mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-12 02:22:55 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Miroslav Stampar
|
6a57c8e61a |
+1
-1
@@ -1 +1 @@
|
|||||||
github: sqlmapproject
|
custom: 'https://www.paypal.com/donate?hosted_button_id=A34GMDLKA2V7G'
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ jobs:
|
|||||||
strategy:
|
strategy:
|
||||||
matrix:
|
matrix:
|
||||||
os: [ubuntu-latest, macos-latest, windows-latest]
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
||||||
python-version: [ '2.x', '3.11', 'pypy-2.7', 'pypy-3.7' ]
|
python-version: [ '2.x', '3.10', 'pypy-2.7', 'pypy-3.7' ]
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v2
|
- uses: actions/checkout@v2
|
||||||
- name: Set up Python
|
- name: Set up Python
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
COPYING -- Describes the terms under which sqlmap is distributed. A copy
|
||||||
of the GNU General Public License (GPL) is appended to this file.
|
of the GNU General Public License (GPL) is appended to this file.
|
||||||
|
|
||||||
sqlmap is (C) 2006-2023 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
sqlmap is (C) 2006-2022 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
|
||||||
|
|
||||||
This program is free software; you may redistribute and/or modify it under
|
This program is free software; you may redistribute and/or modify it under
|
||||||
the terms of the GNU General Public License as published by the Free
|
the terms of the GNU General Public License as published by the Free
|
||||||
|
|||||||
@@ -57,7 +57,6 @@ Translations
|
|||||||
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
|
||||||
* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md)
|
* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md)
|
||||||
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
|
||||||
* [Georgian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ka-GE.md)
|
|
||||||
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
|
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
|
||||||
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
|
||||||
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
id
|
id
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# CTFs
|
# CTFs
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
[Banners]
|
[Banners]
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
users
|
users
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml)
|
# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml)
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Opera
|
# Opera
|
||||||
|
|||||||
@@ -34,7 +34,7 @@
|
|||||||
<!-- Reference: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832%28v=vs.85%29.aspx -->
|
<!-- Reference: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832%28v=vs.85%29.aspx -->
|
||||||
|
|
||||||
<regexp value="Windows.*\b10\.0">
|
<regexp value="Windows.*\b10\.0">
|
||||||
<info type="Windows" distrib="2016|2019|2022|10|11"/>
|
<info type="Windows" distrib="2016|2019|10|11"/>
|
||||||
</regexp>
|
</regexp>
|
||||||
|
|
||||||
<regexp value="Windows.*\b6\.3">
|
<regexp value="Windows.*\b6\.3">
|
||||||
|
|||||||
@@ -10,7 +10,7 @@
|
|||||||
<!-- Microsoft IIS -->
|
<!-- Microsoft IIS -->
|
||||||
|
|
||||||
<regexp value="Microsoft-IIS/(10\.0)">
|
<regexp value="Microsoft-IIS/(10\.0)">
|
||||||
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2016|2019|2022|10|11"/>
|
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2019|2016|10"/>
|
||||||
</regexp>
|
</regexp>
|
||||||
|
|
||||||
<regexp value="Microsoft-IIS/(8\.5)">
|
<regexp value="Microsoft-IIS/(8\.5)">
|
||||||
@@ -878,11 +878,7 @@
|
|||||||
</regexp>
|
</regexp>
|
||||||
|
|
||||||
<regexp value="Apache/2\.4\.46 \(Ubuntu\)">
|
<regexp value="Apache/2\.4\.46 \(Ubuntu\)">
|
||||||
<info type="Linux" distrib="Ubuntu" release="21.04|21.10" codename="hirsute|impish"/>
|
<info type="Linux" distrib="Ubuntu" release="21.04|21.10" codename="eoan|focal"/>
|
||||||
</regexp>
|
|
||||||
|
|
||||||
<regexp value="Apache/2\.4\.52 \(Ubuntu\)">
|
|
||||||
<info type="Linux" distrib="Ubuntu" release="22.04" codename="jammy"/>
|
|
||||||
</regexp>
|
</regexp>
|
||||||
|
|
||||||
<!-- Nginx -->
|
<!-- Nginx -->
|
||||||
|
|||||||
@@ -199,7 +199,6 @@
|
|||||||
<error regexp="io\.prestosql\.jdbc"/>
|
<error regexp="io\.prestosql\.jdbc"/>
|
||||||
<error regexp="com\.simba\.presto\.jdbc"/>
|
<error regexp="com\.simba\.presto\.jdbc"/>
|
||||||
<error regexp="UNION query has different number of fields: \d+, \d+"/>
|
<error regexp="UNION query has different number of fields: \d+, \d+"/>
|
||||||
<error regexp="line \d+:\d+: mismatched input '[^']+'. Expecting:"/>
|
|
||||||
</dbms>
|
</dbms>
|
||||||
|
|
||||||
<dbms value="Altibase">
|
<dbms value="Altibase">
|
||||||
|
|||||||
@@ -357,8 +357,8 @@
|
|||||||
<blind query="SELECT tbl_name FROM sqlite_master WHERE type='table' LIMIT %d,1" count="SELECT COUNT(tbl_name) FROM sqlite_master WHERE type='table'"/>
|
<blind query="SELECT tbl_name FROM sqlite_master WHERE type='table' LIMIT %d,1" count="SELECT COUNT(tbl_name) FROM sqlite_master WHERE type='table'"/>
|
||||||
</tables>
|
</tables>
|
||||||
<columns>
|
<columns>
|
||||||
<inband query="SELECT MAX(sql) FROM sqlite_master WHERE type='table' AND tbl_name='%s'"/>
|
<inband query="SELECT MAX(sql) FROM sqlite_master WHERE tbl_name='%s'"/>
|
||||||
<blind query="SELECT sql FROM sqlite_master WHERE type='table' AND tbl_name='%s' LIMIT 1" condition=""/>
|
<blind query="SELECT sql FROM sqlite_master WHERE tbl_name='%s' LIMIT 1" condition=""/>
|
||||||
</columns>
|
</columns>
|
||||||
<dump_table>
|
<dump_table>
|
||||||
<inband query="SELECT %s FROM %s"/>
|
<inband query="SELECT %s FROM %s"/>
|
||||||
|
|||||||
@@ -7,10 +7,10 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
برنامه `sqlmap`، یک برنامهی تست نفوذ منبع باز است که فرآیند تشخیص و اکسپلویت پایگاه های داده با مشکل امنیتی SQL Injection را بطور خودکار انجام می دهد. این برنامه مجهز به موتور تشخیص قدرتمندی میباشد. همچنین داری طیف گستردهای از اسکریپت ها میباشد که برای متخصصان تست نفوذ کار کردن با بانک اطلاعاتی را راحتر میکند. از جمع اوری اطلاعات درباره بانک داده تا دسترسی به داده های سیستم و اجرا دستورات از طریق ارتباط Out Of Band درسیستم عامل را امکان پذیر میکند.
|
برنامه `sqlmap`، برنامهی منبع باز هست که برای تست نفوذ پذیزی دربرابر حملههای احتمالی `sql injection` (جلوگیری از لو رفتن پایگاه داده) جلو گیری میکند. این برنامه مجهز به مکانیزیم تشخیص قدرتمندی میباشد. همچنین داری طیف گستردهای از اسکریپت ها میباشد که برای متخصص تست نفوذ کار کردن با بانک اطلاعاتی را راحتر میکند. از جمع اوری اطلاعات درباره بانک داده تا دسترسی به داده های سیستم و اجرا دستورات از طریق `via out-of-band` درسیستم عامل را امکان پذیر میکند.
|
||||||
|
|
||||||
|
|
||||||
تصویر محیط ابزار
|
عکس
|
||||||
----
|
----
|
||||||
|
|
||||||
|
|
||||||
@@ -23,7 +23,7 @@
|
|||||||
|
|
||||||
<div dir=rtl>
|
<div dir=rtl>
|
||||||
|
|
||||||
برای نمایش [مجموعه ای از اسکریپتها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) میتوانید از دانشنامه دیدن کنید.
|
برای دیدن کردن از [مجموعهی از اسکریپتها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) میتوانید از ویکی دیدن کنید.
|
||||||
|
|
||||||
|
|
||||||
نصب
|
نصب
|
||||||
@@ -32,11 +32,11 @@
|
|||||||
برای دانلود اخرین نسخه tarball، با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام دهید.
|
برای دانلود اخرین نسخه tarball، با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام دهید.
|
||||||
|
|
||||||
|
|
||||||
نحوه استفاده
|
طرز استفاده
|
||||||
----
|
----
|
||||||
|
|
||||||
|
|
||||||
برای دریافت لیست ارگومانهای اساسی میتوانید از دستور زیر استفاده کنید:
|
برای گرفتن لیست ارگومانهای اساسی میتوانید از دستور زیر استفاده کنید:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -53,7 +53,7 @@
|
|||||||
<div dir=rtl>
|
<div dir=rtl>
|
||||||
|
|
||||||
|
|
||||||
برای دریافت لیست تمامی ارگومانها میتوانید از دستور زیر استفاده کنید:
|
برای گرفتن لیست تمامی ارگومانهای میتوانید از دستور زیر استفاده کنید:
|
||||||
|
|
||||||
<div dir=ltr>
|
<div dir=ltr>
|
||||||
|
|
||||||
@@ -66,7 +66,7 @@
|
|||||||
<div dir=rtl>
|
<div dir=rtl>
|
||||||
|
|
||||||
|
|
||||||
برای اجرای سریع و ساده ابزار می توانید از [اینجا](https://asciinema.org/a/46601) استفاده کنید. برای دریافت اطلاعات بیشتر در رابطه با قابلیت ها ، امکانات قابل پشتیبانی و لیست کامل امکانات و دستورات همراه با مثال می توانید به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید.
