"
|
warnMsg = "invalid value"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif kb.dbms is None:
|
elif kb.dbms is None:
|
||||||
kb.dbms = aliasToDbmsEnum(dbms)
|
kb.dbms = aliasToDbmsEnum(dbms)
|
||||||
@@ -429,7 +429,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value"
|
warnMsg = "invalid value"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif kb.os is None and isinstance(os, six.string_types):
|
elif kb.os is None and isinstance(os, six.string_types):
|
||||||
kb.os = os.capitalize()
|
kb.os = os.capitalize()
|
||||||
@@ -466,7 +466,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value. Valid values are 1 and 2"
|
warnMsg = "invalid value. Valid values are 1 and 2"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return kb.arch
|
return kb.arch
|
||||||
|
|
||||||
@@ -590,7 +590,7 @@ class Backend(object):
|
|||||||
def isVersionGreaterOrEqualThan(version):
|
def isVersionGreaterOrEqualThan(version):
|
||||||
retVal = False
|
retVal = False
|
||||||
|
|
||||||
if Backend.getVersion() is not None and version is not None:
|
if all(_ not in (None, UNKNOWN_DBMS_VERSION) for _ in (Backend.getVersion(), version)):
|
||||||
_version = unArrayizeValue(Backend.getVersion())
|
_version = unArrayizeValue(Backend.getVersion())
|
||||||
_version = re.sub(r"[<>= ]", "", _version)
|
_version = re.sub(r"[<>= ]", "", _version)
|
||||||
|
|
||||||
@@ -663,7 +663,7 @@ def paramToDict(place, parameters=None):
|
|||||||
warnMsg += "chars/statements from manual SQL injection test(s). "
|
warnMsg += "chars/statements from manual SQL injection test(s). "
|
||||||
warnMsg += "Please, always use only valid parameter values "
|
warnMsg += "Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "
|
message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "
|
||||||
|
|
||||||
@@ -673,7 +673,7 @@ def paramToDict(place, parameters=None):
|
|||||||
warnMsg = "provided value for parameter '%s' is empty. " % parameter
|
warnMsg = "provided value for parameter '%s' is empty. " % parameter
|
||||||
warnMsg += "Please, always use only valid parameter values "
|
warnMsg += "Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if place in (PLACE.POST, PLACE.GET):
|
if place in (PLACE.POST, PLACE.GET):
|
||||||
for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"):
|
for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"):
|
||||||
@@ -738,7 +738,7 @@ def paramToDict(place, parameters=None):
|
|||||||
if len(conf.testParameter) > 1:
|
if len(conf.testParameter) > 1:
|
||||||
warnMsg = "provided parameters '%s' " % paramStr
|
warnMsg = "provided parameters '%s' " % paramStr
|
||||||
warnMsg += "are not inside the %s" % place
|
warnMsg += "are not inside the %s" % place
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
parameter = conf.testParameter[0]
|
parameter = conf.testParameter[0]
|
||||||
|
|
||||||
@@ -763,7 +763,7 @@ def paramToDict(place, parameters=None):
|
|||||||
if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded):
|
if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded):
|
||||||
warnMsg = "provided parameter '%s' " % parameter
|
warnMsg = "provided parameter '%s' " % parameter
|
||||||
warnMsg += "appears to be '%s' encoded" % encoding
|
warnMsg += "appears to be '%s' encoded" % encoding
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
break
|
break
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
@@ -814,7 +814,7 @@ def getManualDirectories():
|
|||||||
else:
|
else:
|
||||||
warnMsg = "unable to automatically retrieve the web server "
|
warnMsg = "unable to automatically retrieve the web server "
|
||||||
warnMsg += "document root"
|
warnMsg += "document root"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
directories = []
|
directories = []
|
||||||
|
|
||||||
@@ -900,7 +900,7 @@ def getAutoDirectories():
|
|||||||
retVal.add(directory)
|
retVal.add(directory)
|
||||||
else:
|
else:
|
||||||
warnMsg = "unable to automatically parse any web server path"
|
warnMsg = "unable to automatically parse any web server path"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return list(retVal)
|
return list(retVal)
|
||||||
|
|
||||||
@@ -1637,7 +1637,7 @@ def parseTargetDirect():
|
|||||||
if remote:
|
if remote:
|
||||||
warnMsg = "direct connection over the network for "
|
warnMsg = "direct connection over the network for "
|
||||||
warnMsg += "%s DBMS is not supported" % dbmsName
|
warnMsg += "%s DBMS is not supported" % dbmsName
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.hostname = "localhost"
|
conf.hostname = "localhost"
|
||||||
conf.port = 0
|
conf.port = 0
|
||||||
@@ -1900,7 +1900,7 @@ def parseUnionPage(page):
|
|||||||
if re.search(r"(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page):
|
if re.search(r"(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page):
|
||||||
if len(page) > LARGE_OUTPUT_THRESHOLD:
|
if len(page) > LARGE_OUTPUT_THRESHOLD:
|
||||||
warnMsg = "large output detected. This might take a while"
|
warnMsg = "large output detected. This might take a while"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
data = BigArray()
|
data = BigArray()
|
||||||
keys = set()
|
keys = set()
|
||||||
@@ -2789,7 +2789,7 @@ def wasLastResponseDelayed():
|
|||||||
if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
|
if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
|
||||||
warnMsg = "time-based standard deviation method used on a model "
|
warnMsg = "time-based standard deviation method used on a model "
|
||||||
warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES
|
warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation
|
lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation
|
||||||
retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit))
|
retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit))
|
||||||
@@ -3593,7 +3593,7 @@ def initTechnique(technique=None):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "there is no injection data available for technique "
|
warnMsg = "there is no injection data available for technique "
|
||||||
warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique)
|
warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
except SqlmapDataException:
|
except SqlmapDataException:
|
||||||
errMsg = "missing data in old session file(s). "
|
errMsg = "missing data in old session file(s). "
|
||||||
@@ -3744,7 +3744,7 @@ def showHttpErrorCodes():
|
|||||||
if kb.httpErrorCodes:
|
if kb.httpErrorCodes:
|
||||||
warnMsg = "HTTP error codes detected during run:\n"
|
warnMsg = "HTTP error codes detected during run:\n"
|
||||||
warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items())
|
warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items())
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes):
|
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes):
|
||||||
msg = "too many 4xx and/or 5xx HTTP error codes "
|
msg = "too many 4xx and/or 5xx HTTP error codes "
|
||||||
msg += "could mean that some kind of protection is involved (e.g. WAF)"
|
msg += "could mean that some kind of protection is involved (e.g. WAF)"
|
||||||
@@ -3972,7 +3972,7 @@ def createGithubIssue(errMsg, excMsg):
|
|||||||
if closed:
|
if closed:
|
||||||
warnMsg += " and resolved. Please update to the latest "
|
warnMsg += " and resolved. Please update to the latest "
|
||||||
warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE
|
warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return
|
return
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
@@ -4002,7 +4002,7 @@ def createGithubIssue(errMsg, excMsg):
|
|||||||
warnMsg += " ('%s')" % _excMsg
|
warnMsg += " ('%s')" % _excMsg
|
||||||
if "Unauthorized" in warnMsg:
|
if "Unauthorized" in warnMsg:
|
||||||
warnMsg += ". Please update to the latest revision"
|
warnMsg += ". Please update to the latest revision"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def maskSensitiveData(msg):
|
def maskSensitiveData(msg):
|
||||||
"""
|
"""
|
||||||
@@ -4395,7 +4395,7 @@ def expandMnemonics(mnemonics, parser, args):
|
|||||||
|
|
||||||
if not options:
|
if not options:
|
||||||
warnMsg = "mnemonic '%s' can't be resolved" % name
|
warnMsg = "mnemonic '%s' can't be resolved" % name
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
elif name in options:
|
elif name in options:
|
||||||
found = name
|
found = name
|
||||||
debugMsg = "mnemonic '%s' resolved to %s). " % (name, found)
|
debugMsg = "mnemonic '%s' resolved to %s). " % (name, found)
|
||||||
@@ -4404,7 +4404,7 @@ def expandMnemonics(mnemonics, parser, args):
|
|||||||
found = sorted(options.keys(), key=len)[0]
|
found = sorted(options.keys(), key=len)[0]
|
||||||
warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options))
|
warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options))
|
||||||
warnMsg += "Resolved to shortest of those ('%s')" % found
|
warnMsg += "Resolved to shortest of those ('%s')" % found
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if found:
|
if found:
|
||||||
found = options[found]
|
found = options[found]
|
||||||
@@ -4810,7 +4810,7 @@ def checkOldOptions(args):
|
|||||||
warnMsg = "switch/option '%s' is deprecated" % _
|
warnMsg = "switch/option '%s' is deprecated" % _
|
||||||
if DEPRECATED_OPTIONS[_]:
|
if DEPRECATED_OPTIONS[_]:
|
||||||
warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
|
warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def checkSystemEncoding():
|
def checkSystemEncoding():
|
||||||
"""
|
"""
|
||||||
@@ -4828,7 +4828,7 @@ def checkSystemEncoding():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
|
|
||||||
warnMsg = "temporary switching to charset 'cp1256'"
|
warnMsg = "temporary switching to charset 'cp1256'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
_reload_module(sys)
|
_reload_module(sys)
|
||||||
sys.setdefaultencoding("cp1256")
|
sys.setdefaultencoding("cp1256")
|
||||||
|
|||||||
+4
-4
@@ -421,7 +421,7 @@ class Dump(object):
|
|||||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
||||||
warnMsg = "currently unable to use regular dump directory. "
|
warnMsg = "currently unable to use regular dump directory. "
|
||||||
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
dumpDbPath = tempDir
|
dumpDbPath = tempDir
|
||||||
|
|
||||||
@@ -445,7 +445,7 @@ class Dump(object):
|
|||||||
warnMsg = "unable to create dump directory "
|
warnMsg = "unable to create dump directory "
|
||||||
warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex))
|
warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
dumpDbPath = tempDir
|
dumpDbPath = tempDir
|
||||||
|
|
||||||
@@ -624,7 +624,7 @@ class Dump(object):
|
|||||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
||||||
filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
|
filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
|
||||||
warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
|
warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
with openFile(filepath, "w+b", None) as f:
|
with openFile(filepath, "w+b", None) as f:
|
||||||
_ = safechardecode(value, True)
|
_ = safechardecode(value, True)
|
||||||
@@ -672,7 +672,7 @@ class Dump(object):
|
|||||||
if not warnFile:
|
if not warnFile:
|
||||||
logger.info(msg)
|
logger.info(msg)
|
||||||
else:
|
else:
|
||||||
logger.warn(msg)
|
logger.warning(msg)
|
||||||
|
|
||||||
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
||||||
if conf.api:
|
if conf.api:
|
||||||
|
|||||||
+26
-23
@@ -475,7 +475,7 @@ def _setBulkMultipleTargets():
|
|||||||
|
|
||||||
if not found and not conf.forms and not conf.crawlDepth:
|
if not found and not conf.forms and not conf.crawlDepth:
|
||||||
warnMsg = "no usable links found (with GET parameters)"
|
warnMsg = "no usable links found (with GET parameters)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def _findPageForms():
|
def _findPageForms():
|
||||||
if not conf.forms or conf.crawlDepth:
|
if not conf.forms or conf.crawlDepth:
|
||||||
@@ -523,7 +523,7 @@ def _findPageForms():
|
|||||||
|
|
||||||
if not found:
|
if not found:
|
||||||
warnMsg = "no forms found"
|
warnMsg = "no forms found"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def _setDBMSAuthentication():
|
def _setDBMSAuthentication():
|
||||||
"""
|
"""
|
||||||
@@ -607,16 +607,16 @@ def _setMetasploit():
|
|||||||
warnMsg += "or more of the needed Metasploit executables "
|
warnMsg += "or more of the needed Metasploit executables "
|
||||||
warnMsg += "within msfcli, msfconsole, msfencode and "
|
warnMsg += "within msfcli, msfconsole, msfencode and "
|
||||||
warnMsg += "msfpayload do not exist"
|
warnMsg += "msfpayload do not exist"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
warnMsg = "you did not provide the local path where Metasploit "
|
warnMsg = "you did not provide the local path where Metasploit "
|
||||||
warnMsg += "Framework is installed"
|
warnMsg += "Framework is installed"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not msfEnvPathExists:
|
if not msfEnvPathExists:
|
||||||
warnMsg = "sqlmap is going to look for Metasploit Framework "
|
warnMsg = "sqlmap is going to look for Metasploit Framework "
|
||||||
warnMsg += "installation inside the environment path(s)"
|
warnMsg += "installation inside the environment path(s)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":")
|
envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":")
|
||||||
|
|
||||||
@@ -1202,10 +1202,10 @@ def _setHTTPHandlers():
|
|||||||
|
|
||||||
if conf.proxy:
|
if conf.proxy:
|
||||||
warnMsg += "with HTTP(s) proxy"
|
warnMsg += "with HTTP(s) proxy"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
elif conf.authType:
|
elif conf.authType:
|
||||||
warnMsg += "with authentication methods"
|
warnMsg += "with authentication methods"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
handlers.append(keepAliveHandler)
|
handlers.append(keepAliveHandler)
|
||||||
|
|
||||||
@@ -1547,7 +1547,7 @@ def _setHTTPTimeout():
|
|||||||
if conf.timeout < 3.0:
|
if conf.timeout < 3.0:
|
||||||
warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap "
|
warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap "
|
||||||
warnMsg += "will going to reset it"
|
warnMsg += "will going to reset it"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.timeout = 3.0
|
conf.timeout = 3.0
|
||||||
else:
|
else:
|
||||||
@@ -1586,13 +1586,13 @@ def _createHomeDirectories():
|
|||||||
|
|
||||||
if conf.get("outputDir") and context == "output":
|
if conf.get("outputDir") and context == "output":
|
||||||
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
||||||
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
||||||
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
||||||
|
|
||||||
@@ -1617,7 +1617,7 @@ def _createTemporaryDirectory():
|
|||||||
tempfile.tempdir = conf.tmpDir
|
tempfile.tempdir = conf.tmpDir
|
||||||
|
|
||||||
warnMsg = "using '%s' as the temporary directory" % conf.tmpDir
|
warnMsg = "using '%s' as the temporary directory" % conf.tmpDir
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
errMsg = "there has been a problem while accessing "
|
errMsg = "there has been a problem while accessing "
|
||||||
errMsg += "temporary directory location(s) ('%s')" % getSafeExString(ex)
|
errMsg += "temporary directory location(s) ('%s')" % getSafeExString(ex)
|
||||||
@@ -1632,7 +1632,7 @@ def _createTemporaryDirectory():
|
|||||||
warnMsg += "make sure that there is enough disk space left. If problem persists, "
|
warnMsg += "make sure that there is enough disk space left. If problem persists, "
|
||||||
warnMsg += "try to set environment variable 'TEMP' to a location "
|
warnMsg += "try to set environment variable 'TEMP' to a location "
|
||||||
warnMsg += "writeable by the current user"
|
warnMsg += "writeable by the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if "sqlmap" not in (tempfile.tempdir or "") or conf.tmpDir and tempfile.tempdir == conf.tmpDir:
|
if "sqlmap" not in (tempfile.tempdir or "") or conf.tmpDir and tempfile.tempdir == conf.tmpDir:
|
||||||
try:
|
try:
|
||||||
@@ -1832,7 +1832,7 @@ def _cleanupOptions():
|
|||||||
warnMsg = "increasing default value for "
|
warnMsg = "increasing default value for "
|
||||||
warnMsg += "option '--time-sec' to %d because " % conf.timeSec
|
warnMsg += "option '--time-sec' to %d because " % conf.timeSec
|
||||||
warnMsg += "switch '--tor' was provided"
|
warnMsg += "switch '--tor' was provided"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE
|
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE
|
||||||
|
|
||||||
@@ -2206,7 +2206,7 @@ def _useWizardInterface():
|
|||||||
|
|
||||||
while not conf.url:
|
while not conf.url:
|
||||||
message = "Please enter full target URL (-u): "
|
message = "Please enter full target URL (-u): "
|
||||||
conf.url = readInput(message, default=None)
|
conf.url = readInput(message, default=None, checkBatch=False)
|
||||||
|
|
||||||
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
conf.data = readInput(message, default=None)
|
conf.data = readInput(message, default=None)
|
||||||
@@ -2217,7 +2217,7 @@ def _useWizardInterface():
|
|||||||
if not conf.crawlDepth and not conf.forms:
|
if not conf.crawlDepth and not conf.forms:
|
||||||
warnMsg += "Will search for forms"
|
warnMsg += "Will search for forms"
|
||||||
conf.forms = True
|
conf.forms = True
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
choice = None
|
choice = None
|
||||||
|
|
||||||
@@ -2473,7 +2473,7 @@ def _setTorHttpProxySettings():
|
|||||||
warnMsg += "Tor anonymizing network because of "
|
warnMsg += "Tor anonymizing network because of "
|
||||||
warnMsg += "known issues with default settings of various 'bundles' "
|
warnMsg += "known issues with default settings of various 'bundles' "
|
||||||
warnMsg += "(e.g. Vidalia)"
|
warnMsg += "(e.g. Vidalia)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def _setTorSocksProxySettings():
|
def _setTorSocksProxySettings():
|
||||||
infoMsg = "setting Tor SOCKS proxy settings"
|
infoMsg = "setting Tor SOCKS proxy settings"
|
||||||
@@ -2553,7 +2553,7 @@ def _basicOptionValidation():
|
|||||||
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \
|
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \
|
||||||
isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart:
|
isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart:
|
||||||
warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable"
|
warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \
|
if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \
|
||||||
isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar:
|
isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar:
|
||||||
@@ -2563,7 +2563,7 @@ def _basicOptionValidation():
|
|||||||
if conf.proxyFile and not any((conf.randomAgent, conf.mobile, conf.agent, conf.requestFile)):
|
if conf.proxyFile and not any((conf.randomAgent, conf.mobile, conf.agent, conf.requestFile)):
|
||||||
warnMsg = "usage of switch '--random-agent' is strongly recommended when "
|
warnMsg = "usage of switch '--random-agent' is strongly recommended when "
|
||||||
warnMsg += "using option '--proxy-file'"
|
warnMsg += "using option '--proxy-file'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if conf.textOnly and conf.nullConnection:
|
if conf.textOnly and conf.nullConnection:
|
||||||
errMsg = "switch '--text-only' is incompatible with switch '--null-connection'"
|
errMsg = "switch '--text-only' is incompatible with switch '--null-connection'"
|
||||||
@@ -2671,7 +2671,7 @@ def _basicOptionValidation():
|
|||||||
warnMsg = "increasing default value for "
|
warnMsg = "increasing default value for "
|
||||||
warnMsg += "option '--retries' to %d because " % conf.retries
|
warnMsg += "option '--retries' to %d because " % conf.retries
|
||||||
warnMsg += "option '--retry-on' was provided"
|
warnMsg += "option '--retry-on' was provided"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
|
|
||||||
if conf.cookieDel and len(conf.cookieDel):
|
if conf.cookieDel and len(conf.cookieDel):
|
||||||
@@ -2839,10 +2839,13 @@ def _basicOptionValidation():
|
|||||||
else:
|
else:
|
||||||
conf.encoding = _
|
conf.encoding = _
|
||||||
|
|
||||||
if conf.loadCookies:
|
if conf.fileWrite and not os.path.isfile(conf.fileWrite):
|
||||||
if not os.path.exists(conf.loadCookies):
|
errMsg = "file '%s' does not exist" % os.path.abspath(conf.fileWrite)
|
||||||
errMsg = "cookies file '%s' does not exist" % conf.loadCookies
|
raise SqlmapFilePathException(errMsg)
|
||||||
raise SqlmapFilePathException(errMsg)
|
|
||||||
|
if conf.loadCookies and not os.path.exists(conf.loadCookies):
|
||||||
|
errMsg = "cookies file '%s' does not exist" % os.path.abspath(conf.loadCookies)
|
||||||
|
raise SqlmapFilePathException(errMsg)
|
||||||
|
|
||||||
def initOptions(inputOptions=AttribDict(), overrideOptions=False):
|
def initOptions(inputOptions=AttribDict(), overrideOptions=False):
|
||||||
_setConfAttributes()
|
_setConfAttributes()
|
||||||
|
|||||||
@@ -20,7 +20,7 @@ from thirdparty import six
|
|||||||
from thirdparty.six import unichr as _unichr
|
from thirdparty.six import unichr as _unichr
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.6.5.5"
|
VERSION = "1.6.7.0"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -845,7 +845,7 @@ JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*
|
|||||||
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
||||||
|
|
||||||
# Regular expression used for detecting Array-like POST data
|
# Regular expression used for detecting Array-like POST data
|
||||||
ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\]=.+%s\2\[\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER)
|
ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\d*\]=.+%s\2\[\d*\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER)
|
||||||
|
|
||||||
# Default POST data content-type
|
# Default POST data content-type
|
||||||
DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8"
|
DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8"
|
||||||
|
|||||||
+3
-3
@@ -79,7 +79,7 @@ def saveHistory(completion=None):
|
|||||||
readline.write_history_file(historyPath)
|
readline.write_history_file(historyPath)
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
@@ -103,12 +103,12 @@ def loadHistory(completion=None):
|
|||||||
readline.read_history_file(historyPath)
|
readline.read_history_file(historyPath)
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
except UnicodeError:
|
except UnicodeError:
|
||||||
if IS_WIN:
|
if IS_WIN:
|
||||||
warnMsg = "there was a problem loading the history file '%s'. " % historyPath
|
warnMsg = "there was a problem loading the history file '%s'. " % historyPath
|
||||||
warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
|
warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def autoCompletion(completion=None, os=None, commands=None):
|
def autoCompletion(completion=None, os=None, commands=None):
|
||||||
if not readlineAvailable():
|
if not readlineAvailable():
|
||||||
|
|||||||
+11
-8
@@ -106,7 +106,7 @@ def _setRequestParams():
|
|||||||
|
|
||||||
# Perform checks on POST parameters
|
# Perform checks on POST parameters
|
||||||
if conf.method == HTTPMETHOD.POST and conf.data is None:
|
if conf.method == HTTPMETHOD.POST and conf.data is None:
|
||||||
logger.warn("detected empty POST body")
|
logger.warning("detected empty POST body")
|
||||||
conf.data = ""
|
conf.data = ""
|
||||||
|
|
||||||
if conf.data is not None:
|
if conf.data is not None:
|
||||||
@@ -247,7 +247,7 @@ def _setRequestParams():
|
|||||||
warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') "
|
warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') "
|
||||||
warnMsg += "and without providing any POST parameters "
|
warnMsg += "and without providing any POST parameters "
|
||||||
warnMsg += "through option '--data'"
|
warnMsg += "through option '--data'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "do you want to try URI injections "
|
message = "do you want to try URI injections "
|
||||||
message += "in the target URL itself? [Y/n/q] "
|
message += "in the target URL itself? [Y/n/q] "
|
||||||
@@ -283,7 +283,7 @@ def _setRequestParams():
|
|||||||
warnMsg = "it seems that you've provided empty parameter value(s) "
|
warnMsg = "it seems that you've provided empty parameter value(s) "
|
||||||
warnMsg += "for testing. Please, always use only valid parameter values "
|
warnMsg += "for testing. Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not kb.processUserMarks:
|
if not kb.processUserMarks:
|
||||||
if place == PLACE.URI:
|
if place == PLACE.URI:
|
||||||
@@ -305,6 +305,9 @@ def _setRequestParams():
|
|||||||
testableParameters = True
|
testableParameters = True
|
||||||
|
|
||||||
else:
|
else:
|
||||||
|
if place == PLACE.URI:
|
||||||
|
value = conf.url = conf.url.replace('+', "%20") # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5123
|
||||||
|
|
||||||
conf.parameters[place] = value
|
conf.parameters[place] = value
|
||||||
conf.paramDict[place] = OrderedDict()
|
conf.paramDict[place] = OrderedDict()
|
||||||
|
|
||||||
@@ -582,7 +585,7 @@ def _setResultsFile():
|
|||||||
os.close(handle)
|
os.close(handle)
|
||||||
conf.resultsFP = openFile(conf.resultsFile, "w+", UNICODE_ENCODING, buffering=0)
|
conf.resultsFP = openFile(conf.resultsFile, "w+", UNICODE_ENCODING, buffering=0)
|
||||||
warnMsg += "Using temporary file '%s' instead" % conf.resultsFile
|
warnMsg += "Using temporary file '%s' instead" % conf.resultsFile
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
except IOError as _:
|
except IOError as _:
|
||||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||||
errMsg += "Please make sure that your disk is not full and "
|
errMsg += "Please make sure that your disk is not full and "
|
||||||
@@ -613,7 +616,7 @@ def _createFilesDir():
|
|||||||
warnMsg = "unable to create files directory "
|
warnMsg = "unable to create files directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.filePath = tempDir
|
conf.filePath = tempDir
|
||||||
|
|
||||||
@@ -635,7 +638,7 @@ def _createDumpDir():
|
|||||||
warnMsg = "unable to create dump directory "
|
warnMsg = "unable to create dump directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.dumpPath = tempDir
|
conf.dumpPath = tempDir
|
||||||
|
|
||||||
@@ -658,7 +661,7 @@ def _createTargetDirs():
|
|||||||
warnMsg = "unable to create output directory "
|
warnMsg = "unable to create output directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.outputPath = tempDir
|
conf.outputPath = tempDir
|
||||||
|
|
||||||
@@ -681,7 +684,7 @@ def _createTargetDirs():
|
|||||||
raise SqlmapMissingPrivileges(errMsg)
|
raise SqlmapMissingPrivileges(errMsg)
|
||||||
except UnicodeError as ex:
|
except UnicodeError as ex:
|
||||||
warnMsg = "something went wrong while saving target data ('%s')" % getSafeExString(ex)
|
warnMsg = "something went wrong while saving target data ('%s')" % getSafeExString(ex)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
_createDumpDir()
|
_createDumpDir()
|
||||||
_createFilesDir()
|
_createFilesDir()
|
||||||
|
|||||||
+1
-1
@@ -39,7 +39,7 @@ def vulnTest():
|
|||||||
|
|
||||||
TESTS = (
|
TESTS = (
|
||||||
("-h", ("to see full list of options run with '-hh'",)),
|
("-h", ("to see full list of options run with '-hh'",)),