|
برای اطلاعات بیشتر برای اجرا از [اینجا](https://asciinema.org/a/46601) میتوانید استفاده کنید. برای گرفتن اطلاعات بیشتر توسعه میشود به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید.
|
||||||
|
|
||||||
|
|
||||||
لینکها
|
لینکها
|
||||||
@@ -74,11 +74,11 @@
|
|||||||
|
|
||||||
|
|
||||||
* خانه: https://sqlmap.org
|
* خانه: https://sqlmap.org
|
||||||
* دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) یا [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
* دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
||||||
* نظرات: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
* کایمت و نظرات: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
||||||
* پیگیری مشکلات: https://github.com/sqlmapproject/sqlmap/issues
|
* پیگری مشکلات: https://github.com/sqlmapproject/sqlmap/issues
|
||||||
* راهنمای کاربران: https://github.com/sqlmapproject/sqlmap/wiki
|
* راهنمای کاربران: https://github.com/sqlmapproject/sqlmap/wiki
|
||||||
* سوالات متداول: https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
* سوالات متداول: https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
||||||
* توییتر: [@sqlmap](https://twitter.com/sqlmap)
|
* تویتر: [@sqlmap](https://twitter.com/sqlmap)
|
||||||
* رسانه: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos)
|
* رسانه: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos)
|
||||||
* تصاویر: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
* عکسها: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
||||||
|
|||||||
@@ -1,49 +0,0 @@
|
|||||||
# sqlmap 
|
|
||||||
|
|
||||||
[](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [](https://www.python.org/) [](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [](https://twitter.com/sqlmap)
|
|
||||||
|
|
||||||
sqlmap არის შეღწევადობის ტესტირებისათვის განკუთვილი ინსტრუმენტი, რომლის კოდიც ღიად არის ხელმისაწვდომი. ინსტრუმენტი ახდენს SQL-ინექციის სისუსტეების აღმოჩენისა, გამოყენების და მონაცემთა ბაზათა სერვერების დაუფლების პროცესების ავტომატიზაციას. იგი აღჭურვილია მძლავრი აღმომჩენი მექანიძმით, შეღწევადობის პროფესიონალი ტესტერისათვის შესაფერისი ბევრი ფუნქციით და სკრიპტების ფართო სპექტრით, რომლებიც შეიძლება გამოყენებულ იქნეს მრავალი მიზნით, მათ შორის: მონაცემთა ბაზიდან მონაცემების შეგროვებისათვის, ძირითად საფაილო სისტემაზე წვდომისათვის და out-of-band კავშირების გზით ოპერაციულ სისტემაში ბრძანებათა შესრულებისათვის.
|
|
||||||
|
|
||||||
ეკრანის ანაბეჭდები
|
|
||||||
----
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
შეგიძლიათ ესტუმროთ [ეკრანის ანაბეჭდთა კოლექციას](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), სადაც დემონსტრირებულია ინსტრუმენტის ზოგიერთი ფუნქცია.
|
|
||||||
|
|
||||||
ინსტალაცია
|
|
||||||
----
|
|
||||||
|
|
||||||
თქვენ შეგიძლიათ უახლესი tar-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/tarball/master) დაწკაპუნებით, ან უახლესი zip-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/zipball/master) დაწკაპუნებით.
|
|
||||||
|
|
||||||
ასევე შეგიძლიათ (და სასურველია) sqlmap-ის ჩამოტვირთვა [Git](https://github.com/sqlmapproject/sqlmap)-საცავის (repository) კლონირებით:
|
|
||||||
|
|
||||||
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
|
|
||||||
|
|
||||||
sqlmap ნებისმიერ პლატფორმაზე მუშაობს [Python](https://www.python.org/download/)-ის **2.6**, **2.7** და **3.x** ვერსიებთან.
|
|
||||||
|
|
||||||
გამოყენება
|
|
||||||
----
|
|
||||||
|
|
||||||
ძირითადი ვარიანტებისა და პარამეტრების ჩამონათვალის მისაღებად გამოიყენეთ ბრძანება:
|
|
||||||
|
|
||||||
python sqlmap.py -h
|
|
||||||
|
|
||||||
ვარიანტებისა და პარამეტრების სრული ჩამონათვალის მისაღებად გამოიყენეთ ბრძანება:
|
|
||||||
|
|
||||||
python sqlmap.py -hh
|
|
||||||
|
|
||||||
გამოყენების მარტივი მაგალითი შეგიძლიათ იხილოთ [აქ](https://asciinema.org/a/46601). sqlmap-ის შესაძლებლობათა მიმოხილვის, მხარდაჭერილი ფუნქციონალისა და ყველა ვარიანტის აღწერების მისაღებად გამოყენების მაგალითებთან ერთად, გირჩევთ, იხილოთ [მომხმარებლის სახელმძღვანელო](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
|
|
||||||
|
|
||||||
ბმულები
|
|
||||||
----
|
|
||||||
|
|
||||||
* საწყისი გვერდი: https://sqlmap.org
|
|
||||||
* ჩამოტვირთვა: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ან [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
|
|
||||||
* RSS არხი: https://github.com/sqlmapproject/sqlmap/commits/master.atom
|
|
||||||
* პრობლემებისათვის თვალყურის დევნება: https://github.com/sqlmapproject/sqlmap/issues
|
|
||||||
* მომხმარებლის სახელმძღვანელო: https://github.com/sqlmapproject/sqlmap/wiki
|
|
||||||
* ხშირად დასმული კითხვები (ხდკ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
|
|
||||||
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
|
|
||||||
* დემონსტრაციები: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos)
|
|
||||||
* ეკრანის ანაბეჭდები: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
|
|
||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -3,7 +3,7 @@
|
|||||||
"""
|
"""
|
||||||
beep.py - Make a beep sound
|
beep.py - Make a beep sound
|
||||||
|
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
"""
|
"""
|
||||||
cloak.py - Simple file encryption/compression utility
|
cloak.py - Simple file encryption/compression utility
|
||||||
|
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
"""
|
"""
|
||||||
dbgtool.py - Portable executable to ASCII debug script converter
|
dbgtool.py - Portable executable to ASCII debug script converter
|
||||||
|
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Removes trailing spaces from blank lines inside project files
|
# Removes trailing spaces from blank lines inside project files
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Stress test against Python3
|
# Stress test against Python3
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Removes duplicate entries in wordlist like files
|
# Removes duplicate entries in wordlist like files
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null
|
find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# sudo pip install modernize
|
# sudo pip install modernize
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
|
# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle)
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Runs py3diatra on all python files (prerequisite: pip install pydiatra)
|
# Runs py3diatra on all python files (prerequisite: pip install pydiatra)
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
|
# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes)
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
# Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
# See the file 'LICENSE' for copying permission
|
# See the file 'LICENSE' for copying permission
|
||||||
|
|
||||||
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pylint --rcfile=./.pylintrc '{}' \;
|
find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pylint --rcfile=./.pylintrc '{}' \;
|
||||||
|
|||||||
@@ -16,7 +16,7 @@ cat > $TMP_DIR/setup.py << EOF
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -67,7 +67,7 @@ cat > sqlmap/__init__.py << EOF
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
"""
|
"""
|
||||||
vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
|
vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
|
||||||
|
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -44,8 +44,7 @@ SCHEMA = """
|
|||||||
CREATE TABLE users (
|
CREATE TABLE users (
|
||||||
id INTEGER,
|
id INTEGER,
|
||||||
name TEXT,
|
name TEXT,
|
||||||
surname TEXT,
|
surname TEXT
|
||||||
PRIMARY KEY (id)
|
|
||||||
);
|
);
|
||||||
INSERT INTO users (id, name, surname) VALUES (1, 'luther', 'blisset');
|
INSERT INTO users (id, name, surname) VALUES (1, 'luther', 'blisset');
|
||||||
INSERT INTO users (id, name, surname) VALUES (2, 'fluffy', 'bunny');
|
INSERT INTO users (id, name, surname) VALUES (2, 'fluffy', 'bunny');
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+39
-24
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -10,6 +10,7 @@ import logging
|
|||||||
import random
|
import random
|
||||||
import re
|
import re
|
||||||
import socket
|
import socket
|
||||||
|
import subprocess
|
||||||
import time
|
import time
|
||||||
|
|
||||||
from extra.beep.beep import beep
|
from extra.beep.beep import beep
|
||||||
@@ -270,18 +271,15 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
elif kb.dbmsFilter and not intersect(payloadDbms, kb.dbmsFilter, True):
|
if kb.dbmsFilter and not intersect(payloadDbms, kb.dbmsFilter, True):
|
||||||
debugMsg = "skipping test '%s' because " % title
|
debugMsg = "skipping test '%s' because " % title
|
||||||
debugMsg += "its declared DBMS is different than provided"
|
debugMsg += "its declared DBMS is different than provided"
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
continue
|
continue
|
||||||
|
|
||||||
elif kb.reduceTests == False:
|
|
||||||
pass
|
|
||||||
|
|
||||||
# Skip DBMS-specific test if it does not match the
|
# Skip DBMS-specific test if it does not match the
|
||||||
# previously identified DBMS (via DBMS-specific payload)
|
# previously identified DBMS (via DBMS-specific payload)
|
||||||
elif injection.dbms and not intersect(payloadDbms, injection.dbms, True):
|
if injection.dbms and not intersect(payloadDbms, injection.dbms, True):
|
||||||
debugMsg = "skipping test '%s' because " % title
|
debugMsg = "skipping test '%s' because " % title
|
||||||
debugMsg += "its declared DBMS is different than identified"
|
debugMsg += "its declared DBMS is different than identified"