|
||||||
("--dependencies --deprecations", ("sqlmap requires", "third-party library", "~DeprecationWarning:")),
|
("--dependencies", ("sqlmap requires", "third-party library")),
|
||||||
("-u <url> --data=\"reflect=1\" --flush-session --wizard --disable-coloring", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
("-u <url> --data=\"reflect=1\" --flush-session --wizard --disable-coloring", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
||||||
("-u <url> --data=\"code=1\" --code=200 --technique=B --banner --no-cast --flush-session", ("back-end DBMS: SQLite", "banner: '3.", "~COALESCE(CAST(")),
|
("-u <url> --data=\"code=1\" --code=200 --technique=B --banner --no-cast --flush-session", ("back-end DBMS: SQLite", "banner: '3.", "~COALESCE(CAST(")),
|
||||||
(u"-c <config> --flush-session --output-dir=\"<tmpdir>\" --smart --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible", "as the output directory")),
|
(u"-c <config> --flush-session --output-dir=\"<tmpdir>\" --smart --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible", "as the output directory")),
|
||||||
|
|||||||
+1
-1
@@ -154,7 +154,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
|||||||
|
|
||||||
if numThreads == 1:
|
if numThreads == 1:
|
||||||
warnMsg = "running in a single-thread mode. This could take a while"
|
warnMsg = "running in a single-thread mode. This could take a while"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if numThreads > 1:
|
if numThreads > 1:
|
||||||
if startThreadMsg:
|
if startThreadMsg:
|
||||||
|
|||||||
+1
-1
@@ -68,7 +68,7 @@ def update():
|
|||||||
elif not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
elif not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
||||||
warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository "
|
warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository "
|
||||||
warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if VERSION == getLatestRevision():
|
if VERSION == getLatestRevision():
|
||||||
logger.info("already at the latest revision '%s'" % getRevisionNumber())
|
logger.info("already at the latest revision '%s'" % getRevisionNumber())
|
||||||
|
|||||||
@@ -51,6 +51,6 @@ def parseSitemap(url, retVal=None):
|
|||||||
abortedFlag = True
|
abortedFlag = True
|
||||||
warnMsg = "user aborted during sitemap parsing. sqlmap "
|
warnMsg = "user aborted during sitemap parsing. sqlmap "
|
||||||
warnMsg += "will use partial list"
|
warnMsg += "will use partial list"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|||||||
@@ -154,7 +154,7 @@ class Connect(object):
|
|||||||
if (len(inspect.stack()) > sys.getrecursionlimit() // 2): # Note: https://github.com/sqlmapproject/sqlmap/issues/4525
|
if (len(inspect.stack()) > sys.getrecursionlimit() // 2): # Note: https://github.com/sqlmapproject/sqlmap/issues/4525
|
||||||
warnMsg = "unable to connect to the target URL"
|
warnMsg = "unable to connect to the target URL"
|
||||||
raise SqlmapConnectionException(warnMsg)
|
raise SqlmapConnectionException(warnMsg)
|
||||||
except TypeError:
|
except (TypeError, UnicodeError):
|
||||||
pass
|
pass
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -169,7 +169,7 @@ class Connect(object):
|
|||||||
|
|
||||||
if conf.proxyList and threadData.retriesCount >= conf.retries and not kb.locks.handlers.locked():
|
if conf.proxyList and threadData.retriesCount >= conf.retries and not kb.locks.handlers.locked():
|
||||||
warnMsg = "changing proxy"
|
warnMsg = "changing proxy"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.proxy = None
|
conf.proxy = None
|
||||||
threadData.retriesCount = 0
|
threadData.retriesCount = 0
|
||||||
@@ -312,7 +312,7 @@ class Connect(object):
|
|||||||
conf.proxy = None
|
conf.proxy = None
|
||||||
|
|
||||||
warnMsg = "changing proxy"
|
warnMsg = "changing proxy"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
setHTTPHandlers()
|
setHTTPHandlers()
|
||||||
|
|
||||||
@@ -703,7 +703,7 @@ class Connect(object):
|
|||||||
conn.close()
|
conn.close()
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex)
|
warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
except SqlmapConnectionException as ex:
|
except SqlmapConnectionException as ex:
|
||||||
if conf.proxyList and not kb.threadException:
|
if conf.proxyList and not kb.threadException:
|
||||||
@@ -730,7 +730,7 @@ class Connect(object):
|
|||||||
except socket.timeout:
|
except socket.timeout:
|
||||||
warnMsg = "connection timed out while trying "
|
warnMsg = "connection timed out while trying "
|
||||||
warnMsg += "to get error page information (%d)" % ex.code
|
warnMsg += "to get error page information (%d)" % ex.code
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return None, None, None
|
return None, None, None
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
raise
|
raise
|
||||||
@@ -805,7 +805,7 @@ class Connect(object):
|
|||||||
debugMsg = "got HTTP error code: %d ('%s')" % (code, status)
|
debugMsg = "got HTTP error code: %d ('%s')" % (code, status)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
except (_urllib.error.URLError, socket.error, socket.timeout, _http_client.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError, ValueError, OverflowError, AttributeError):
|
except (_urllib.error.URLError, socket.error, socket.timeout, _http_client.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError, ValueError, OverflowError, AttributeError, OSError):
|
||||||
tbMsg = traceback.format_exc()
|
tbMsg = traceback.format_exc()
|
||||||
|
|
||||||
if conf.debug:
|
if conf.debug:
|
||||||
@@ -821,7 +821,7 @@ class Connect(object):
|
|||||||
elif "no host given" in tbMsg:
|
elif "no host given" in tbMsg:
|
||||||
warnMsg = "invalid URL address used (%s)" % repr(url)
|
warnMsg = "invalid URL address used (%s)" % repr(url)
|
||||||
raise SqlmapSyntaxException(warnMsg)
|
raise SqlmapSyntaxException(warnMsg)
|
||||||
elif "forcibly closed" in tbMsg or "Connection is already closed" in tbMsg:
|
elif any(_ in tbMsg for _ in ("forcibly closed", "Connection is already closed", "ConnectionAbortedError")):
|
||||||
warnMsg = "connection was forcibly closed by the target URL"
|
warnMsg = "connection was forcibly closed by the target URL"
|
||||||
elif "timed out" in tbMsg:
|
elif "timed out" in tbMsg:
|
||||||
if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED):
|
if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED):
|
||||||
@@ -927,7 +927,7 @@ class Connect(object):
|
|||||||
if conf.retryOn and re.search(conf.retryOn, page, re.I):
|
if conf.retryOn and re.search(conf.retryOn, page, re.I):
|
||||||
if threadData.retriesCount < conf.retries:
|
if threadData.retriesCount < conf.retries:
|
||||||
warnMsg = "forced retry of the request because of undesired page content"
|
warnMsg = "forced retry of the request because of undesired page content"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return Connect._retryProxy(**kwargs)
|
return Connect._retryProxy(**kwargs)
|
||||||
|
|
||||||
processResponse(page, responseHeaders, code, status)
|
processResponse(page, responseHeaders, code, status)
|
||||||
@@ -1174,7 +1174,7 @@ class Connect(object):
|
|||||||
if attempt > 0:
|
if attempt > 0:
|
||||||
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
warnMsg += ". sqlmap is going to retry the request"
|
warnMsg += ". sqlmap is going to retry the request"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
||||||
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
||||||
|
|||||||
@@ -270,7 +270,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
warnMsg += "of entries for the SQL query provided. "
|
warnMsg += "of entries for the SQL query provided. "
|
||||||
warnMsg += "sqlmap will assume that it returns only "
|
warnMsg += "sqlmap will assume that it returns only "
|
||||||
warnMsg += "one entry"
|
warnMsg += "one entry"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
stopLimit = 1
|
stopLimit = 1
|
||||||
|
|
||||||
@@ -278,7 +278,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
if not count:
|
if not count:
|
||||||
warnMsg = "the SQL query provided does not "
|
warnMsg = "the SQL query provided does not "
|
||||||
warnMsg += "return any output"
|
warnMsg += "return any output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
@@ -298,7 +298,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
print()
|
print()
|
||||||
warnMsg = "user aborted during dumping phase"
|
warnMsg = "user aborted during dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return outputs
|
return outputs
|
||||||
|
|
||||||
|
|||||||
@@ -211,7 +211,7 @@ class Abstraction(Web, UDF, XP_cmdshell):
|
|||||||
warnMsg += "were able to extract and crack a DBA "
|
warnMsg += "were able to extract and crack a DBA "
|
||||||
warnMsg += "password by any mean"
|
warnMsg += "password by any mean"
|
||||||
|
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec():
|
if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec():
|
||||||
success = True
|
success = True
|
||||||
|
|||||||
@@ -72,7 +72,7 @@ class ICMPsh(object):
|
|||||||
raise SqlmapDataException("local host address is missing")
|
raise SqlmapDataException("local host address is missing")
|
||||||
elif address and not valid:
|
elif address and not valid:
|
||||||
warnMsg = "invalid local host address"
|
warnMsg = "invalid local host address"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return address
|
return address
|
||||||
|
|
||||||
|
|||||||
@@ -206,7 +206,7 @@ class Metasploit(object):
|
|||||||
warnMsg = "by default PostgreSQL on Windows runs as "
|
warnMsg = "by default PostgreSQL on Windows runs as "
|
||||||
warnMsg += "postgres user, it is unlikely that the VNC "
|
warnMsg += "postgres user, it is unlikely that the VNC "
|
||||||
warnMsg += "injection will be successful"
|
warnMsg += "injection will be successful"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
|
elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
|
||||||
choose = True
|
choose = True
|
||||||
@@ -215,7 +215,7 @@ class Metasploit(object):
|
|||||||
warnMsg += "successful because usually Microsoft SQL Server "
|
warnMsg += "successful because usually Microsoft SQL Server "
|
||||||
warnMsg += "%s runs as Network Service " % Backend.getVersion()
|
warnMsg += "%s runs as Network Service " % Backend.getVersion()
|
||||||
warnMsg += "or the Administrator is not logged in"
|
warnMsg += "or the Administrator is not logged in"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if choose:
|
if choose:
|
||||||
message = "what do you want to do?\n"
|
message = "what do you want to do?\n"
|
||||||
@@ -236,23 +236,23 @@ class Metasploit(object):
|
|||||||
|
|
||||||
elif choice == "1":
|
elif choice == "1":
|
||||||
if Backend.isDbms(DBMS.PGSQL):
|
if Backend.isDbms(DBMS.PGSQL):
|
||||||
logger.warn("beware that the VNC injection might not work")
|
logger.warning("beware that the VNC injection might not work")
|
||||||
break
|
break
|
||||||
|
|
||||||
elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
|
elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
|
||||||
break
|
break
|
||||||
|
|
||||||
elif not isDigit(choice):
|
elif not isDigit(choice):
|
||||||
logger.warn("invalid value, only digits are allowed")
|
logger.warning("invalid value, only digits are allowed")
|
||||||
|
|
||||||
elif int(choice) < 1 or int(choice) > 2:
|
elif int(choice) < 1 or int(choice) > 2:
|
||||||
logger.warn("invalid value, it must be 1 or 2")
|
logger.warning("invalid value, it must be 1 or 2")
|
||||||
|
|
||||||
if self.connectionStr.startswith("reverse_http") and _payloadStr != "windows/meterpreter":
|
if self.connectionStr.startswith("reverse_http") and _payloadStr != "windows/meterpreter":
|
||||||
warnMsg = "Reverse HTTP%s connection is only supported " % ("S" if self.connectionStr.endswith("s") else "")
|
warnMsg = "Reverse HTTP%s connection is only supported " % ("S" if self.connectionStr.endswith("s") else "")
|
||||||
warnMsg += "with the Meterpreter payload. Falling back to "
|
warnMsg += "with the Meterpreter payload. Falling back to "
|
||||||
warnMsg += "reverse TCP"
|
warnMsg += "reverse TCP"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
self.connectionStr = "reverse_tcp"
|
self.connectionStr = "reverse_tcp"
|
||||||
|
|
||||||
|
|||||||
+9
-9
@@ -198,7 +198,7 @@ class UDF(object):
|
|||||||
if not self.isDba():
|
if not self.isDba():
|
||||||
warnMsg = "functionality requested probably does not work because "
|
warnMsg = "functionality requested probably does not work because "
|
||||||
warnMsg += "the current session user is not a database administrator"
|
warnMsg += "the current session user is not a database administrator"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not conf.shLib:
|
if not conf.shLib:
|
||||||
msg = "what is the local path of the shared library? "
|
msg = "what is the local path of the shared library? "
|
||||||
@@ -209,7 +209,7 @@ class UDF(object):
|
|||||||
if self.udfLocalFile:
|
if self.udfLocalFile:
|
||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
logger.warn("you need to specify the local path of the shared library")
|
logger.warning("you need to specify the local path of the shared library")
|
||||||
else:
|
else:
|
||||||
self.udfLocalFile = conf.shLib
|
self.udfLocalFile = conf.shLib
|
||||||
|
|
||||||
@@ -249,7 +249,7 @@ class UDF(object):
|
|||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
logger.warn("invalid value, only digits are allowed")
|
logger.warning("invalid value, only digits are allowed")
|
||||||
|
|
||||||
for x in xrange(0, udfCount):
|
for x in xrange(0, udfCount):
|
||||||
while True:
|
while True:
|
||||||
@@ -260,7 +260,7 @@ class UDF(object):
|
|||||||
self.udfs[udfName] = {}
|
self.udfs[udfName] = {}
|
||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
logger.warn("you need to specify the name of the UDF")
|
logger.warning("you need to specify the name of the UDF")
|
||||||
|
|
||||||
if Backend.isDbms(DBMS.MYSQL):
|
if Backend.isDbms(DBMS.MYSQL):
|
||||||
defaultType = "string"
|
defaultType = "string"
|
||||||
@@ -280,7 +280,7 @@ class UDF(object):
|
|||||||
break
|
break
|
||||||
|
|
||||||
else:
|
else:
|
||||||
logger.warn("invalid value, only digits >= 0 are allowed")
|
logger.warning("invalid value, only digits >= 0 are allowed")
|
||||||
|
|
||||||
for y in xrange(0, parCount):
|
for y in xrange(0, parCount):
|
||||||
msg = "what is the data-type of input parameter "
|
msg = "what is the data-type of input parameter "
|
||||||
@@ -290,7 +290,7 @@ class UDF(object):
|
|||||||
parType = readInput(msg, default=defaultType).strip()
|
parType = readInput(msg, default=defaultType).strip()
|
||||||
|
|
||||||
if parType.isdigit():
|
if parType.isdigit():
|
||||||
logger.warn("you need to specify the data-type of the parameter")
|
logger.warning("you need to specify the data-type of the parameter")
|
||||||
|
|
||||||
else:
|
else:
|
||||||
self.udfs[udfName]["input"].append(parType)
|
self.udfs[udfName]["input"].append(parType)
|
||||||
@@ -303,7 +303,7 @@ class UDF(object):
|
|||||||
retType = readInput(msg, default=defaultType)
|
retType = readInput(msg, default=defaultType)
|
||||||
|
|
||||||
if hasattr(retType, "isdigit") and retType.isdigit():
|
if hasattr(retType, "isdigit") and retType.isdigit():
|
||||||
logger.warn("you need to specify the data-type of the return value")
|
logger.warning("you need to specify the data-type of the return value")
|
||||||
else:
|
else:
|
||||||
self.udfs[udfName]["return"] = retType
|
self.udfs[udfName]["return"] = retType
|
||||||
break
|
break
|
||||||
@@ -346,7 +346,7 @@ class UDF(object):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "invalid value, only digits >= 1 and "
|
warnMsg = "invalid value, only digits >= 1 and "
|
||||||
warnMsg += "<= %d are allowed" % len(udfList)
|
warnMsg += "<= %d are allowed" % len(udfList)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not isinstance(choice, int):
|
if not isinstance(choice, int):
|
||||||
break
|
break
|
||||||
@@ -370,7 +370,7 @@ class UDF(object):
|
|||||||
|
|
||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
logger.warn("you need to specify the value of the parameter")
|
logger.warning("you need to specify the value of the parameter")
|
||||||
|
|
||||||
count += 1
|
count += 1
|
||||||
|
|
||||||
|
|||||||
+5
-5
@@ -137,7 +137,7 @@ class Web(object):
|
|||||||
if "File uploaded" not in (page or ""):
|
if "File uploaded" not in (page or ""):
|
||||||
warnMsg = "unable to upload the file through the web file "
|
warnMsg = "unable to upload the file through the web file "
|
||||||
warnMsg += "stager to '%s'" % directory
|
warnMsg += "stager to '%s'" % directory
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return False
|
return False
|
||||||
else:
|
else:
|
||||||
return True
|
return True
|
||||||
@@ -202,10 +202,10 @@ class Web(object):
|
|||||||
choice = readInput(message, default=str(default))
|
choice = readInput(message, default=str(default))
|
||||||
|
|
||||||
if not isDigit(choice):
|
if not isDigit(choice):
|
||||||
logger.warn("invalid value, only digits are allowed")
|
logger.warning("invalid value, only digits are allowed")
|
||||||
|
|
||||||
elif int(choice) < 1 or int(choice) > len(choices):
|
elif int(choice) < 1 or int(choice) > len(choices):
|
||||||
logger.warn("invalid value, it must be between 1 and %d" % len(choices))
|
logger.warning("invalid value, it must be between 1 and %d" % len(choices))
|
||||||
|
|
||||||
else:
|
else:
|
||||||
self.webPlatform = choices[int(choice) - 1]
|
self.webPlatform = choices[int(choice) - 1]
|
||||||
@@ -362,7 +362,7 @@ class Web(object):
|
|||||||
if "<%" in uplPage or "<?" in uplPage:
|
if "<%" in uplPage or "<?" in uplPage:
|
||||||
warnMsg = "file stager uploaded on '%s', " % directory
|
warnMsg = "file stager uploaded on '%s', " % directory
|
||||||
warnMsg += "but not dynamically interpreted"
|
warnMsg += "but not dynamically interpreted"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
elif self.webPlatform == WEB_PLATFORM.ASPX:
|
elif self.webPlatform == WEB_PLATFORM.ASPX:
|
||||||
@@ -399,7 +399,7 @@ class Web(object):
|
|||||||
warnMsg += "was able to upload the file stager or "
|
warnMsg += "was able to upload the file stager or "
|
||||||
warnMsg += "because the DBMS and web server sit on "
|
warnMsg += "because the DBMS and web server sit on "
|
||||||
warnMsg += "different servers"
|
warnMsg += "different servers"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "do you want to try the same method used "
|
message = "do you want to try the same method used "
|
||||||
message += "for the file stager? [Y/n] "
|
message += "for the file stager? [Y/n] "
|
||||||
|
|||||||
@@ -270,7 +270,7 @@ class XP_cmdshell(object):
|
|||||||
kb.xpCmdshellAvailable = True
|
kb.xpCmdshellAvailable = True
|
||||||
|
|
||||||
else:
|
else:
|
||||||
logger.warn("xp_cmdshell re-enabling failed")
|
logger.warning("xp_cmdshell re-enabling failed")
|
||||||
|
|
||||||
logger.info("creating xp_cmdshell with sp_OACreate")
|
logger.info("creating xp_cmdshell with sp_OACreate")
|
||||||
self._xpCmdshellConfigure(0)
|
self._xpCmdshellConfigure(0)
|
||||||
@@ -283,7 +283,7 @@ class XP_cmdshell(object):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "xp_cmdshell creation failed, probably "
|
warnMsg = "xp_cmdshell creation failed, probably "
|
||||||
warnMsg += "because sp_OACreate is disabled"
|
warnMsg += "because sp_OACreate is disabled"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
hashDBWrite(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE, kb.xpCmdshellAvailable)
|
hashDBWrite(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE, kb.xpCmdshellAvailable)
|
||||||
|
|
||||||
|
|||||||
@@ -423,7 +423,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
|
|||||||
if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE:
|
if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE:
|
||||||
conf.timeSec += 1
|
conf.timeSec += 1
|
||||||
warnMsg = "increasing time delay to %d second%s" % (conf.timeSec, 's' if conf.timeSec > 1 else '')
|
warnMsg = "increasing time delay to %d second%s" % (conf.timeSec, 's' if conf.timeSec > 1 else '')
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES:
|
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES:
|
||||||
dbgMsg = "turning off time auto-adjustment mechanism"
|
dbgMsg = "turning off time auto-adjustment mechanism"
|
||||||
|
|||||||
@@ -167,7 +167,7 @@ def _oneShotErrorUse(expression, field=None, chunkTest=False):
|
|||||||
warnMsg = "possible server trimmed output detected "
|
warnMsg = "possible server trimmed output detected "
|
||||||
warnMsg += "(due to its length and/or content): "
|
warnMsg += "(due to its length and/or content): "
|
||||||
warnMsg += safecharencode(trimmed)
|
warnMsg += safecharencode(trimmed)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not kb.testMode:
|
if not kb.testMode:
|
||||||
check = r"(?P<result>[^<>\n]*?)%s" % kb.chars.stop[:2]
|
check = r"(?P<result>[^<>\n]*?)%s" % kb.chars.stop[:2]
|
||||||
@@ -351,7 +351,7 @@ def errorUse(expression, dump=False):
|
|||||||
warnMsg += "of entries for the SQL query provided. "
|
warnMsg += "of entries for the SQL query provided. "
|
||||||
warnMsg += "sqlmap will assume that it returns only "
|
warnMsg += "sqlmap will assume that it returns only "
|
||||||
warnMsg += "one entry"
|
warnMsg += "one entry"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
stopLimit = 1
|
stopLimit = 1
|
||||||
|
|
||||||
@@ -359,7 +359,7 @@ def errorUse(expression, dump=False):
|
|||||||
if not count:
|
if not count:
|
||||||
warnMsg = "the SQL query provided does not "
|
warnMsg = "the SQL query provided does not "
|
||||||
warnMsg += "return any output"
|
warnMsg += "return any output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
value = [] # for empty tables
|
value = [] # for empty tables
|
||||||
return value
|
return value
|
||||||
@@ -445,7 +445,7 @@ def errorUse(expression, dump=False):
|
|||||||
abortedFlag = True
|
abortedFlag = True
|
||||||
warnMsg = "user aborted during enumeration. sqlmap "
|
warnMsg = "user aborted during enumeration. sqlmap "
|
||||||
warnMsg += "will display partial output"
|
warnMsg += "will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered))
|
threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered))
|
||||||
|
|||||||
@@ -275,7 +275,7 @@ def _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLO
|
|||||||
content = ("%s%s" % (removeReflectiveValues(page, payload) or "", removeReflectiveValues(listToStrValue(headers.headers if headers else None), payload, True) or "")).lower()
|
content = ("%s%s" % (removeReflectiveValues(page, payload) or "", removeReflectiveValues(listToStrValue(headers.headers if headers else None), payload, True) or "")).lower()
|
||||||
if content.count(phrase) > 0 and content.count(phrase) < LIMITED_ROWS_TEST_NUMBER:
|
if content.count(phrase) > 0 and content.count(phrase) < LIMITED_ROWS_TEST_NUMBER:
|
||||||
warnMsg = "output with limited number of rows detected. Switching to partial mode"
|
warnMsg = "output with limited number of rows detected. Switching to partial mode"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True, kb.tableFrom, kb.unionTemplate)
|
vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True, kb.tableFrom, kb.unionTemplate)
|
||||||
|
|
||||||
unionErrorCase = kb.errorIsNone and wasLastResponseDBMSError()
|
unionErrorCase = kb.errorIsNone and wasLastResponseDBMSError()
|
||||||
@@ -284,7 +284,7 @@ def _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLO
|
|||||||
warnMsg = "combined UNION/error-based SQL injection case found on "
|
warnMsg = "combined UNION/error-based SQL injection case found on "
|
||||||
warnMsg += "column %d. sqlmap will try to find another " % (position + 1)
|
warnMsg += "column %d. sqlmap will try to find another " % (position + 1)
|
||||||
warnMsg += "column with better characteristics"
|
warnMsg += "column with better characteristics"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
|
|
||||||
|
|||||||
@@ -167,7 +167,7 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
|
|||||||
warnMsg = "possible server trimmed output detected "
|
warnMsg = "possible server trimmed output detected "
|
||||||
warnMsg += "(probably due to its length and/or content): "
|
warnMsg += "(probably due to its length and/or content): "
|
||||||
warnMsg += safecharencode(trimmed)
|
warnMsg += safecharencode(trimmed)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif re.search(r"ORDER BY [^ ]+\Z", expression):
|
elif re.search(r"ORDER BY [^ ]+\Z", expression):
|
||||||
debugMsg = "retrying failed SQL query without the ORDER BY clause"
|
debugMsg = "retrying failed SQL query without the ORDER BY clause"
|
||||||
@@ -304,7 +304,7 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
warnMsg += "of entries for the SQL query provided. "
|
warnMsg += "of entries for the SQL query provided. "
|
||||||
warnMsg += "sqlmap will assume that it returns only "
|
warnMsg += "sqlmap will assume that it returns only "
|
||||||
warnMsg += "one entry"
|
warnMsg += "one entry"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
stopLimit = 1
|
stopLimit = 1
|
||||||
|
|
||||||
@@ -312,7 +312,7 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
if not count:
|
if not count:
|
||||||
warnMsg = "the SQL query provided does not "
|
warnMsg = "the SQL query provided does not "
|
||||||
warnMsg += "return any output"
|
warnMsg += "return any output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
value = [] # for empty tables
|
value = [] # for empty tables
|
||||||
return value
|
return value
|
||||||
@@ -429,7 +429,7 @@ def unionUse(expression, unpack=True, dump=False):
|
|||||||
|
|
||||||
warnMsg = "user aborted during enumeration. sqlmap "
|
warnMsg = "user aborted during enumeration. sqlmap "
|
||||||
warnMsg += "will display partial output"
|
warnMsg += "will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
for _ in sorted(threadData.shared.buffered):
|
for _ in sorted(threadData.shared.buffered):
|
||||||
|
|||||||
+8
-8
@@ -66,7 +66,7 @@ def tableExists(tableFile, regex=None):
|
|||||||
if kb.choices.tableExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:
|
if kb.choices.tableExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:
|
||||||
warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED])
|
warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED])
|
||||||
warnMsg += "for common table existence check"
|
warnMsg += "for common table existence check"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "are you sure you want to continue? [y/N] "
|
message = "are you sure you want to continue? [y/N] "
|
||||||
kb.choices.tableExists = readInput(message, default='N', boolean=True)
|
kb.choices.tableExists = readInput(message, default='N', boolean=True)
|
||||||
@@ -160,7 +160,7 @@ def tableExists(tableFile, regex=None):
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during table existence "
|
warnMsg = "user aborted during table existence "
|
||||||
warnMsg += "check. sqlmap will display partial output"
|
warnMsg += "check. sqlmap will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
clearConsoleLine(True)
|
clearConsoleLine(True)
|
||||||
dataToStdout("\n")
|
dataToStdout("\n")
|
||||||