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
@@ -289,7 +287,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
|
|
||||||
# Skip DBMS-specific test if it does not match the
|
# Skip DBMS-specific test if it does not match the
|
||||||
# previously identified DBMS (via DBMS-specific error message)
|
# previously identified DBMS (via DBMS-specific error message)
|
||||||
elif kb.reduceTests and not intersect(payloadDbms, kb.reduceTests, True):
|
if kb.reduceTests and not intersect(payloadDbms, kb.reduceTests, True):
|
||||||
debugMsg = "skipping test '%s' because the heuristic " % title
|
debugMsg = "skipping test '%s' because the heuristic " % title
|
||||||
debugMsg += "tests showed that the back-end DBMS "
|
debugMsg += "tests showed that the back-end DBMS "
|
||||||
debugMsg += "could be '%s'" % unArrayizeValue(kb.reduceTests)
|
debugMsg += "could be '%s'" % unArrayizeValue(kb.reduceTests)
|
||||||
@@ -782,8 +780,22 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
injection.conf.regexp = conf.regexp
|
injection.conf.regexp = conf.regexp
|
||||||
injection.conf.optimize = conf.optimize
|
injection.conf.optimize = conf.optimize
|
||||||
|
|
||||||
if conf.beep:
|
if not kb.alerted:
|
||||||
beep()
|
if conf.beep:
|
||||||
|
beep()
|
||||||
|
|
||||||
|
if conf.alert:
|
||||||
|
infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
try:
|
||||||
|
process = subprocess.Popen(conf.alert, shell=True)
|
||||||
|
process.wait()
|
||||||
|
except Exception as ex:
|
||||||
|
errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex))
|
||||||
|
logger.error(errMsg)
|
||||||
|
|
||||||
|
kb.alerted = True
|
||||||
|
|
||||||
# There is no need to perform this test for other
|
# There is no need to perform this test for other
|
||||||
# <where> tags
|
# <where> tags
|
||||||
@@ -798,7 +810,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
|
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
warnMsg = "user aborted during detection phase"
|
warnMsg = "user aborted during detection phase"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.multipleTargets:
|
if conf.multipleTargets:
|
||||||
msg = "how do you want to proceed? [ne(X)t target/(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]"
|
msg = "how do you want to proceed? [ne(X)t target/(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]"
|
||||||
@@ -814,7 +826,7 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
choice = None
|
choice = None
|
||||||
while not ((choice or "").isdigit() and 0 <= int(choice) <= 6):
|
while not ((choice or "").isdigit() and 0 <= int(choice) <= 6):
|
||||||
if choice:
|
if choice:
|
||||||
logger.warning("invalid value")
|
logger.warn("invalid value")
|
||||||
msg = "enter new verbosity level: [0-6] "
|
msg = "enter new verbosity level: [0-6] "
|
||||||
choice = readInput(msg, default=str(conf.verbose), checkBatch=False)
|
choice = readInput(msg, default=str(conf.verbose), checkBatch=False)
|
||||||
conf.verbose = int(choice)
|
conf.verbose = int(choice)
|
||||||
@@ -839,13 +851,15 @@ def checkSqlInjection(place, parameter, value):
|
|||||||
warnMsg = "in OR boolean-based injection cases, please consider usage "
|
warnMsg = "in OR boolean-based injection cases, please consider usage "
|
||||||
warnMsg += "of switch '--drop-set-cookie' if you experience any "
|
warnMsg += "of switch '--drop-set-cookie' if you experience any "
|
||||||
warnMsg += "problems during data retrieval"
|
warnMsg += "problems during data retrieval"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if not checkFalsePositives(injection):
|
if not checkFalsePositives(injection):
|
||||||
if conf.hostname in kb.vulnHosts:
|
if conf.hostname in kb.vulnHosts:
|
||||||
kb.vulnHosts.remove(conf.hostname)
|
kb.vulnHosts.remove(conf.hostname)
|
||||||
|
|
||||||
if NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE not in injection.notes:
|
if NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE not in injection.notes:
|
||||||
injection.notes.append(NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE)
|
injection.notes.append(NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE)
|
||||||
|
|
||||||
else:
|
else:
|
||||||
injection = None
|
injection = None
|
||||||
|
|
||||||
@@ -962,7 +976,7 @@ def checkFalsePositives(injection):
|
|||||||
|
|
||||||
if not retVal:
|
if not retVal:
|
||||||
warnMsg = "false positive or unexploitable injection point detected"
|
warnMsg = "false positive or unexploitable injection point detected"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -988,7 +1002,7 @@ def checkSuhosinPatch(injection):
|
|||||||
warnMsg = "parameter length constraining "
|
warnMsg = "parameter length constraining "
|
||||||
warnMsg += "mechanism detected (e.g. Suhosin patch). "
|
warnMsg += "mechanism detected (e.g. Suhosin patch). "
|
||||||
warnMsg += "Potential problems in enumeration phase can be expected"
|
warnMsg += "Potential problems in enumeration phase can be expected"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -1009,7 +1023,7 @@ def checkFilteredChars(injection):
|
|||||||
warnMsg += "filtered by the back-end server. There is a strong "
|
warnMsg += "filtered by the back-end server. There is a strong "
|
||||||
warnMsg += "possibility that sqlmap won't be able to properly "
|
warnMsg += "possibility that sqlmap won't be able to properly "
|
||||||
warnMsg += "exploit this vulnerability"
|
warnMsg += "exploit this vulnerability"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
# inference techniques depend on character '>'
|
# inference techniques depend on character '>'
|
||||||
if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
|
if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
|
||||||
@@ -1017,7 +1031,7 @@ def checkFilteredChars(injection):
|
|||||||
warnMsg = "it appears that the character '>' is "
|
warnMsg = "it appears that the character '>' is "
|
||||||
warnMsg += "filtered by the back-end server. You are strongly "
|
warnMsg += "filtered by the back-end server. You are strongly "
|
||||||
warnMsg += "advised to rerun with the '--tamper=between'"
|
warnMsg += "advised to rerun with the '--tamper=between'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
kb.injection = popValue()
|
kb.injection = popValue()
|
||||||
|
|
||||||
@@ -1108,7 +1122,7 @@ def heuristicCheckSqlInjection(place, parameter):
|
|||||||
|
|
||||||
else:
|
else:
|
||||||
infoMsg += "not be injectable"
|
infoMsg += "not be injectable"
|
||||||
logger.warning(infoMsg)
|
logger.warn(infoMsg)
|
||||||
|
|
||||||
kb.heuristicMode = True
|
kb.heuristicMode = True
|
||||||
kb.disableHtmlDecoding = True
|
kb.disableHtmlDecoding = True
|
||||||
@@ -1216,7 +1230,7 @@ def checkDynamicContent(firstPage, secondPage):
|
|||||||
if count > conf.retries:
|
if count > conf.retries:
|
||||||
warnMsg = "target URL content appears to be too dynamic. "
|
warnMsg = "target URL content appears to be too dynamic. "
|
||||||
warnMsg += "Switching to '--text-only' "
|
warnMsg += "Switching to '--text-only' "
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.textOnly = True
|
conf.textOnly = True
|
||||||
return
|
return
|
||||||
@@ -1274,7 +1288,7 @@ def checkStability():
|
|||||||
warnMsg += "injectable parameters are detected, or in case of "
|
warnMsg += "injectable parameters are detected, or in case of "
|
||||||
warnMsg += "junk results, refer to user's manual paragraph "
|
warnMsg += "junk results, refer to user's manual paragraph "
|
||||||
warnMsg += "'Page comparison'"
|
warnMsg += "'Page comparison'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] "
|
message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] "
|
||||||
choice = readInput(message, default='C').upper()
|
choice = readInput(message, default='C').upper()
|
||||||
@@ -1353,10 +1367,11 @@ def checkWaf():
|
|||||||
retVal = False
|
retVal = False
|
||||||
payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD)
|
payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD)
|
||||||
|
|
||||||
place = PLACE.GET
|
|
||||||
if PLACE.URI in conf.parameters:
|
if PLACE.URI in conf.parameters:
|
||||||
|
place = PLACE.POST
|
||||||
value = "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
value = "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
||||||
else:
|
else:
|
||||||
|
place = PLACE.GET
|
||||||
value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER
|
value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER
|
||||||
value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload))
|
||||||
|
|
||||||
@@ -1499,7 +1514,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
warnMsg = "you provided '%s' as the string to " % conf.string
|
warnMsg = "you provided '%s' as the string to " % conf.string
|
||||||
warnMsg += "match, but such a string is not within the target "
|
warnMsg += "match, but such a string is not within the target "
|
||||||
warnMsg += "URL raw response, sqlmap will carry on anyway"
|
warnMsg += "URL raw response, sqlmap will carry on anyway"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.regexp:
|
if conf.regexp:
|
||||||
infoMsg = "testing if the provided regular expression matches within "
|
infoMsg = "testing if the provided regular expression matches within "
|
||||||
@@ -1510,7 +1525,7 @@ def checkConnection(suppressOutput=False):
|
|||||||
warnMsg = "you provided '%s' as the regular expression " % conf.regexp
|
warnMsg = "you provided '%s' as the regular expression " % conf.regexp