@@ -169,7 +169,7 @@ def tableExists(tableFile, regex=None):
|
|||||||
warnMsg = "no table(s) found"
|
warnMsg = "no table(s) found"
|
||||||
if conf.db:
|
if conf.db:
|
||||||
warnMsg += " for database '%s'" % conf.db
|
warnMsg += " for database '%s'" % conf.db
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
for item in threadData.shared.files:
|
for item in threadData.shared.files:
|
||||||
if conf.db not in kb.data.cachedTables:
|
if conf.db not in kb.data.cachedTables:
|
||||||
@@ -190,7 +190,7 @@ def columnExists(columnFile, regex=None):
|
|||||||
if kb.choices.columnExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:
|
if kb.choices.columnExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:
|
||||||
warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED])
|
warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED])
|
||||||
warnMsg += "for common column existence check"
|
warnMsg += "for common column existence check"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
message = "are you sure you want to continue? [y/N] "
|
message = "are you sure you want to continue? [y/N] "
|
||||||
kb.choices.columnExists = readInput(message, default='N', boolean=True)
|
kb.choices.columnExists = readInput(message, default='N', boolean=True)
|
||||||
@@ -281,7 +281,7 @@ def columnExists(columnFile, regex=None):
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during column existence "
|
warnMsg = "user aborted during column existence "
|
||||||
warnMsg += "check. sqlmap will display partial output"
|
warnMsg += "check. sqlmap will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
finally:
|
finally:
|
||||||
kb.bruteMode = False
|
kb.bruteMode = False
|
||||||
|
|
||||||
@@ -290,7 +290,7 @@ def columnExists(columnFile, regex=None):
|
|||||||
|
|
||||||
if not threadData.shared.files:
|
if not threadData.shared.files:
|
||||||
warnMsg = "no column(s) found"
|
warnMsg = "no column(s) found"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
columns = {}
|
columns = {}
|
||||||
|
|
||||||
@@ -394,7 +394,7 @@ def fileExists(pathFile):
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during file existence "
|
warnMsg = "user aborted during file existence "
|
||||||
warnMsg += "check. sqlmap will display partial output"
|
warnMsg += "check. sqlmap will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
finally:
|
finally:
|
||||||
kb.bruteMode = False
|
kb.bruteMode = False
|
||||||
logger.setLevel(popValue())
|
logger.setLevel(popValue())
|
||||||
@@ -404,7 +404,7 @@ def fileExists(pathFile):
|
|||||||
|
|
||||||
if not threadData.shared.files:
|
if not threadData.shared.files:
|
||||||
warnMsg = "no file(s) found"
|
warnMsg = "no file(s) found"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
retVal = threadData.shared.files
|
retVal = threadData.shared.files
|
||||||
|
|
||||||
|
|||||||
@@ -162,7 +162,7 @@ def crawl(target, post=None, cookie=None):
|
|||||||
except SqlmapConnectionException as ex:
|
except SqlmapConnectionException as ex:
|
||||||
if "page not found" in getSafeExString(ex):
|
if "page not found" in getSafeExString(ex):
|
||||||
found = False
|
found = False
|
||||||
logger.warn("'sitemap.xml' not found")
|
logger.warning("'sitemap.xml' not found")
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
finally:
|
finally:
|
||||||
@@ -198,7 +198,7 @@ def crawl(target, post=None, cookie=None):
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during crawling. sqlmap "
|
warnMsg = "user aborted during crawling. sqlmap "
|
||||||
warnMsg += "will use partial list"
|
warnMsg += "will use partial list"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
clearConsoleLine(True)
|
clearConsoleLine(True)
|
||||||
@@ -208,7 +208,7 @@ def crawl(target, post=None, cookie=None):
|
|||||||
warnMsg = "no usable links found (with GET parameters)"
|
warnMsg = "no usable links found (with GET parameters)"
|
||||||
if conf.forms:
|
if conf.forms:
|
||||||
warnMsg += " or forms"
|
warnMsg += " or forms"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
for url in threadData.shared.value:
|
for url in threadData.shared.value:
|
||||||
kb.targets.add((urldecode(url, kb.pageEncoding), None, None, None, None))
|
kb.targets.add((urldecode(url, kb.pageEncoding), None, None, None, None))
|
||||||
|
|||||||
+8
-8
@@ -26,7 +26,7 @@ def checkDependencies():
|
|||||||
warnMsg = "'%s' third-party library must be " % data[1]
|
warnMsg = "'%s' third-party library must be " % data[1]
|
||||||
warnMsg += "version >= 1.0.2 to work properly. "
|
warnMsg += "version >= 1.0.2 to work properly. "
|
||||||
warnMsg += "Download from '%s'" % data[2]
|
warnMsg += "Download from '%s'" % data[2]
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
elif dbmsName == DBMS.MYSQL:
|
elif dbmsName == DBMS.MYSQL:
|
||||||
__import__("pymysql")
|
__import__("pymysql")
|
||||||
elif dbmsName in (DBMS.PGSQL, DBMS.CRATEDB):
|
elif dbmsName in (DBMS.PGSQL, DBMS.CRATEDB):
|
||||||
@@ -62,7 +62,7 @@ def checkDependencies():
|
|||||||
warnMsg = "sqlmap requires '%s' third-party library " % data[1]
|
warnMsg = "sqlmap requires '%s' third-party library " % data[1]
|
||||||
warnMsg += "in order to directly connect to the DBMS "
|
warnMsg += "in order to directly connect to the DBMS "
|
||||||
warnMsg += "'%s'. Download from '%s'" % (dbmsName, data[2])
|
warnMsg += "'%s'. Download from '%s'" % (dbmsName, data[2])
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add(data[1])
|
missing_libraries.add(data[1])
|
||||||
|
|
||||||
continue
|
continue
|
||||||
@@ -78,7 +78,7 @@ def checkDependencies():
|
|||||||
warnMsg = "sqlmap requires 'python-impacket' third-party library for "
|
warnMsg = "sqlmap requires 'python-impacket' third-party library for "
|
||||||
warnMsg += "out-of-band takeover feature. Download from "
|
warnMsg += "out-of-band takeover feature. Download from "
|
||||||
warnMsg += "'https://github.com/coresecurity/impacket'"
|
warnMsg += "'https://github.com/coresecurity/impacket'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('python-impacket')
|
missing_libraries.add('python-impacket')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -89,7 +89,7 @@ def checkDependencies():
|
|||||||
warnMsg = "sqlmap requires 'python-ntlm' third-party library "
|
warnMsg = "sqlmap requires 'python-ntlm' third-party library "
|
||||||
warnMsg += "if you plan to attack a web application behind NTLM "
|
warnMsg += "if you plan to attack a web application behind NTLM "
|
||||||
warnMsg += "authentication. Download from 'https://github.com/mullender/python-ntlm'"
|
warnMsg += "authentication. Download from 'https://github.com/mullender/python-ntlm'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('python-ntlm')
|
missing_libraries.add('python-ntlm')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -100,7 +100,7 @@ def checkDependencies():
|
|||||||
warnMsg = "sqlmap requires 'websocket-client' third-party library "
|
warnMsg = "sqlmap requires 'websocket-client' third-party library "
|
||||||
warnMsg += "if you plan to attack a web application using WebSocket. "
|
warnMsg += "if you plan to attack a web application using WebSocket. "
|
||||||
warnMsg += "Download from 'https://pypi.python.org/pypi/websocket-client/'"
|
warnMsg += "Download from 'https://pypi.python.org/pypi/websocket-client/'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('websocket-client')
|
missing_libraries.add('websocket-client')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -110,7 +110,7 @@ def checkDependencies():
|
|||||||
except ImportError:
|
except ImportError:
|
||||||
warnMsg = "sqlmap requires 'tkinter' library "
|
warnMsg = "sqlmap requires 'tkinter' library "
|
||||||
warnMsg += "if you plan to run a GUI"
|
warnMsg += "if you plan to run a GUI"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('tkinter')
|
missing_libraries.add('tkinter')
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -120,7 +120,7 @@ def checkDependencies():
|
|||||||
except ImportError:
|
except ImportError:
|
||||||
warnMsg = "sqlmap requires 'tkinter.ttk' library "
|
warnMsg = "sqlmap requires 'tkinter.ttk' library "
|
||||||
warnMsg += "if you plan to run a GUI"
|
warnMsg += "if you plan to run a GUI"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('tkinter.ttk')
|
missing_libraries.add('tkinter.ttk')
|
||||||
|
|
||||||
if IS_WIN:
|
if IS_WIN:
|
||||||
@@ -134,7 +134,7 @@ def checkDependencies():
|
|||||||
warnMsg += "completion and history support features in the SQL "
|
warnMsg += "completion and history support features in the SQL "
|
||||||
warnMsg += "shell and OS shell. Download from "
|
warnMsg += "shell and OS shell. Download from "
|
||||||
warnMsg += "'https://pypi.org/project/pyreadline/'"
|
warnMsg += "'https://pypi.org/project/pyreadline/'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
missing_libraries.add('python-pyreadline')
|
missing_libraries.add('python-pyreadline')
|
||||||
|
|
||||||
if len(missing_libraries) == 0:
|
if len(missing_libraries) == 0:
|
||||||
|
|||||||
+6
-6
@@ -701,7 +701,7 @@ def attackDumpedTable():
|
|||||||
_ = ','.join(binary_fields)
|
_ = ','.join(binary_fields)
|
||||||
warnMsg = "potential binary fields detected ('%s'). In case of any problems you are " % _
|
warnMsg = "potential binary fields detected ('%s'). In case of any problems you are " % _
|
||||||
warnMsg += "advised to rerun table dump with '--fresh-queries --binary-fields=\"%s\"'" % _
|
warnMsg += "advised to rerun table dump with '--fresh-queries --binary-fields=\"%s\"'" % _
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
for i in xrange(count):
|
for i in xrange(count):
|
||||||
if not found and i > HASH_RECOGNITION_QUIT_THRESHOLD:
|
if not found and i > HASH_RECOGNITION_QUIT_THRESHOLD:
|
||||||
@@ -1064,7 +1064,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}]
|
item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}]
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid hash '%s'" % hash_
|
warnMsg = "invalid hash '%s'" % hash_
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if item and hash_ not in keys:
|
if item and hash_ not in keys:
|
||||||
resumed = hashDBRetrieve(hash_)
|
resumed = hashDBRetrieve(hash_)
|
||||||
@@ -1197,7 +1197,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
print()
|
print()
|
||||||
processException = True
|
processException = True
|
||||||
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
|
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
_finalize(retVal, results, processes, attack_info)
|
_finalize(retVal, results, processes, attack_info)
|
||||||
@@ -1272,7 +1272,7 @@ def dictionaryAttack(attack_dict):
|
|||||||
print()
|
print()
|
||||||
processException = True
|
processException = True
|
||||||
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
|
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
for process in processes:
|
for process in processes:
|
||||||
try:
|
try:
|
||||||
@@ -1290,11 +1290,11 @@ def dictionaryAttack(attack_dict):
|
|||||||
|
|
||||||
if foundHash and len(hash_regexes) == 0:
|
if foundHash and len(hash_regexes) == 0:
|
||||||
warnMsg = "unknown hash format"
|
warnMsg = "unknown hash format"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if len(results) == 0:
|
if len(results) == 0:
|
||||||
warnMsg = "no clear password(s) found"
|
warnMsg = "no clear password(s) found"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return results
|
return results
|
||||||
|
|
||||||
|
|||||||
+6
-2
@@ -116,7 +116,7 @@ class HashDB(object):
|
|||||||
retVal = None
|
retVal = None
|
||||||
warnMsg = "error occurred while unserializing value for session key '%s'. " % key
|
warnMsg = "error occurred while unserializing value for session key '%s'. " % key
|
||||||
warnMsg += "If the problem persists please rerun with '--flush-session'"
|
warnMsg += "If the problem persists please rerun with '--flush-session'"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -163,7 +163,7 @@ class HashDB(object):
|
|||||||
if retries == 0:
|
if retries == 0:
|
||||||
warnMsg = "there has been a problem while writing to "
|
warnMsg = "there has been a problem while writing to "
|
||||||
warnMsg += "the session file ('%s')" % getSafeExString(ex)
|
warnMsg += "the session file ('%s')" % getSafeExString(ex)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if retries >= HASHDB_FLUSH_RETRIES:
|
if retries >= HASHDB_FLUSH_RETRIES:
|
||||||
return
|
return
|
||||||
@@ -198,6 +198,10 @@ class HashDB(object):
|
|||||||
threadData.inTransaction = False
|
threadData.inTransaction = False
|
||||||
except sqlite3.OperationalError:
|
except sqlite3.OperationalError:
|
||||||
pass
|
pass
|
||||||
|
except sqlite3.ProgrammingError:
|
||||||
|
self.cursor = None
|
||||||
|
threadData.inTransaction = False
|
||||||
|
return
|
||||||
else:
|
else:
|
||||||
return
|
return
|
||||||
|
|
||||||
|
|||||||
@@ -88,7 +88,7 @@ def pivotDumpTable(table, colList, count=None, blind=True, alias=None):
|
|||||||
if not validPivotValue:
|
if not validPivotValue:
|
||||||
warnMsg = "column '%s' not " % conf.pivotColumn
|
warnMsg = "column '%s' not " % conf.pivotColumn
|
||||||
warnMsg += "found in table '%s'" % table
|
warnMsg += "found in table '%s'" % table
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not validPivotValue:
|
if not validPivotValue:
|
||||||
for column in colList:
|
for column in colList:
|
||||||
@@ -120,7 +120,7 @@ def pivotDumpTable(table, colList, count=None, blind=True, alias=None):
|
|||||||
if not validPivotValue:
|
if not validPivotValue:
|
||||||
warnMsg = "no proper pivot column provided (with unique values)."
|
warnMsg = "no proper pivot column provided (with unique values)."