|
||||||
warnMsg += "which does not have any match within the target URL raw response. sqlmap "
|
warnMsg += "which does not have any match within the target URL raw response. sqlmap "
|
||||||
warnMsg += "will carry on anyway"
|
warnMsg += "will carry on anyway"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
kb.errorIsNone = False
|
kb.errorIsNone = False
|
||||||
|
|
||||||
@@ -1525,12 +1540,12 @@ def checkConnection(suppressOutput=False):
|
|||||||
elif wasLastResponseDBMSError():
|
elif wasLastResponseDBMSError():
|
||||||
warnMsg = "there is a DBMS error found in the HTTP response body "
|
warnMsg = "there is a DBMS error found in the HTTP response body "
|
||||||
warnMsg += "which could interfere with the results of the tests"
|
warnMsg += "which could interfere with the results of the tests"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
elif wasLastResponseHTTPError():
|
elif wasLastResponseHTTPError():
|
||||||
if getLastRequestHTTPError() not in (conf.ignoreCode or []):
|
if getLastRequestHTTPError() not in (conf.ignoreCode or []):
|
||||||
warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError()
|
warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError()
|
||||||
warnMsg += "which could interfere with the results of the tests"
|
warnMsg += "which could interfere with the results of the tests"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
else:
|
else:
|
||||||
kb.errorIsNone = True
|
kb.errorIsNone = True
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -9,7 +9,6 @@ from __future__ import division
|
|||||||
|
|
||||||
import os
|
import os
|
||||||
import re
|
import re
|
||||||
import subprocess
|
|
||||||
import time
|
import time
|
||||||
|
|
||||||
from lib.controller.action import action
|
from lib.controller.action import action
|
||||||
@@ -187,12 +186,12 @@ def _showInjections():
|
|||||||
if conf.tamper:
|
if conf.tamper:
|
||||||
warnMsg = "changes made by tampering scripts are not "
|
warnMsg = "changes made by tampering scripts are not "
|
||||||
warnMsg += "included in shown payload content(s)"
|
warnMsg += "included in shown payload content(s)"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.hpp:
|
if conf.hpp:
|
||||||
warnMsg = "changes made by HTTP parameter pollution are not "
|
warnMsg = "changes made by HTTP parameter pollution are not "
|
||||||
warnMsg += "included in shown payload content(s)"
|
warnMsg += "included in shown payload content(s)"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def _randomFillBlankFields(value):
|
def _randomFillBlankFields(value):
|
||||||
retVal = value
|
retVal = value
|
||||||
@@ -557,7 +556,7 @@ def start():
|
|||||||
|
|
||||||
if not check:
|
if not check:
|
||||||
warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.skipStatic:
|
if conf.skipStatic:
|
||||||
infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
@@ -599,19 +598,6 @@ def start():
|
|||||||
|
|
||||||
kb.injections.append(injection)
|
kb.injections.append(injection)
|
||||||
|
|
||||||
if not kb.alerted:
|
|
||||||
if conf.alert:
|
|
||||||
infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert
|
|
||||||
logger.info(infoMsg)
|
|
||||||
try:
|
|
||||||
process = subprocess.Popen(conf.alert, shell=True)
|
|
||||||
process.wait()
|
|
||||||
except Exception as ex:
|
|
||||||
errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex))
|
|
||||||
logger.error(errMsg)
|
|
||||||
|
|
||||||
kb.alerted = True
|
|
||||||
|
|
||||||
# In case when user wants to end detection phase (Ctrl+C)
|
# In case when user wants to end detection phase (Ctrl+C)
|
||||||
if not proceed:
|
if not proceed:
|
||||||
break
|
break
|
||||||
@@ -626,7 +612,7 @@ def start():
|
|||||||
|
|
||||||
if not injectable:
|
if not injectable:
|
||||||
warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter)
|
warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
finally:
|
finally:
|
||||||
if place == PLACE.COOKIE:
|
if place == PLACE.COOKIE:
|
||||||
@@ -723,7 +709,7 @@ def start():
|
|||||||
|
|
||||||
if conf.multipleTargets:
|
if conf.multipleTargets:
|
||||||
warnMsg = "user aborted in multiple target mode"
|
warnMsg = "user aborted in multiple target mode"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
message = "do you want to skip to the next target in list? [Y/n/q]"
|
message = "do you want to skip to the next target in list? [Y/n/q]"
|
||||||
choice = readInput(message, default='Y').upper()
|
choice = readInput(message, default='Y').upper()
|
||||||
@@ -763,7 +749,7 @@ def start():
|
|||||||
warnMsg = "it appears that the target "
|
warnMsg = "it appears that the target "
|
||||||
warnMsg += "has a maximum connections "
|
warnMsg += "has a maximum connections "
|
||||||
warnMsg += "constraint"
|
warnMsg += "constraint"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if kb.dataOutputFlag and not conf.multipleTargets:
|
if kb.dataOutputFlag and not conf.multipleTargets:
|
||||||
logger.info("fetched data logged to text files under '%s'" % conf.outputPath)
|
logger.info("fetched data logged to text files under '%s'" % conf.outputPath)
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+7
-10
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -134,7 +134,7 @@ class Agent(object):
|
|||||||
origValue = extractRegexResult(r"%s\s*:\s*(?P<result>\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P<result>[^%s]*)\Z" % quote, origValue)
|
origValue = extractRegexResult(r"%s\s*:\s*(?P<result>\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P<result>[^%s]*)\Z" % quote, origValue)
|
||||||
else:
|
else:
|
||||||
_ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
|
_ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
|
||||||
origValue = _.split('=', 1)[1] if '=' in _ else _
|
origValue = _.split('=', 1)[1] if '=' in _ else ""
|
||||||
elif place == PLACE.CUSTOM_HEADER:
|
elif place == PLACE.CUSTOM_HEADER:
|
||||||
paramString = origValue
|
paramString = origValue
|
||||||
origValue = origValue[origValue.find(',') + 1:]
|
origValue = origValue[origValue.find(',') + 1:]
|
||||||
@@ -196,9 +196,9 @@ class Agent(object):
|
|||||||
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
|
||||||
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
_ = "%s%s" % (origValue, kb.customInjectionMark)
|
||||||
|
|
||||||
if kb.postHint == POST_HINT.JSON and isNumber(origValue) and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
|
||||||
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
newValue = '"%s"' % self.addPayloadDelimiters(newValue)
|
||||||
elif kb.postHint == POST_HINT.JSON_LIKE and isNumber(origValue) and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
|
elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
|
||||||
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
newValue = "'%s'" % self.addPayloadDelimiters(newValue)
|
||||||
else:
|
else:
|
||||||
newValue = self.addPayloadDelimiters(newValue)
|
newValue = self.addPayloadDelimiters(newValue)
|
||||||
@@ -489,7 +489,7 @@ class Agent(object):
|
|||||||
if field and Backend.getIdentifiedDbms():
|
if field and Backend.getIdentifiedDbms():
|
||||||
rootQuery = queries[Backend.getIdentifiedDbms()]
|
rootQuery = queries[Backend.getIdentifiedDbms()]
|
||||||
|
|
||||||
if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast and not (field.startswith("COUNT(") and getTechnique() in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION) and Backend.getIdentifiedDbms() == DBMS.MSSQL):
|
if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast:
|
||||||
nulledCastedField = field
|
nulledCastedField = field
|
||||||
else:
|
else:
|
||||||
if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')):
|
if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')):
|
||||||
@@ -581,7 +581,7 @@ class Agent(object):
|
|||||||
"""
|
"""
|
||||||
|
|
||||||
prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT(?: \d+)?)\s+\d+)*"
|
prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT(?: \d+)?)\s+\d+)*"
|
||||||
fieldsSelectTop = re.search(r"\ASELECT\s+TOP(\s+\d+|\s*\([^)]+\))\s+(.+?)\s+FROM", query, re.I)
|
fieldsSelectTop = re.search(r"\ASELECT\s+TOP(\s+[\d]|\s*\([^)]+\))\s+(.+?)\s+FROM", query, re.I)
|
||||||
fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I)
|
fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I)
|
||||||
fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I)
|
fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I)
|
||||||
fieldsSelectCase = re.search(r"\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I)
|
fieldsSelectCase = re.search(r"\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I)
|
||||||
@@ -596,9 +596,6 @@ class Agent(object):
|
|||||||
if not _:
|
if not _:
|
||||||
fieldsSelectFrom = None
|
fieldsSelectFrom = None
|
||||||
|
|
||||||
if re.search(r"\bWHERE\b.+(MIN|MAX)", query, re.I):
|
|
||||||
fieldsMinMaxstr = None
|
|
||||||
|
|
||||||
fieldsToCastStr = fieldsNoSelect
|
fieldsToCastStr = fieldsNoSelect
|
||||||
|
|
||||||
if fieldsSubstr:
|
if fieldsSubstr:
|
||||||
@@ -732,7 +729,7 @@ class Agent(object):
|
|||||||
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1)
|
concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1)
|
||||||
concatenatedQuery += "+'%s'" % kb.chars.stop
|
concatenatedQuery += "+'%s'" % kb.chars.stop
|
||||||
elif fieldsSelectTop:
|
elif fieldsSelectTop:
|
||||||
topNum = re.search(r"\ASELECT\s+TOP(\s+\d+|\s*\([^)]+\))\s+", concatenatedQuery, re.I).group(1)