|
||||||
warnMsg += " It won't be possible to retrieve all rows"
|
warnMsg += " It won't be possible to retrieve all rows"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
pivotValue = " "
|
pivotValue = " "
|
||||||
breakRetrieval = False
|
breakRetrieval = False
|
||||||
@@ -177,7 +177,7 @@ def pivotDumpTable(table, colList, count=None, blind=True, alias=None):
|
|||||||
|
|
||||||
warnMsg = "user aborted during enumeration. sqlmap "
|
warnMsg = "user aborted during enumeration. sqlmap "
|
||||||
warnMsg += "will display partial output"
|
warnMsg += "will display partial output"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
except SqlmapConnectionException as ex:
|
except SqlmapConnectionException as ex:
|
||||||
errMsg = "connection exception detected ('%s'). sqlmap " % getSafeExString(ex)
|
errMsg = "connection exception detected ('%s'). sqlmap " % getSafeExString(ex)
|
||||||
|
|||||||
+1
-1
@@ -26,7 +26,7 @@ def purge(directory):
|
|||||||
|
|
||||||
if not os.path.isdir(directory):
|
if not os.path.isdir(directory):
|
||||||
warnMsg = "skipping purging of directory '%s' as it does not exist" % directory
|
warnMsg = "skipping purging of directory '%s' as it does not exist" % directory
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return
|
return
|
||||||
|
|
||||||
infoMsg = "purging content of directory '%s'..." % directory
|
infoMsg = "purging content of directory '%s'..." % directory
|
||||||
|
|||||||
+1
-1
@@ -196,7 +196,7 @@ def search(dork):
|
|||||||
logger.critical(getSafeExString(ex))
|
logger.critical(getSafeExString(ex))
|
||||||
|
|
||||||
warnMsg = "changing proxy"
|
warnMsg = "changing proxy"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.proxy = None
|
conf.proxy = None
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,7 @@ Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
|||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
import imp
|
import importlib
|
||||||
import logging
|
import logging
|
||||||
import os
|
import os
|
||||||
import re
|
import re
|
||||||
@@ -13,15 +13,18 @@ import sys
|
|||||||
import traceback
|
import traceback
|
||||||
import warnings
|
import warnings
|
||||||
|
|
||||||
|
_path = list(sys.path)
|
||||||
_sqlalchemy = None
|
_sqlalchemy = None
|
||||||
try:
|
try:
|
||||||
f, pathname, desc = imp.find_module("sqlalchemy", sys.path[1:])
|
sys.path = sys.path[1:]
|
||||||
_ = imp.load_module("sqlalchemy", f, pathname, desc)
|
module = importlib.import_module("sqlalchemy")
|
||||||
if hasattr(_, "dialects"):
|
if hasattr(module, "dialects"):
|
||||||
_sqlalchemy = _
|
_sqlalchemy = module
|
||||||
warnings.simplefilter(action="ignore", category=_sqlalchemy.exc.SAWarning)
|
warnings.simplefilter(action="ignore", category=_sqlalchemy.exc.SAWarning)
|
||||||
except ImportError:
|
except ImportError:
|
||||||
pass
|
pass
|
||||||
|
finally:
|
||||||
|
sys.path = _path
|
||||||
|
|
||||||
try:
|
try:
|
||||||
import MySQLdb # used by SQLAlchemy in case of MySQL
|
import MySQLdb # used by SQLAlchemy in case of MySQL
|
||||||
|
|||||||
@@ -11,74 +11,74 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to get the banner"
|
warnMsg = "on Microsoft Access it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getCurrentUser(self):
|
def getCurrentUser(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the current user"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to get name of the current database"
|
warnMsg = "on Microsoft Access it is not possible to get name of the current database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on Microsoft Access it is not possible to test if current user is DBA"
|
warnMsg = "on Microsoft Access it is not possible to test if current user is DBA"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the users"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the user password hashes"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the user privileges"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on Microsoft Access it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to search databases"
|
warnMsg = "on Microsoft Access it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to search tables"
|
warnMsg = "on Microsoft Access it is not possible to search tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to search columns"
|
warnMsg = "on Microsoft Access it is not possible to search columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Microsoft Access search option is not available"
|
warnMsg = "on Microsoft Access search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the hostname"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Microsoft Access it is not possible to enumerate the SQL statements"
|
warnMsg = "on Microsoft Access it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -166,7 +166,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return False
|
return False
|
||||||
|
|
||||||
setDbms(DBMS.ACCESS)
|
setDbms(DBMS.ACCESS)
|
||||||
@@ -185,7 +185,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,10 +11,10 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Altibase it is not possible to enumerate the SQL statements"
|
warnMsg = "on Altibase it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Altibase it is not possible to enumerate the hostname"
|
warnMsg = "on Altibase it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -79,7 +79,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -90,6 +90,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
Vendored
+6
-6
@@ -15,34 +15,34 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on Cache it is not possible to enumerate the users"
|
warnMsg = "on Cache it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Cache it is not possible to enumerate password hashes"
|
warnMsg = "on Cache it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Cache it is not possible to enumerate the user privileges"
|
warnMsg = "on Cache it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Cache it is not possible to enumerate the SQL statements"
|
warnMsg = "on Cache it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Cache it is not possible to enumerate the user roles"
|
warnMsg = "on Cache it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Cache it is not possible to enumerate the hostname"
|
warnMsg = "on Cache it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
Vendored
+2
-2
@@ -97,7 +97,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -108,6 +108,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ class Connector(GenericConnector):
|
|||||||
try:
|
try:
|
||||||
return self.cursor.fetchall()
|
return self.cursor.fetchall()
|
||||||
except psycopg2.ProgrammingError as ex:
|
except psycopg2.ProgrammingError as ex:
|
||||||
logger.warn(getSafeExString(ex))
|
logger.warning(getSafeExString(ex))
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def execute(self, query):
|
def execute(self, query):
|
||||||
@@ -56,7 +56,7 @@ class Connector(GenericConnector):
|
|||||||
self.cursor.execute(query)
|
self.cursor.execute(query)
|
||||||
retVal = True
|
retVal = True
|
||||||
except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex:
|
except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex:
|
||||||
logger.warn(("(remote) '%s'" % getSafeExString(ex)).strip())
|
logger.warning(("(remote) '%s'" % getSafeExString(ex)).strip())
|
||||||
except psycopg2.InternalError as ex:
|
except psycopg2.InternalError as ex:
|
||||||
raise SqlmapConnectionException(getSafeExString(ex))
|
raise SqlmapConnectionException(getSafeExString(ex))
|
||||||
|
|
||||||
|
|||||||
@@ -11,12 +11,12 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on CrateDB it is not possible to enumerate the user password hashes"
|
warnMsg = "on CrateDB it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on CrateDB it is not possible to enumerate the user roles"
|
warnMsg = "on CrateDB it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -89,6 +89,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,22 +11,22 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Cubrid it is not possible to enumerate password hashes"
|
warnMsg = "on Cubrid it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Cubrid it is not possible to enumerate the SQL statements"
|
warnMsg = "on Cubrid it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Cubrid it is not possible to enumerate the user roles"
|
warnMsg = "on Cubrid it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Cubrid it is not possible to enumerate the hostname"
|
warnMsg = "on Cubrid it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -89,6 +89,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID
|
warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,12 +11,12 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on IBM DB2 it is not possible to enumerate password hashes"
|
warnMsg = "on IBM DB2 it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on IBM DB2 it is not possible to enumerate the SQL statements"
|
warnMsg = "on IBM DB2 it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -101,7 +101,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.DB2
|
warnMsg = "the back-end DBMS is not %s" % DBMS.DB2
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -115,7 +115,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.DB2
|
warnMsg = "the back-end DBMS is not %s" % DBMS.DB2
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -12,31 +12,31 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate password hashes"
|
warnMsg = "on Apache Derby it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate the SQL statements"
|
warnMsg = "on Apache Derby it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate the user privileges"
|
warnMsg = "on Apache Derby it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate the user roles"
|
warnMsg = "on Apache Derby it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate the hostname"
|
warnMsg = "on Apache Derby it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on Apache Derby it is not possible to enumerate the banner"
|
warnMsg = "on Apache Derby it is not possible to enumerate the banner"
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY
|
warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -89,6 +89,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY
|
warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,74 +11,74 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to get the banner"
|
warnMsg = "on eXtremeDB it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getCurrentUser(self):
|
def getCurrentUser(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the current user"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to get name of the current database"
|
warnMsg = "on eXtremeDB it is not possible to get name of the current database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on eXtremeDB it is not possible to test if current user is DBA"
|
warnMsg = "on eXtremeDB it is not possible to test if current user is DBA"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the users"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the user password hashes"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the user privileges"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on eXtremeDB it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to search databases"
|
warnMsg = "on eXtremeDB it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to search tables"
|
warnMsg = "on eXtremeDB it is not possible to search tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to search columns"
|
warnMsg = "on eXtremeDB it is not possible to search columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on eXtremeDB search option is not available"
|
warnMsg = "on eXtremeDB search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the hostname"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on eXtremeDB it is not possible to enumerate the SQL statements"
|
warnMsg = "on eXtremeDB it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -76,7 +76,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -85,7 +85,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,28 +11,28 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on Firebird it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on Firebird it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Firebird it is not possible to enumerate the user password hashes"
|
warnMsg = "on Firebird it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Firebird it is not possible to search databases"
|
warnMsg = "on Firebird it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Firebird it is not possible to enumerate the hostname"
|
warnMsg = "on Firebird it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Firebird it is not possible to enumerate the SQL statements"
|
warnMsg = "on Firebird it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -126,7 +126,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD
|
warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -146,7 +146,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD
|
warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,22 +11,22 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on FrontBase it is not possible to get the banner"
|
warnMsg = "on FrontBase it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on FrontBase it is not possible to enumerate the user privileges"
|
warnMsg = "on FrontBase it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on FrontBase it is not possible to enumerate the hostname"
|
warnMsg = "on FrontBase it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on FrontBase it is not possible to enumerate the SQL statements"
|
warnMsg = "on FrontBase it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -75,7 +75,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -84,6 +84,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -31,25 +31,25 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on H2 it is not possible to enumerate the user privileges"
|
warnMsg = "on H2 it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on H2 it is not possible to enumerate the hostname"
|
warnMsg = "on H2 it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
return H2_DEFAULT_SCHEMA
|
return H2_DEFAULT_SCHEMA
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on H2 it is not possible to enumerate password hashes"
|
warnMsg = "on H2 it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on H2 it is not possible to enumerate the SQL statements"
|
warnMsg = "on H2 it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -97,7 +97,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.H2
|
warnMsg = "the back-end DBMS is not %s" % DBMS.H2
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
else:
|
else:
|
||||||
@@ -108,10 +108,10 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.H2
|
warnMsg = "the back-end DBMS is not %s" % DBMS.H2
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on H2 it is not possible to enumerate the hostname"
|
warnMsg = "on H2 it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -31,19 +31,19 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on HSQLDB it is not possible to enumerate the user privileges"
|
warnMsg = "on HSQLDB it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on HSQLDB it is not possible to enumerate the hostname"
|
warnMsg = "on HSQLDB it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
return HSQLDB_DEFAULT_SCHEMA
|
return HSQLDB_DEFAULT_SCHEMA
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on HSQLDB it is not possible to enumerate the SQL statements"
|
warnMsg = "on HSQLDB it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -41,7 +41,7 @@ class Filesystem(GenericFilesystem):
|
|||||||
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
||||||
warnMsg += "bytes, this might cause errors in the file "
|
warnMsg += "bytes, this might cause errors in the file "
|
||||||
warnMsg += "writing process"
|
warnMsg += "writing process"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|||||||
@@ -103,14 +103,14 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
else:
|
else:
|
||||||
result = inject.checkBooleanExpression("ZERO() IS 0") # Note: check for H2 DBMS (sharing majority of same functions)
|
result = inject.checkBooleanExpression("ZERO() IS 0") # Note: check for H2 DBMS (sharing majority of same functions)
|
||||||
if result:
|
if result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -134,7 +134,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
dbgMsg = "...or version is < 1.7.2"
|
dbgMsg = "...or version is < 1.7.2"
|
||||||
logger.debug(dbgMsg)
|
logger.debug(dbgMsg)
|
||||||
@@ -143,7 +143,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on HSQLDB it is not possible to enumerate the hostname"
|
warnMsg = "on HSQLDB it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def checkDbmsOs(self, detailed=False):
|
def checkDbmsOs(self, detailed=False):
|
||||||
if Backend.getOs():
|
if Backend.getOs():
|
||||||
|
|||||||
@@ -11,28 +11,28 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Informix searching of databases is not implemented"
|
warnMsg = "on Informix searching of databases is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Informix searching of tables is not implemented"
|
warnMsg = "on Informix searching of tables is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Informix searching of columns is not implemented"
|
warnMsg = "on Informix searching of columns is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Informix search option is not available"
|
warnMsg = "on Informix search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Informix it is not possible to enumerate the SQL statements"
|
warnMsg = "on Informix it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX
|
warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -106,6 +106,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX
|
warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on SAP MaxDB it is not possible to enumerate the user password hashes"
|
warnMsg = "on SAP MaxDB it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
@@ -108,7 +108,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg = "missing database parameter. sqlmap is going "
|
warnMsg = "missing database parameter. sqlmap is going "
|
||||||
warnMsg += "to use the current database to enumerate "
|
warnMsg += "to use the current database to enumerate "
|
||||||
warnMsg += "table(s) columns"
|
warnMsg += "table(s) columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
|
|
||||||
@@ -226,20 +226,20 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on SAP MaxDB it is not possible to enumerate the user privileges"
|
warnMsg = "on SAP MaxDB it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on SAP MaxDB search option is not available"
|
warnMsg = "on SAP MaxDB search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on SAP MaxDB it is not possible to enumerate the hostname"
|
warnMsg = "on SAP MaxDB it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on SAP MaxDB it is not possible to enumerate the SQL statements"
|
warnMsg = "on SAP MaxDB it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -34,7 +34,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "unable to perform %s version check" % DBMS.MAXDB
|
warnMsg = "unable to perform %s version check" % DBMS.MAXDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
@@ -112,7 +112,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -123,7 +123,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,74 +11,74 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on Mckoi it is not possible to get the banner"
|
warnMsg = "on Mckoi it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getCurrentUser(self):
|
def getCurrentUser(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the current user"
|
warnMsg = "on Mckoi it is not possible to enumerate the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on Mckoi it is not possible to get name of the current database"
|
warnMsg = "on Mckoi it is not possible to get name of the current database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on Mckoi it is not possible to test if current user is DBA"
|
warnMsg = "on Mckoi it is not possible to test if current user is DBA"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the users"
|
warnMsg = "on Mckoi it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the user password hashes"
|
warnMsg = "on Mckoi it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the user privileges"
|
warnMsg = "on Mckoi it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on Mckoi it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Mckoi it is not possible to search databases"
|
warnMsg = "on Mckoi it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Mckoi it is not possible to search tables"
|
warnMsg = "on Mckoi it is not possible to search tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Mckoi it is not possible to search columns"
|
warnMsg = "on Mckoi it is not possible to search columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Mckoi search option is not available"
|
warnMsg = "on Mckoi search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the hostname"
|
warnMsg = "on Mckoi it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Mckoi it is not possible to enumerate the SQL statements"
|
warnMsg = "on Mckoi it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -76,7 +76,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -85,7 +85,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,22 +11,22 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on MimerSQL it is not possible to enumerate password hashes"
|
warnMsg = "on MimerSQL it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on MimerSQL it is not possible to enumerate the SQL statements"
|
warnMsg = "on MimerSQL it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on MimerSQL it is not possible to enumerate the user roles"
|
warnMsg = "on MimerSQL it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on MimerSQL it is not possible to enumerate the hostname"
|
warnMsg = "on MimerSQL it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -89,6 +89,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,28 +11,28 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on MonetDB it is not possible to enumerate password hashes"
|
warnMsg = "on MonetDB it is not possible to enumerate password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on MonetDB it is not possible to enumerate the SQL statements"
|
warnMsg = "on MonetDB it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on MonetDB it is not possible to enumerate the user privileges"
|
warnMsg = "on MonetDB it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on MonetDB it is not possible to enumerate the user roles"
|
warnMsg = "on MonetDB it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on MonetDB it is not possible to enumerate the hostname"
|
warnMsg = "on MonetDB it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -89,6 +89,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg = "on Microsoft SQL Server it is not possible to fetch "
|
warnMsg = "on Microsoft SQL Server it is not possible to fetch "
|
||||||
warnMsg += "database users privileges, sqlmap will check whether "
|
warnMsg += "database users privileges, sqlmap will check whether "
|
||||||
warnMsg += "or not the database users are database administrators"
|
warnMsg += "or not the database users are database administrators"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
users = []
|
users = []
|
||||||
areAdmins = set()
|
areAdmins = set()
|
||||||
@@ -140,7 +140,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
if count != 0:
|
if count != 0:
|
||||||
warnMsg = "unable to retrieve the number of "
|
warnMsg = "unable to retrieve the number of "
|
||||||
warnMsg += "tables for database '%s'" % db
|
warnMsg += "tables for database '%s'" % db
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
tables = []
|
tables = []
|
||||||
@@ -159,7 +159,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "unable to retrieve the tables "
|
warnMsg = "unable to retrieve the tables "
|
||||||
warnMsg += "for database '%s'" % db
|
warnMsg += "for database '%s'" % db
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not kb.data.cachedTables and not conf.search:
|
if not kb.data.cachedTables and not conf.search:
|
||||||
errMsg = "unable to retrieve the tables for any database"
|
errMsg = "unable to retrieve the tables for any database"
|
||||||
@@ -248,7 +248,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg += "s LIKE"
|
warnMsg += "s LIKE"
|
||||||
warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
||||||
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db)
|
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
continue
|
continue
|
||||||
|
|
||||||
@@ -269,7 +269,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
if not foundTbls:
|
if not foundTbls:
|
||||||
warnMsg = "no databases contain any of the provided tables"
|
warnMsg = "no databases contain any of the provided tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
return
|
return
|
||||||
|
|
||||||
conf.dumper.dbTables(foundTbls)
|
conf.dumper.dbTables(foundTbls)
|
||||||
@@ -407,7 +407,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg += "s LIKE"
|
warnMsg += "s LIKE"
|
||||||
warnMsg += " '%s' " % column
|
warnMsg += " '%s' " % column
|
||||||
warnMsg += "in database '%s'" % db
|
warnMsg += "in database '%s'" % db
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
continue
|
continue
|
||||||
|
|
||||||
|
|||||||
@@ -117,7 +117,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -172,7 +172,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
warnMsg = "unable to fingerprint the underlying operating "
|
warnMsg = "unable to fingerprint the underlying operating "
|
||||||
warnMsg += "system version, assuming it is Windows "
|
warnMsg += "system version, assuming it is Windows "
|
||||||
warnMsg += "%s Service Pack %d" % (Backend.getOsVersion(), Backend.getOsServicePack())
|
warnMsg += "%s Service Pack %d" % (Backend.getOsVersion(), Backend.getOsServicePack())
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
self.cleanup(onlyFileTbl=True)
|
self.cleanup(onlyFileTbl=True)
|
||||||
|
|
||||||
|
|||||||
@@ -68,7 +68,7 @@ class Filesystem(GenericFilesystem):
|
|||||||
if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
|
if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
|
||||||
if not kb.bruteMode:
|
if not kb.bruteMode:
|
||||||
warnMsg += ", going to fall-back to simpler UNION technique"
|
warnMsg += ", going to fall-back to simpler UNION technique"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
result = self.nonStackedReadFile(remoteFile)
|
result = self.nonStackedReadFile(remoteFile)
|
||||||
else:
|
else:
|
||||||
raise SqlmapNoneDataException(warnMsg)
|
raise SqlmapNoneDataException(warnMsg)
|
||||||
@@ -100,7 +100,7 @@ class Filesystem(GenericFilesystem):
|
|||||||
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
||||||
warnMsg += "bytes, this might cause errors in the file "
|
warnMsg += "bytes, this might cause errors in the file "
|
||||||
warnMsg += "writing process"
|
warnMsg += "writing process"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
@@ -129,7 +129,7 @@ class Filesystem(GenericFilesystem):
|
|||||||
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
|
||||||
warnMsg += "bytes, this might cause errors in the file "
|
warnMsg += "bytes, this might cause errors in the file "
|
||||||
warnMsg += "writing process"
|
warnMsg += "writing process"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "unable to perform %s comment injection" % DBMS.MYSQL
|
warnMsg = "unable to perform %s comment injection" % DBMS.MYSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
@@ -192,7 +192,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -297,7 +297,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -124,7 +124,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
warnMsg = "unable to retrieve the number of "
|
warnMsg = "unable to retrieve the number of "
|
||||||
warnMsg += "roles for user '%s'" % user
|
warnMsg += "roles for user '%s'" % user
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
infoMsg = "fetching roles for user '%s'" % user
|
infoMsg = "fetching roles for user '%s'" % user
|
||||||
@@ -149,7 +149,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "unable to retrieve the roles "
|
warnMsg = "unable to retrieve the roles "
|
||||||
warnMsg += "for user '%s'" % user
|
warnMsg += "for user '%s'" % user
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
retrievedUsers.add(user)
|
retrievedUsers.add(user)
|
||||||
|
|
||||||
|
|||||||
@@ -90,7 +90,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -116,7 +116,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ class Connector(GenericConnector):
|
|||||||
try:
|
try:
|
||||||
return self.cursor.fetchall()
|
return self.cursor.fetchall()
|
||||||
except psycopg2.ProgrammingError as ex:
|
except psycopg2.ProgrammingError as ex:
|
||||||
logger.warn(getSafeExString(ex))
|
logger.warning(getSafeExString(ex))
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def execute(self, query):
|
def execute(self, query):
|
||||||
@@ -56,7 +56,7 @@ class Connector(GenericConnector):
|
|||||||
self.cursor.execute(query)
|
self.cursor.execute(query)
|
||||||
retVal = True
|
retVal = True
|
||||||
except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex:
|
except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex:
|
||||||
logger.warn(("(remote) '%s'" % getSafeExString(ex)).strip())
|
logger.warning(("(remote) '%s'" % getSafeExString(ex)).strip())
|
||||||
except psycopg2.InternalError as ex:
|
except psycopg2.InternalError as ex:
|
||||||
raise SqlmapConnectionException(getSafeExString(ex))
|
raise SqlmapConnectionException(getSafeExString(ex))
|
||||||
|
|
||||||
|
|||||||
@@ -12,4 +12,4 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on PostgreSQL it is not possible to enumerate the hostname"
|
warnMsg = "on PostgreSQL it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|||||||
@@ -117,7 +117,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -187,7 +187,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
|
warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -11,48 +11,48 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on Presto it is not possible to get the banner"
|
warnMsg = "on Presto it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on Presto it is not possible to get name of the current database (schema)"
|
warnMsg = "on Presto it is not possible to get name of the current database (schema)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on Presto it is not possible to test if current user is DBA"
|
warnMsg = "on Presto it is not possible to test if current user is DBA"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the users"
|
warnMsg = "on Presto it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the user password hashes"
|
warnMsg = "on Presto it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the user privileges"
|
warnMsg = "on Presto it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the user roles"
|
warnMsg = "on Presto it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the hostname"
|
warnMsg = "on Presto it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Presto it is not possible to enumerate the SQL statements"
|
warnMsg = "on Presto it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO
|
warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -132,6 +132,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO
|
warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,74 +11,74 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getBanner(self):
|
def getBanner(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to get the banner"
|
warnMsg = "on Raima Database Manager it is not possible to get the banner"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
def getCurrentUser(self):
|
def getCurrentUser(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the current user"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to get name of the current database"
|
warnMsg = "on Raima Database Manager it is not possible to get name of the current database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to test if current user is DBA"
|
warnMsg = "on Raima Database Manager it is not possible to test if current user is DBA"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the users"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the user password hashes"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the user privileges"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to search databases"
|
warnMsg = "on Raima Database Manager it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to search tables"
|
warnMsg = "on Raima Database Manager it is not possible to search tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to search columns"
|
warnMsg = "on Raima Database Manager it is not possible to search columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Raima Database Manager search option is not available"
|
warnMsg = "on Raima Database Manager search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the hostname"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Raima Database Manager it is not possible to enumerate the SQL statements"
|
warnMsg = "on Raima Database Manager it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -76,7 +76,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA
|
warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -85,7 +85,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA
|
warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -48,7 +48,7 @@ class Connector(GenericConnector):
|
|||||||
|
|
||||||
except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError):
|
except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError):
|
||||||
warnMsg = "unable to connect using SQLite 3 library, trying with SQLite 2"
|
warnMsg = "unable to connect using SQLite 3 library, trying with SQLite 2"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
try:
|
try:
|
||||||
|
|||||||
@@ -12,45 +12,45 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getCurrentUser(self):
|
def getCurrentUser(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the current user"
|
warnMsg = "on SQLite it is not possible to enumerate the current user"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getCurrentDb(self):
|
def getCurrentDb(self):
|
||||||
warnMsg = "on SQLite it is not possible to get name of the current database"
|
warnMsg = "on SQLite it is not possible to get name of the current database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def isDba(self, user=None):
|
def isDba(self, user=None):
|
||||||
warnMsg = "on SQLite the current user has all privileges"
|
warnMsg = "on SQLite the current user has all privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return True
|
return True
|
||||||
|
|
||||||
def getUsers(self):
|
def getUsers(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the users"
|
warnMsg = "on SQLite it is not possible to enumerate the users"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the user password hashes"
|
warnMsg = "on SQLite it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the user privileges"
|
warnMsg = "on SQLite it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getDbs(self):
|
def getDbs(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate databases (use only '--tables')"
|