|
topNum = re.search(r"\ASELECT\s+TOP(\s+[\d]|\s*\([^)]+\))\s+", concatenatedQuery, re.I).group(1)
|
||||||
concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, "TOP%s '%s'+" % (topNum, kb.chars.start), 1)
|
concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, "TOP%s '%s'+" % (topNum, kb.chars.start), 1)
|
||||||
concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1)
|
concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1)
|
||||||
elif fieldsSelectCase:
|
elif fieldsSelectCase:
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+34
-58
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -351,7 +351,7 @@ class Backend(object):
|
|||||||
elif kb.dbms is not None and kb.dbms != dbms:
|
elif kb.dbms is not None and kb.dbms != dbms:
|
||||||
warnMsg = "there appears to be a high probability that "
|
warnMsg = "there appears to be a high probability that "
|
||||||
warnMsg += "this could be a false positive case"
|
warnMsg += "this could be a false positive case"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
msg = "sqlmap previously fingerprinted back-end DBMS as "
|
msg = "sqlmap previously fingerprinted back-end DBMS as "
|
||||||
msg += "%s. However now it has been fingerprinted " % kb.dbms
|
msg += "%s. However now it has been fingerprinted " % kb.dbms
|
||||||
@@ -371,7 +371,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value"
|
warnMsg = "invalid value"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
elif kb.dbms is None:
|
elif kb.dbms is None:
|
||||||
kb.dbms = aliasToDbmsEnum(dbms)
|
kb.dbms = aliasToDbmsEnum(dbms)
|
||||||
@@ -429,7 +429,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value"
|
warnMsg = "invalid value"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
elif kb.os is None and isinstance(os, six.string_types):
|
elif kb.os is None and isinstance(os, six.string_types):
|
||||||
kb.os = os.capitalize()
|
kb.os = os.capitalize()
|
||||||
@@ -466,7 +466,7 @@ class Backend(object):
|
|||||||
break
|
break
|
||||||
else:
|
else:
|
||||||
warnMsg = "invalid value. Valid values are 1 and 2"
|
warnMsg = "invalid value. Valid values are 1 and 2"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
return kb.arch
|
return kb.arch
|
||||||
|
|
||||||
@@ -590,7 +590,7 @@ class Backend(object):
|
|||||||
def isVersionGreaterOrEqualThan(version):
|
def isVersionGreaterOrEqualThan(version):
|
||||||
retVal = False
|
retVal = False
|
||||||
|
|
||||||
if all(_ not in (None, UNKNOWN_DBMS_VERSION) for _ in (Backend.getVersion(), version)):
|
if Backend.getVersion() is not None and version is not None:
|
||||||
_version = unArrayizeValue(Backend.getVersion())
|
_version = unArrayizeValue(Backend.getVersion())
|
||||||
_version = re.sub(r"[<>= ]", "", _version)
|
_version = re.sub(r"[<>= ]", "", _version)
|
||||||
|
|
||||||
@@ -663,7 +663,7 @@ def paramToDict(place, parameters=None):
|
|||||||
warnMsg += "chars/statements from manual SQL injection test(s). "
|
warnMsg += "chars/statements from manual SQL injection test(s). "
|
||||||
warnMsg += "Please, always use only valid parameter values "
|
warnMsg += "Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "
|
message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "
|
||||||
|
|
||||||
@@ -673,7 +673,7 @@ def paramToDict(place, parameters=None):
|
|||||||
warnMsg = "provided value for parameter '%s' is empty. " % parameter
|
warnMsg = "provided value for parameter '%s' is empty. " % parameter
|
||||||
warnMsg += "Please, always use only valid parameter values "
|
warnMsg += "Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if place in (PLACE.POST, PLACE.GET):
|
if place in (PLACE.POST, PLACE.GET):
|
||||||
for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"):
|
for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"):
|
||||||
@@ -738,7 +738,7 @@ def paramToDict(place, parameters=None):
|
|||||||
if len(conf.testParameter) > 1:
|
if len(conf.testParameter) > 1:
|
||||||
warnMsg = "provided parameters '%s' " % paramStr
|
warnMsg = "provided parameters '%s' " % paramStr
|
||||||
warnMsg += "are not inside the %s" % place
|
warnMsg += "are not inside the %s" % place
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
else:
|
else:
|
||||||
parameter = conf.testParameter[0]
|
parameter = conf.testParameter[0]
|
||||||
|
|
||||||
@@ -763,7 +763,7 @@ def paramToDict(place, parameters=None):
|
|||||||
if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded):
|
if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded):
|
||||||
warnMsg = "provided parameter '%s' " % parameter
|
warnMsg = "provided parameter '%s' " % parameter
|
||||||
warnMsg += "appears to be '%s' encoded" % encoding
|
warnMsg += "appears to be '%s' encoded" % encoding
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
break
|
break
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
@@ -814,7 +814,7 @@ def getManualDirectories():
|
|||||||
else:
|
else:
|
||||||
warnMsg = "unable to automatically retrieve the web server "
|
warnMsg = "unable to automatically retrieve the web server "
|
||||||
warnMsg += "document root"
|
warnMsg += "document root"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
directories = []
|
directories = []
|
||||||
|
|
||||||
@@ -900,7 +900,7 @@ def getAutoDirectories():
|
|||||||
retVal.add(directory)
|
retVal.add(directory)
|
||||||
else:
|
else:
|
||||||
warnMsg = "unable to automatically parse any web server path"
|
warnMsg = "unable to automatically parse any web server path"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
return list(retVal)
|
return list(retVal)
|
||||||
|
|
||||||
@@ -1034,10 +1034,7 @@ def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=C
|
|||||||
except UnicodeEncodeError:
|
except UnicodeEncodeError:
|
||||||
sys.stdout.write(re.sub(r"[^ -~]", '?', clearColors(data)))
|
sys.stdout.write(re.sub(r"[^ -~]", '?', clearColors(data)))
|
||||||
finally:
|
finally:
|
||||||
try:
|
sys.stdout.flush()
|
||||||
sys.stdout.flush()
|
|
||||||
except IOError:
|
|
||||||
raise SystemExit
|
|
||||||
|
|
||||||
if multiThreadMode:
|
if multiThreadMode:
|
||||||
logging._releaseLock()
|
logging._releaseLock()
|
||||||
@@ -1640,7 +1637,7 @@ def parseTargetDirect():
|
|||||||
if remote:
|
if remote:
|
||||||
warnMsg = "direct connection over the network for "
|
warnMsg = "direct connection over the network for "
|
||||||
warnMsg += "%s DBMS is not supported" % dbmsName
|
warnMsg += "%s DBMS is not supported" % dbmsName
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.hostname = "localhost"
|
conf.hostname = "localhost"
|
||||||
conf.port = 0
|
conf.port = 0
|
||||||
@@ -1822,7 +1819,7 @@ def expandAsteriskForColumns(expression):
|
|||||||
the SQL query string (expression)
|
the SQL query string (expression)
|
||||||
"""
|
"""
|
||||||
|
|
||||||
match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+(([`'\"][^`'\"]+[`'\"]|[\w.]+)+)(\s|\Z)", expression)
|
match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+((`[^`]+`|[^\s]+)+)", expression)
|
||||||
|
|
||||||
if match:
|
if match:
|
||||||
infoMsg = "you did not provide the fields in your query. "
|
infoMsg = "you did not provide the fields in your query. "
|
||||||
@@ -1903,7 +1900,7 @@ def parseUnionPage(page):
|
|||||||
if re.search(r"(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page):
|
if re.search(r"(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page):
|
||||||
if len(page) > LARGE_OUTPUT_THRESHOLD:
|
if len(page) > LARGE_OUTPUT_THRESHOLD:
|
||||||
warnMsg = "large output detected. This might take a while"
|
warnMsg = "large output detected. This might take a while"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
data = BigArray()
|
data = BigArray()
|
||||||
keys = set()
|
keys = set()
|
||||||
@@ -2792,7 +2789,7 @@ def wasLastResponseDelayed():
|
|||||||
if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
|
if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
|
||||||
warnMsg = "time-based standard deviation method used on a model "
|
warnMsg = "time-based standard deviation method used on a model "
|
||||||
warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES
|
warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation
|
lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation
|
||||||
retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit))
|
retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit))
|
||||||
@@ -3402,39 +3399,19 @@ def parseSqliteTableSchema(value):
|
|||||||
>>> kb.data.cachedColumns = {}
|
>>> kb.data.cachedColumns = {}
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);")
|
>>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);")
|
||||||
True
|
True
|
||||||
>>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('id', 'INTEGER'), ('name', 'TEXT'))
|
>>> repr(kb.data.cachedColumns).count(',') == 1
|
||||||
True
|
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE dummy(`foo bar` BIGINT, \\"foo\\" VARCHAR, 'bar' TEXT)");
|
|
||||||
True
|
|
||||||
>>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('foo bar', 'BIGINT'), ('foo', 'VARCHAR'), ('bar', 'TEXT'))
|
|
||||||
True
|
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE suppliers(\\n\\tsupplier_id INTEGER PRIMARY KEY DESC,\\n\\tname TEXT NOT NULL\\n);");
|
|
||||||
True
|
|
||||||
>>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('supplier_id', 'INTEGER'), ('name', 'TEXT'))
|
|
||||||
True
|
|
||||||
>>> parseSqliteTableSchema("CREATE TABLE country_languages (\\n\\tcountry_id INTEGER NOT NULL,\\n\\tlanguage_id INTEGER NOT NULL,\\n\\tPRIMARY KEY (country_id, language_id),\\n\\tFOREIGN KEY (country_id) REFERENCES countries (country_id) ON DELETE CASCADE ON UPDATE NO ACTION,\\tFOREIGN KEY (language_id) REFERENCES languages (language_id) ON DELETE CASCADE ON UPDATE NO ACTION);");
|
|
||||||
True
|
|
||||||
>>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('country_id', 'INTEGER'), ('language_id', 'INTEGER'))
|
|
||||||
True
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
retVal = False
|
retVal = False
|
||||||
|
|
||||||
value = extractRegexResult(r"(?s)\((?P<result>.+)\)", value)
|
|
||||||
|
|
||||||
if value:
|
if value:
|
||||||
table = {}
|
table = {}
|
||||||
columns = OrderedDict()
|
columns = {}
|
||||||
|
|
||||||
value = re.sub(r"\(.+?\)", "", value).strip()
|
for match in re.finditer(r"[(,]\s*[\"'`]?(\w+)[\"'`]?(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I):
|
||||||
|
|
||||||
for match in re.finditer(r"(?:\A|,)\s*(([\"'`]).+?\2|\w+)(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I):
|
|
||||||
column = match.group(1).strip(match.group(2) or "")
|
|
||||||
if re.search(r"(?i)\A(CONSTRAINT|PRIMARY|UNIQUE|CHECK|FOREIGN)\b", column.strip()):
|
|
||||||
continue
|
|
||||||
retVal = True
|
retVal = True
|
||||||
|
columns[match.group(1)] = match.group(2) or "TEXT"
|
||||||
columns[column] = match.group(3) or "TEXT"
|
|
||||||
|
|
||||||
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
|
||||||
kb.data.cachedColumns[conf.db] = table
|
kb.data.cachedColumns[conf.db] = table
|
||||||
@@ -3616,7 +3593,7 @@ def initTechnique(technique=None):
|
|||||||
else:
|
else:
|
||||||
warnMsg = "there is no injection data available for technique "
|
warnMsg = "there is no injection data available for technique "
|
||||||
warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique)
|
warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
except SqlmapDataException:
|
except SqlmapDataException:
|
||||||
errMsg = "missing data in old session file(s). "
|
errMsg = "missing data in old session file(s). "
|
||||||
@@ -3731,7 +3708,7 @@ def getSortedInjectionTests():
|
|||||||
if test.stype == PAYLOAD.TECHNIQUE.UNION:
|
if test.stype == PAYLOAD.TECHNIQUE.UNION:
|
||||||
retVal = SORT_ORDER.LAST
|
retVal = SORT_ORDER.LAST
|
||||||
|
|
||||||
elif "details" in test and "dbms" in (test.details or {}):
|
elif "details" in test and "dbms" in test.details:
|
||||||
if intersect(test.details.dbms, Backend.getIdentifiedDbms()):
|
if intersect(test.details.dbms, Backend.getIdentifiedDbms()):
|
||||||
retVal = SORT_ORDER.SECOND
|
retVal = SORT_ORDER.SECOND
|
||||||
else:
|
else:
|
||||||
@@ -3767,7 +3744,7 @@ def showHttpErrorCodes():
|
|||||||
if kb.httpErrorCodes:
|
if kb.httpErrorCodes:
|
||||||
warnMsg = "HTTP error codes detected during run:\n"
|
warnMsg = "HTTP error codes detected during run:\n"
|
||||||
warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items())
|
warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items())
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes):
|
if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes):
|
||||||
msg = "too many 4xx and/or 5xx HTTP error codes "
|
msg = "too many 4xx and/or 5xx HTTP error codes "
|
||||||
msg += "could mean that some kind of protection is involved (e.g. WAF)"
|
msg += "could mean that some kind of protection is involved (e.g. WAF)"
|
||||||
@@ -3995,7 +3972,7 @@ def createGithubIssue(errMsg, excMsg):
|
|||||||
if closed:
|
if closed:
|
||||||
warnMsg += " and resolved. Please update to the latest "
|
warnMsg += " and resolved. Please update to the latest "
|
||||||
warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE
|
warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
return
|
return
|
||||||
except:
|
except:
|
||||||
pass
|
pass
|
||||||
@@ -4025,7 +4002,7 @@ def createGithubIssue(errMsg, excMsg):
|
|||||||
warnMsg += " ('%s')" % _excMsg
|
warnMsg += " ('%s')" % _excMsg
|
||||||
if "Unauthorized" in warnMsg:
|
if "Unauthorized" in warnMsg:
|
||||||
warnMsg += ". Please update to the latest revision"
|
warnMsg += ". Please update to the latest revision"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def maskSensitiveData(msg):
|
def maskSensitiveData(msg):
|
||||||
"""
|
"""
|
||||||
@@ -4033,7 +4010,7 @@ def maskSensitiveData(msg):
|
|||||||
|
|
||||||
>>> maskSensitiveData('python sqlmap.py -u "http://www.test.com/vuln.php?id=1" --banner') == 'python sqlmap.py -u *********************************** --banner'
|
>>> maskSensitiveData('python sqlmap.py -u "http://www.test.com/vuln.php?id=1" --banner') == 'python sqlmap.py -u *********************************** --banner'
|
||||||
True
|
True
|
||||||
>>> maskSensitiveData('sqlmap.py -u test.com/index.go?id=index --auth-type=basic --auth-creds=foo:bar\\ndummy line') == 'sqlmap.py -u ************************** --auth-type=***** --auth-creds=*******\\ndummy line'
|
>>> maskSensitiveData('sqlmap.py -u test.com/index.go?id=index') == 'sqlmap.py -u **************************'
|
||||||
True
|
True
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -4049,7 +4026,7 @@ def maskSensitiveData(msg):
|
|||||||
retVal = retVal.replace(value, '*' * len(value))
|
retVal = retVal.replace(value, '*' * len(value))
|
||||||
|
|
||||||
# Just in case (for problematic parameters regarding user encoding)
|
# Just in case (for problematic parameters regarding user encoding)
|
||||||
for match in re.finditer(r"(?im)[ -]-(u|url|data|cookie|auth-\w+|proxy|host|referer|headers?|H)( |=)(.*?)(?= -?-[a-z]|$)", retVal):
|
for match in re.finditer(r"(?i)[ -]-(u|url|data|cookie|auth-\w+|proxy|host|referer|headers?|H)( |=)(.*?)(?= -?-[a-z]|\Z)", retVal):
|
||||||
retVal = retVal.replace(match.group(3), '*' * len(match.group(3)))
|
retVal = retVal.replace(match.group(3), '*' * len(match.group(3)))
|
||||||
|
|
||||||
# Fail-safe substitutions
|
# Fail-safe substitutions
|
||||||
@@ -4292,8 +4269,7 @@ def safeSQLIdentificatorNaming(name, isTable=False):
|
|||||||
retVal = "[%s]" % retVal
|
retVal = "[%s]" % retVal
|
||||||
|
|
||||||
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
|
||||||
if (conf.db or "").lower() != "information_schema": # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5192
|
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
||||||
retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
|
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|
||||||
@@ -4419,7 +4395,7 @@ def expandMnemonics(mnemonics, parser, args):
|
|||||||
|
|
||||||
if not options:
|
if not options:
|
||||||
warnMsg = "mnemonic '%s' can't be resolved" % name
|
warnMsg = "mnemonic '%s' can't be resolved" % name
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
elif name in options:
|
elif name in options:
|
||||||
found = name
|
found = name
|
||||||
debugMsg = "mnemonic '%s' resolved to %s). " % (name, found)
|
debugMsg = "mnemonic '%s' resolved to %s). " % (name, found)
|
||||||
@@ -4428,7 +4404,7 @@ def expandMnemonics(mnemonics, parser, args):
|
|||||||
found = sorted(options.keys(), key=len)[0]
|
found = sorted(options.keys(), key=len)[0]
|
||||||
warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options))
|
warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options))
|
||||||
warnMsg += "Resolved to shortest of those ('%s')" % found
|
warnMsg += "Resolved to shortest of those ('%s')" % found
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if found:
|
if found:
|
||||||
found = options[found]
|
found = options[found]
|
||||||
@@ -4717,7 +4693,7 @@ def findPageForms(content, url, raise_=False, addToTargets=False):
|
|||||||
else:
|
else:
|
||||||
url = urldecode(request.get_full_url(), kb.pageEncoding)
|
url = urldecode(request.get_full_url(), kb.pageEncoding)
|
||||||
method = request.get_method()
|
method = request.get_method()
|
||||||
data = unArrayizeValue(request.data)
|
data = request.data
|
||||||
data = urldecode(data, kb.pageEncoding, spaceplus=False)
|
data = urldecode(data, kb.pageEncoding, spaceplus=False)
|
||||||
|
|
||||||
if not data and method and method.upper() == HTTPMETHOD.POST:
|
if not data and method and method.upper() == HTTPMETHOD.POST:
|
||||||
@@ -4834,7 +4810,7 @@ def checkOldOptions(args):
|
|||||||
warnMsg = "switch/option '%s' is deprecated" % _
|
warnMsg = "switch/option '%s' is deprecated" % _
|
||||||
if DEPRECATED_OPTIONS[_]:
|
if DEPRECATED_OPTIONS[_]:
|
||||||
warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
|
warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def checkSystemEncoding():
|
def checkSystemEncoding():
|
||||||
"""
|
"""
|
||||||
@@ -4852,7 +4828,7 @@ def checkSystemEncoding():
|
|||||||
logger.critical(errMsg)
|
logger.critical(errMsg)
|
||||||
|
|
||||||
warnMsg = "temporary switching to charset 'cp1256'"
|
warnMsg = "temporary switching to charset 'cp1256'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
_reload_module(sys)
|
_reload_module(sys)
|
||||||
sys.setdefaultencoding("cp1256")
|
sys.setdefaultencoding("cp1256")
|
||||||
|
|||||||
+5
-36
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -12,7 +12,6 @@ import functools
|
|||||||
import math
|
import math
|
||||||
import os
|
import os
|
||||||
import random
|
import random
|
||||||
import re
|
|
||||||
import sys
|
import sys
|
||||||
import time
|
import time
|
||||||
import uuid