warnMsg = "on SQLite it is not possible to enumerate databases (use only '--tables')"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on SQLite it is not possible to search databases"
|
warnMsg = "on SQLite it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
@@ -60,10 +60,10 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the hostname"
|
warnMsg = "on SQLite it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on SQLite it is not possible to enumerate the SQL statements"
|
warnMsg = "on SQLite it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -86,7 +86,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
else:
|
else:
|
||||||
@@ -104,7 +104,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|||||||
@@ -59,7 +59,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg = "on Sybase it is not possible to fetch "
|
warnMsg = "on Sybase it is not possible to fetch "
|
||||||
warnMsg += "database users privileges, sqlmap will check whether "
|
warnMsg += "database users privileges, sqlmap will check whether "
|
||||||
warnMsg += "or not the database users are database administrators"
|
warnMsg += "or not the database users are database administrators"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
users = []
|
users = []
|
||||||
areAdmins = set()
|
areAdmins = set()
|
||||||
@@ -169,7 +169,7 @@ class Enumeration(GenericEnumeration):
|
|||||||
warnMsg = "missing database parameter. sqlmap is going "
|
warnMsg = "missing database parameter. sqlmap is going "
|
||||||
warnMsg += "to use the current database to enumerate "
|
warnMsg += "to use the current database to enumerate "
|
||||||
warnMsg += "table(s) columns"
|
warnMsg += "table(s) columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
|
|
||||||
@@ -295,32 +295,32 @@ class Enumeration(GenericEnumeration):
|
|||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Sybase searching of databases is not implemented"
|
warnMsg = "on Sybase searching of databases is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Sybase searching of tables is not implemented"
|
warnMsg = "on Sybase searching of tables is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Sybase searching of columns is not implemented"
|
warnMsg = "on Sybase searching of columns is not implemented"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Sybase search option is not available"
|
warnMsg = "on Sybase search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getHostname(self):
|
def getHostname(self):
|
||||||
warnMsg = "on Sybase it is not possible to enumerate the hostname"
|
warnMsg = "on Sybase it is not possible to enumerate the hostname"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Sybase it is not possible to enumerate the SQL statements"
|
warnMsg = "on Sybase it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -86,7 +86,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -115,6 +115,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,6 +11,6 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Vertica it is not possible to enumerate the user roles"
|
warnMsg = "on Vertica it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|||||||
@@ -79,7 +79,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
|
warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -101,6 +101,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
|
warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -11,46 +11,46 @@ from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
|||||||
class Enumeration(GenericEnumeration):
|
class Enumeration(GenericEnumeration):
|
||||||
def getPasswordHashes(self):
|
def getPasswordHashes(self):
|
||||||
warnMsg = "on Virtuoso it is not possible to enumerate the user password hashes"
|
warnMsg = "on Virtuoso it is not possible to enumerate the user password hashes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getPrivileges(self, *args, **kwargs):
|
def getPrivileges(self, *args, **kwargs):
|
||||||
warnMsg = "on Virtuoso it is not possible to enumerate the user privileges"
|
warnMsg = "on Virtuoso it is not possible to enumerate the user privileges"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def getRoles(self, *args, **kwargs):
|
def getRoles(self, *args, **kwargs):
|
||||||
warnMsg = "on Virtuoso it is not possible to enumerate the user roles"
|
warnMsg = "on Virtuoso it is not possible to enumerate the user roles"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return {}
|
return {}
|
||||||
|
|
||||||
def searchDb(self):
|
def searchDb(self):
|
||||||
warnMsg = "on Virtuoso it is not possible to search databases"
|
warnMsg = "on Virtuoso it is not possible to search databases"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchTable(self):
|
def searchTable(self):
|
||||||
warnMsg = "on Virtuoso it is not possible to search tables"
|
warnMsg = "on Virtuoso it is not possible to search tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def searchColumn(self):
|
def searchColumn(self):
|
||||||
warnMsg = "on Virtuoso it is not possible to search columns"
|
warnMsg = "on Virtuoso it is not possible to search columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|
||||||
def search(self):
|
def search(self):
|
||||||
warnMsg = "on Virtuoso search option is not available"
|
warnMsg = "on Virtuoso search option is not available"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
def getStatements(self):
|
def getStatements(self):
|
||||||
warnMsg = "on Virtuoso it is not possible to enumerate the SQL statements"
|
warnMsg = "on Virtuoso it is not possible to enumerate the SQL statements"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return []
|
return []
|
||||||
|
|||||||
@@ -75,7 +75,7 @@ class Fingerprint(GenericFingerprint):
|
|||||||
|
|
||||||
if not result:
|
if not result:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO
|
warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
@@ -84,6 +84,6 @@ class Fingerprint(GenericFingerprint):
|
|||||||
return True
|
return True
|
||||||
else:
|
else:
|
||||||
warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO
|
warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return False
|
return False
|
||||||
|
|||||||
@@ -65,7 +65,7 @@ class Custom(object):
|
|||||||
elif not isStackingAvailable() and not conf.direct:
|
elif not isStackingAvailable() and not conf.direct:
|
||||||
warnMsg = "execution of non-query SQL statements is only "
|
warnMsg = "execution of non-query SQL statements is only "
|
||||||
warnMsg += "available when stacked queries are supported"
|
warnMsg += "available when stacked queries are supported"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
else:
|
else:
|
||||||
@@ -80,7 +80,7 @@ class Custom(object):
|
|||||||
output = NULL
|
output = NULL
|
||||||
|
|
||||||
except SqlmapNoneDataException as ex:
|
except SqlmapNoneDataException as ex:
|
||||||
logger.warn(ex)
|
logger.warning(ex)
|
||||||
|
|
||||||
return output
|
return output
|
||||||
|
|
||||||
|
|||||||
@@ -106,13 +106,13 @@ class Databases(object):
|
|||||||
warnMsg = "information_schema not available, "
|
warnMsg = "information_schema not available, "
|
||||||
warnMsg += "back-end DBMS is MySQL < 5. database "
|
warnMsg += "back-end DBMS is MySQL < 5. database "
|
||||||
warnMsg += "names will be fetched from 'mysql' database"
|
warnMsg += "names will be fetched from 'mysql' database"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE):
|
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE):
|
||||||
warnMsg = "schema names are going to be used on %s " % Backend.getIdentifiedDbms()
|
warnMsg = "schema names are going to be used on %s " % Backend.getIdentifiedDbms()
|
||||||
warnMsg += "for enumeration as the counterpart to database "
|
warnMsg += "for enumeration as the counterpart to database "
|
||||||
warnMsg += "names on other DBMSes"
|
warnMsg += "names on other DBMSes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
infoMsg = "fetching database (schema) names"
|
infoMsg = "fetching database (schema) names"
|
||||||
|
|
||||||
@@ -120,7 +120,7 @@ class Databases(object):
|
|||||||
warnMsg = "user names are going to be used on %s " % Backend.getIdentifiedDbms()
|
warnMsg = "user names are going to be used on %s " % Backend.getIdentifiedDbms()
|
||||||
warnMsg += "for enumeration as the counterpart to database "
|
warnMsg += "for enumeration as the counterpart to database "
|
||||||
warnMsg += "names on other DBMSes"
|
warnMsg += "names on other DBMSes"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
infoMsg = "fetching database (user) names"
|
infoMsg = "fetching database (user) names"
|
||||||
|
|
||||||
@@ -220,7 +220,7 @@ class Databases(object):
|
|||||||
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
|
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
|
||||||
warnMsg = "information_schema not available, "
|
warnMsg = "information_schema not available, "
|
||||||
warnMsg += "back-end DBMS is MySQL < 5.0"
|
warnMsg += "back-end DBMS is MySQL < 5.0"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
bruteForce = True
|
bruteForce = True
|
||||||
|
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
|
elif Backend.getIdentifiedDbms() in (DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
|
||||||
@@ -235,7 +235,7 @@ class Databases(object):
|
|||||||
if not tables:
|
if not tables:
|
||||||
warnMsg = "cannot retrieve table names, "
|
warnMsg = "cannot retrieve table names, "
|
||||||
warnMsg += "back-end DBMS is %s" % Backend.getIdentifiedDbms()
|
warnMsg += "back-end DBMS is %s" % Backend.getIdentifiedDbms()
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
bruteForce = True
|
bruteForce = True
|
||||||
else:
|
else:
|
||||||
return tables
|
return tables
|
||||||
@@ -381,7 +381,7 @@ class Databases(object):
|
|||||||
if count == 0:
|
if count == 0:
|
||||||
warnMsg = "database '%s' " % unsafeSQLIdentificatorNaming(db)
|
warnMsg = "database '%s' " % unsafeSQLIdentificatorNaming(db)
|
||||||
warnMsg += "appears to be empty"
|
warnMsg += "appears to be empty"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
break
|
break
|
||||||
|
|
||||||
elif not isNumPosStrValue(count):
|
elif not isNumPosStrValue(count):
|
||||||
@@ -441,7 +441,7 @@ class Databases(object):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "unable to retrieve the table names "
|
warnMsg = "unable to retrieve the table names "
|
||||||
warnMsg += "for database '%s'" % unsafeSQLIdentificatorNaming(db)
|
warnMsg += "for database '%s'" % unsafeSQLIdentificatorNaming(db)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if isNoneValue(kb.data.cachedTables):
|
if isNoneValue(kb.data.cachedTables):
|
||||||
kb.data.cachedTables.clear()
|
kb.data.cachedTables.clear()
|
||||||
@@ -471,7 +471,7 @@ class Databases(object):
|
|||||||
warnMsg = "missing database parameter. sqlmap is going "
|
warnMsg = "missing database parameter. sqlmap is going "
|
||||||
warnMsg += "to use the current database to enumerate "
|
warnMsg += "to use the current database to enumerate "
|
||||||
warnMsg += "table(s) columns"
|
warnMsg += "table(s) columns"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
|
|
||||||
@@ -542,7 +542,7 @@ class Databases(object):
|
|||||||
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
|
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
|
||||||
warnMsg = "information_schema not available, "
|
warnMsg = "information_schema not available, "
|
||||||
warnMsg += "back-end DBMS is MySQL < 5.0"
|
warnMsg += "back-end DBMS is MySQL < 5.0"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
bruteForce = True
|
bruteForce = True
|
||||||
|
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
|
elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
|
||||||
@@ -925,7 +925,7 @@ class Databases(object):
|
|||||||
warnMsg += ("table '%s' " % unsafeSQLIdentificatorNaming(unArrayizeValue(tblList))) if len(tblList) == 1 else "any table "
|
warnMsg += ("table '%s' " % unsafeSQLIdentificatorNaming(unArrayizeValue(tblList))) if len(tblList) == 1 else "any table "
|
||||||
if METADB_SUFFIX not in conf.db:
|
if METADB_SUFFIX not in conf.db:
|
||||||
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if bruteForce is None:
|
if bruteForce is None:
|
||||||
return self.getColumns(onlyColNames=onlyColNames, colTuple=colTuple, bruteForce=True)
|
return self.getColumns(onlyColNames=onlyColNames, colTuple=colTuple, bruteForce=True)
|
||||||
@@ -994,7 +994,7 @@ class Databases(object):
|
|||||||
warnMsg = "missing table parameter, sqlmap will retrieve "
|
warnMsg = "missing table parameter, sqlmap will retrieve "
|
||||||
warnMsg += "the number of entries for all database "
|
warnMsg += "the number of entries for all database "
|
||||||
warnMsg += "management system databases' tables"
|
warnMsg += "management system databases' tables"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
elif "." in conf.tbl:
|
elif "." in conf.tbl:
|
||||||
if not conf.db:
|
if not conf.db:
|
||||||
@@ -1004,7 +1004,7 @@ class Databases(object):
|
|||||||
warnMsg = "missing database parameter. sqlmap is going to "
|
warnMsg = "missing database parameter. sqlmap is going to "
|
||||||
warnMsg += "use the current database to retrieve the "
|
warnMsg += "use the current database to retrieve the "
|
||||||
warnMsg += "number of entries for table '%s'" % unsafeSQLIdentificatorNaming(conf.tbl)
|
warnMsg += "number of entries for table '%s'" % unsafeSQLIdentificatorNaming(conf.tbl)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
|
|
||||||
|
|||||||
+12
-12
@@ -68,7 +68,7 @@ class Entries(object):
|
|||||||
warnMsg = "missing database parameter. sqlmap is going "
|
warnMsg = "missing database parameter. sqlmap is going "
|
||||||
warnMsg += "to use the current database to enumerate "
|
warnMsg += "to use the current database to enumerate "
|
||||||
warnMsg += "table(s) entries"
|
warnMsg += "table(s) entries"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
conf.db = self.getCurrentDb()
|
conf.db = self.getCurrentDb()
|
||||||
|
|
||||||
@@ -142,7 +142,7 @@ class Entries(object):
|
|||||||
if METADB_SUFFIX not in conf.db:
|
if METADB_SUFFIX not in conf.db:
|
||||||
warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
||||||
warnMsg += ", skipping" if len(tblList) > 1 else ""
|
warnMsg += ", skipping" if len(tblList) > 1 else ""
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
continue
|
continue
|
||||||
|
|
||||||
@@ -157,7 +157,7 @@ class Entries(object):
|
|||||||
if METADB_SUFFIX not in conf.db:
|
if METADB_SUFFIX not in conf.db:
|
||||||
warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
||||||
warnMsg += " (no usable column names)"
|
warnMsg += " (no usable column names)"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
kb.dumpColumns = [unsafeSQLIdentificatorNaming(_) for _ in colList]
|
kb.dumpColumns = [unsafeSQLIdentificatorNaming(_) for _ in colList]
|
||||||
@@ -222,7 +222,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if isNoneValue(entries) and not kb.dumpKeyboardInterrupt:
|
if isNoneValue(entries) and not kb.dumpKeyboardInterrupt:
|
||||||
try:
|
try:
|
||||||
@@ -232,7 +232,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if retVal:
|
if retVal:
|
||||||
entries, _ = retVal
|
entries, _ = retVal
|
||||||
@@ -254,7 +254,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not isNoneValue(entries):
|
if not isNoneValue(entries):
|
||||||
if isinstance(entries, six.string_types):
|
if isinstance(entries, six.string_types):
|
||||||
@@ -314,7 +314,7 @@ class Entries(object):
|
|||||||
warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
||||||
warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db)
|
warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db)
|
||||||
warnMsg += "appears to be empty"
|
warnMsg += "appears to be empty"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
for column in colList:
|
for column in colList:
|
||||||
lengths[column] = len(column)
|
lengths[column] = len(column)
|
||||||
@@ -326,7 +326,7 @@ class Entries(object):
|
|||||||
warnMsg += "column(s) '%s' " % colNames
|
warnMsg += "column(s) '%s' " % colNames
|
||||||
warnMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
warnMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
||||||
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
continue
|
continue
|
||||||
|
|
||||||
@@ -366,7 +366,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if not entries and not kb.dumpKeyboardInterrupt:
|
if not entries and not kb.dumpKeyboardInterrupt:
|
||||||
try:
|
try:
|
||||||
@@ -376,7 +376,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
if retVal:
|
if retVal:
|
||||||
entries, lengths = retVal
|
entries, lengths = retVal
|
||||||
@@ -437,7 +437,7 @@ class Entries(object):
|
|||||||
kb.dumpKeyboardInterrupt = True
|
kb.dumpKeyboardInterrupt = True
|
||||||
clearConsoleLine()
|
clearConsoleLine()
|
||||||
warnMsg = "Ctrl+C detected in dumping phase"
|
warnMsg = "Ctrl+C detected in dumping phase"
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
for column, columnEntries in entries.items():
|
for column, columnEntries in entries.items():
|
||||||
length = max(lengths[column], len(column))
|
length = max(lengths[column], len(column))
|
||||||
@@ -452,7 +452,7 @@ class Entries(object):
|
|||||||
warnMsg += "of columns '%s' " % colNames
|
warnMsg += "of columns '%s' " % colNames
|
||||||
warnMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
warnMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl)
|
||||||
warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "")
|
warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "")
|
||||||
logger.warn(warnMsg)
|
logger.warning(warnMsg)
|
||||||
else:
|
else:
|
||||||
kb.data.dumpedTable["__infos__"] = {"count": entriesCount,
|
kb.data.dumpedTable["__infos__"] = {"count": entriesCount,
|
||||||
"table": safeSQLIdentificatorNaming(tbl, True),
|
"table": safeSQLIdentificatorNaming(tbl, True),
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user