|
import uuid
|
||||||
@@ -278,37 +277,7 @@ else:
|
|||||||
xrange = xrange
|
xrange = xrange
|
||||||
buffer = buffer
|
buffer = buffer
|
||||||
|
|
||||||
def LooseVersion(version):
|
try:
|
||||||
"""
|
from pkg_resources import parse_version as LooseVersion
|
||||||
>>> LooseVersion("1.0") == LooseVersion("1.0")
|
except ImportError:
|
||||||
True
|
from distutils.version import LooseVersion
|
||||||
>>> LooseVersion("1.0.1") > LooseVersion("1.0")
|
|
||||||
True
|
|
||||||
>>> LooseVersion("1.0.1-") == LooseVersion("1.0.1")
|
|
||||||
True
|
|
||||||
>>> LooseVersion("1.0.11") < LooseVersion("1.0.111")
|
|
||||||
True
|
|
||||||
>>> LooseVersion("foobar") > LooseVersion("1.0")
|
|
||||||
False
|
|
||||||
>>> LooseVersion("1.0") > LooseVersion("foobar")
|
|
||||||
False
|
|
||||||
>>> LooseVersion("3.22-mysql") == LooseVersion("3.22-mysql-ubuntu0.3")
|
|
||||||
True
|
|
||||||
>>> LooseVersion("8.0.22-0ubuntu0.20.04.2")
|
|
||||||
8.000022
|
|
||||||
"""
|
|
||||||
|
|
||||||
match = re.search(r"\A(\d[\d.]*)", version or "")
|
|
||||||
|
|
||||||
if match:
|
|
||||||
result = 0
|
|
||||||
value = match.group(1)
|
|
||||||
weight = 1.0
|
|
||||||
for part in value.strip('.').split('.'):
|
|
||||||
if part.isdigit():
|
|
||||||
result += int(part) * weight
|
|
||||||
weight *= 1e-3
|
|
||||||
else:
|
|
||||||
result = float("NaN")
|
|
||||||
|
|
||||||
return result
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+6
-6
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -421,7 +421,7 @@ class Dump(object):
|
|||||||
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
tempDir = tempfile.mkdtemp(prefix="sqlmapdb")
|
||||||
warnMsg = "currently unable to use regular dump directory. "
|
warnMsg = "currently unable to use regular dump directory. "
|
||||||
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
dumpDbPath = tempDir
|
dumpDbPath = tempDir
|
||||||
|
|
||||||
@@ -445,11 +445,11 @@ class Dump(object):
|
|||||||
warnMsg = "unable to create dump directory "
|
warnMsg = "unable to create dump directory "
|
||||||
warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex))
|
warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
warnMsg += "Using temporary directory '%s' instead" % tempDir
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
dumpDbPath = tempDir
|
dumpDbPath = tempDir
|
||||||
|
|
||||||
dumpFileName = conf.dumpFile or os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower())))
|
dumpFileName = os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower())))
|
||||||
if not checkFile(dumpFileName, False):
|
if not checkFile(dumpFileName, False):
|
||||||
try:
|
try:
|
||||||
openFile(dumpFileName, "w+b").close()
|
openFile(dumpFileName, "w+b").close()
|
||||||
@@ -624,7 +624,7 @@ class Dump(object):
|
|||||||
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
_ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column)))
|
||||||
filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
|
filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8)))
|
||||||
warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
|
warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
with openFile(filepath, "w+b", None) as f:
|
with openFile(filepath, "w+b", None) as f:
|
||||||
_ = safechardecode(value, True)
|
_ = safechardecode(value, True)
|
||||||
@@ -672,7 +672,7 @@ class Dump(object):
|
|||||||
if not warnFile:
|
if not warnFile:
|
||||||
logger.info(msg)
|
logger.info(msg)
|
||||||
else:
|
else:
|
||||||
logger.warning(msg)
|
logger.warn(msg)
|
||||||
|
|
||||||
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
def dbColumns(self, dbColumnsDict, colConsider, dbs):
|
||||||
if conf.api:
|
if conf.api:
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+2
-2
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -223,7 +223,7 @@ def runGui(parser):
|
|||||||
helpmenu.add_command(label="Wiki pages", command=lambda: webbrowser.open(WIKI_PAGE))
|
helpmenu.add_command(label="Wiki pages", command=lambda: webbrowser.open(WIKI_PAGE))
|
||||||
helpmenu.add_command(label="Report issue", command=lambda: webbrowser.open(ISSUES_PAGE))
|
helpmenu.add_command(label="Report issue", command=lambda: webbrowser.open(ISSUES_PAGE))
|
||||||
helpmenu.add_separator()
|
helpmenu.add_separator()
|
||||||
helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "Copyright (c) 2006-2023\n\n (%s)" % DEV_EMAIL_ADDRESS))
|
helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "Copyright (c) 2006-2022\n\n (%s)" % DEV_EMAIL_ADDRESS))
|
||||||
menubar.add_cascade(label="Help", menu=helpmenu)
|
menubar.add_cascade(label="Help", menu=helpmenu)
|
||||||
|
|
||||||
window.config(menu=menubar)
|
window.config(menu=menubar)
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+28
-50
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -416,9 +416,6 @@ def _doSearch():
|
|||||||
conf.googlePage += 1
|
conf.googlePage += 1
|
||||||
|
|
||||||
def _setStdinPipeTargets():
|
def _setStdinPipeTargets():
|
||||||
if conf.url:
|
|
||||||
return
|
|
||||||
|
|
||||||
if isinstance(conf.stdinPipe, _collections.Iterable):
|
if isinstance(conf.stdinPipe, _collections.Iterable):
|
||||||
infoMsg = "using 'STDIN' for parsing targets list"
|
infoMsg = "using 'STDIN' for parsing targets list"
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
@@ -478,7 +475,7 @@ def _setBulkMultipleTargets():
|
|||||||
|
|
||||||
if not found and not conf.forms and not conf.crawlDepth:
|
if not found and not conf.forms and not conf.crawlDepth:
|
||||||
warnMsg = "no usable links found (with GET parameters)"
|
warnMsg = "no usable links found (with GET parameters)"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def _findPageForms():
|
def _findPageForms():
|
||||||
if not conf.forms or conf.crawlDepth:
|
if not conf.forms or conf.crawlDepth:
|
||||||
@@ -526,7 +523,7 @@ def _findPageForms():
|
|||||||
|
|
||||||
if not found:
|
if not found:
|
||||||
warnMsg = "no forms found"
|
warnMsg = "no forms found"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def _setDBMSAuthentication():
|
def _setDBMSAuthentication():
|
||||||
"""
|
"""
|
||||||
@@ -610,16 +607,16 @@ def _setMetasploit():
|
|||||||
warnMsg += "or more of the needed Metasploit executables "
|
warnMsg += "or more of the needed Metasploit executables "
|
||||||
warnMsg += "within msfcli, msfconsole, msfencode and "
|
warnMsg += "within msfcli, msfconsole, msfencode and "
|
||||||
warnMsg += "msfpayload do not exist"
|
warnMsg += "msfpayload do not exist"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
else:
|
else:
|
||||||
warnMsg = "you did not provide the local path where Metasploit "
|
warnMsg = "you did not provide the local path where Metasploit "
|
||||||
warnMsg += "Framework is installed"
|
warnMsg += "Framework is installed"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if not msfEnvPathExists:
|
if not msfEnvPathExists:
|
||||||
warnMsg = "sqlmap is going to look for Metasploit Framework "
|
warnMsg = "sqlmap is going to look for Metasploit Framework "
|
||||||
warnMsg += "installation inside the environment path(s)"
|
warnMsg += "installation inside the environment path(s)"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":")
|
envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":")
|
||||||
|
|
||||||
@@ -1205,10 +1202,10 @@ def _setHTTPHandlers():
|
|||||||
|
|
||||||
if conf.proxy:
|
if conf.proxy:
|
||||||
warnMsg += "with HTTP(s) proxy"
|
warnMsg += "with HTTP(s) proxy"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
elif conf.authType:
|
elif conf.authType:
|
||||||
warnMsg += "with authentication methods"
|
warnMsg += "with authentication methods"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
else:
|
else:
|
||||||
handlers.append(keepAliveHandler)
|
handlers.append(keepAliveHandler)
|
||||||
|
|
||||||
@@ -1550,7 +1547,7 @@ def _setHTTPTimeout():
|
|||||||
if conf.timeout < 3.0:
|
if conf.timeout < 3.0:
|
||||||
warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap "
|
warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap "
|
||||||
warnMsg += "will going to reset it"
|
warnMsg += "will going to reset it"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.timeout = 3.0
|
conf.timeout = 3.0
|
||||||
else:
|
else:
|
||||||
@@ -1589,13 +1586,13 @@ def _createHomeDirectories():
|
|||||||
|
|
||||||
if conf.get("outputDir") and context == "output":
|
if conf.get("outputDir") and context == "output":
|
||||||
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
warnMsg = "using '%s' as the %s directory" % (directory, context)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context)
|
||||||
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context)
|
||||||
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (directory, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
paths["SQLMAP_%s_PATH" % context.upper()] = tempDir
|
||||||
|
|
||||||
@@ -1620,7 +1617,7 @@ def _createTemporaryDirectory():
|
|||||||
tempfile.tempdir = conf.tmpDir
|
tempfile.tempdir = conf.tmpDir
|
||||||
|
|
||||||
warnMsg = "using '%s' as the temporary directory" % conf.tmpDir
|
warnMsg = "using '%s' as the temporary directory" % conf.tmpDir
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
except (OSError, IOError) as ex:
|
except (OSError, IOError) as ex:
|
||||||
errMsg = "there has been a problem while accessing "
|
errMsg = "there has been a problem while accessing "
|
||||||
errMsg += "temporary directory location(s) ('%s')" % getSafeExString(ex)
|
errMsg += "temporary directory location(s) ('%s')" % getSafeExString(ex)
|
||||||
@@ -1635,7 +1632,7 @@ def _createTemporaryDirectory():
|
|||||||
warnMsg += "make sure that there is enough disk space left. If problem persists, "
|
warnMsg += "make sure that there is enough disk space left. If problem persists, "
|
||||||
warnMsg += "try to set environment variable 'TEMP' to a location "
|
warnMsg += "try to set environment variable 'TEMP' to a location "
|
||||||
warnMsg += "writeable by the current user"
|
warnMsg += "writeable by the current user"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if "sqlmap" not in (tempfile.tempdir or "") or conf.tmpDir and tempfile.tempdir == conf.tmpDir:
|
if "sqlmap" not in (tempfile.tempdir or "") or conf.tmpDir and tempfile.tempdir == conf.tmpDir:
|
||||||
try:
|
try:
|
||||||
@@ -1696,20 +1693,11 @@ def _cleanupOptions():
|
|||||||
try:
|
try:
|
||||||
conf.ignoreCode = [int(_) for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.ignoreCode)]
|
conf.ignoreCode = [int(_) for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.ignoreCode)]
|
||||||
except ValueError:
|
except ValueError:
|
||||||
errMsg = "option '--ignore-code' should contain a list of integer values or a wildcard value '%s'" % IGNORE_CODE_WILDCARD
|
errMsg = "options '--ignore-code' should contain a list of integer values or a wildcard value '%s'" % IGNORE_CODE_WILDCARD
|
||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
else:
|
else:
|
||||||
conf.ignoreCode = []
|
conf.ignoreCode = []
|
||||||
|
|
||||||
if conf.abortCode:
|
|
||||||
try:
|
|
||||||
conf.abortCode = [int(_) for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.abortCode)]
|
|
||||||
except ValueError:
|
|
||||||
errMsg = "option '--abort-code' should contain a list of integer values"
|
|
||||||
raise SqlmapSyntaxException(errMsg)
|
|
||||||
else:
|
|
||||||
conf.abortCode = []
|
|
||||||
|
|
||||||
if conf.paramFilter:
|
if conf.paramFilter:
|
||||||
conf.paramFilter = [_.strip() for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.paramFilter.upper())]
|
conf.paramFilter = [_.strip() for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.paramFilter.upper())]
|
||||||
else:
|
else:
|
||||||
@@ -1844,7 +1832,7 @@ def _cleanupOptions():
|
|||||||
warnMsg = "increasing default value for "
|
warnMsg = "increasing default value for "
|
||||||
warnMsg += "option '--time-sec' to %d because " % conf.timeSec
|
warnMsg += "option '--time-sec' to %d because " % conf.timeSec
|
||||||
warnMsg += "switch '--tor' was provided"
|
warnMsg += "switch '--tor' was provided"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
else:
|
else:
|
||||||
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE
|
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE
|
||||||
|
|
||||||
@@ -2057,7 +2045,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.delayCandidates = TIME_DELAY_CANDIDATES * [0]
|
kb.delayCandidates = TIME_DELAY_CANDIDATES * [0]
|
||||||
kb.dep = None
|
kb.dep = None
|
||||||
kb.disableHtmlDecoding = False
|
kb.disableHtmlDecoding = False
|
||||||
kb.disableShiftTable = False
|
|
||||||
kb.dnsMode = False
|
kb.dnsMode = False
|
||||||
kb.dnsTest = None
|
kb.dnsTest = None
|
||||||
kb.docRoot = None
|
kb.docRoot = None
|
||||||
@@ -2106,7 +2093,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.lastParserStatus = None
|
kb.lastParserStatus = None
|
||||||
|
|
||||||
kb.locks = AttribDict()
|
kb.locks = AttribDict()
|
||||||
for _ in ("cache", "connError", "count", "handlers", "hint", "identYwaf", "index", "io", "limit", "liveCookies", "log", "socket", "redirect", "request", "value"):
|
for _ in ("cache", "connError", "count", "handlers", "hint", "index", "io", "limit", "liveCookies", "log", "socket", "redirect", "request", "value"):
|
||||||
kb.locks[_] = threading.Lock()
|
kb.locks[_] = threading.Lock()
|
||||||
|
|
||||||
kb.matchRatio = None
|
kb.matchRatio = None
|
||||||
@@ -2178,6 +2165,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
|
|||||||
kb.testType = None
|
kb.testType = None
|
||||||
kb.threadContinue = True
|
kb.threadContinue = True
|
||||||
kb.threadException = False
|
kb.threadException = False
|
||||||
|
kb.tlsSNI = {}
|
||||||
kb.uChar = NULL
|
kb.uChar = NULL
|
||||||
kb.udfFail = False
|
kb.udfFail = False
|
||||||
kb.unionDuplicates = False
|
kb.unionDuplicates = False
|
||||||
@@ -2218,7 +2206,7 @@ def _useWizardInterface():
|
|||||||
|
|
||||||
while not conf.url:
|
while not conf.url:
|
||||||
message = "Please enter full target URL (-u): "
|
message = "Please enter full target URL (-u): "
|
||||||
conf.url = readInput(message, default=None, checkBatch=False)
|
conf.url = readInput(message, default=None)
|
||||||
|
|
||||||
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
|
||||||
conf.data = readInput(message, default=None)
|
conf.data = readInput(message, default=None)
|
||||||
@@ -2229,7 +2217,7 @@ def _useWizardInterface():
|
|||||||
if not conf.crawlDepth and not conf.forms:
|
if not conf.crawlDepth and not conf.forms:
|
||||||
warnMsg += "Will search for forms"
|
warnMsg += "Will search for forms"
|
||||||
conf.forms = True
|
conf.forms = True
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
choice = None
|
choice = None
|
||||||
|
|
||||||
@@ -2485,7 +2473,7 @@ def _setTorHttpProxySettings():
|
|||||||
warnMsg += "Tor anonymizing network because of "
|
warnMsg += "Tor anonymizing network because of "
|
||||||
warnMsg += "known issues with default settings of various 'bundles' "
|
warnMsg += "known issues with default settings of various 'bundles' "
|
||||||
warnMsg += "(e.g. Vidalia)"
|
warnMsg += "(e.g. Vidalia)"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def _setTorSocksProxySettings():
|
def _setTorSocksProxySettings():
|
||||||
infoMsg = "setting Tor SOCKS proxy settings"
|
infoMsg = "setting Tor SOCKS proxy settings"
|
||||||
@@ -2565,7 +2553,7 @@ def _basicOptionValidation():
|
|||||||
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \
|
if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \
|
||||||
isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart:
|
isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart:
|
||||||
warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable"
|
warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \
|
if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \
|
||||||
isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar:
|
isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar:
|
||||||
@@ -2575,7 +2563,7 @@ def _basicOptionValidation():
|
|||||||
if conf.proxyFile and not any((conf.randomAgent, conf.mobile, conf.agent, conf.requestFile)):
|
if conf.proxyFile and not any((conf.randomAgent, conf.mobile, conf.agent, conf.requestFile)):
|
||||||
warnMsg = "usage of switch '--random-agent' is strongly recommended when "
|
warnMsg = "usage of switch '--random-agent' is strongly recommended when "
|
||||||
warnMsg += "using option '--proxy-file'"
|
warnMsg += "using option '--proxy-file'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if conf.textOnly and conf.nullConnection:
|
if conf.textOnly and conf.nullConnection:
|
||||||
errMsg = "switch '--text-only' is incompatible with switch '--null-connection'"
|
errMsg = "switch '--text-only' is incompatible with switch '--null-connection'"
|
||||||
@@ -2664,9 +2652,6 @@ def _basicOptionValidation():
|
|||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
if conf.paramExclude:
|
if conf.paramExclude:
|
||||||
if re.search(r"\A\w+,", conf.paramExclude):
|
|
||||||
conf.paramExclude = r"\A(%s)\Z" % ('|'.join(re.escape(_).strip() for _ in conf.paramExclude.split(',')))
|
|
||||||
|
|
||||||
try:
|
try:
|
||||||
re.compile(conf.paramExclude)
|
re.compile(conf.paramExclude)
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
@@ -2686,10 +2671,10 @@ def _basicOptionValidation():
|
|||||||
warnMsg = "increasing default value for "
|
warnMsg = "increasing default value for "
|
||||||
warnMsg += "option '--retries' to %d because " % conf.retries
|
warnMsg += "option '--retries' to %d because " % conf.retries
|
||||||
warnMsg += "option '--retry-on' was provided"
|
warnMsg += "option '--retry-on' was provided"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
|
|
||||||
if conf.cookieDel and len(conf.cookieDel) != 1:
|
if conf.cookieDel and len(conf.cookieDel):
|
||||||
errMsg = "option '--cookie-del' should contain a single character (e.g. ';')"
|
errMsg = "option '--cookie-del' should contain a single character (e.g. ';')"
|
||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
@@ -2747,10 +2732,6 @@ def _basicOptionValidation():
|
|||||||
errMsg = "option '--csrf-method' requires usage of option '--csrf-token'"
|
errMsg = "option '--csrf-method' requires usage of option '--csrf-token'"
|
||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
|
|
||||||
if conf.csrfData and not conf.csrfToken:
|
|
||||||
errMsg = "option '--csrf-data' requires usage of option '--csrf-token'"
|
|
||||||
raise SqlmapSyntaxException(errMsg)
|
|
||||||
|
|
||||||
if conf.csrfToken and conf.threads > 1:
|
if conf.csrfToken and conf.threads > 1:
|
||||||
errMsg = "option '--csrf-url' is incompatible with option '--threads'"
|
errMsg = "option '--csrf-url' is incompatible with option '--threads'"
|
||||||
raise SqlmapSyntaxException(errMsg)
|
raise SqlmapSyntaxException(errMsg)
|
||||||
@@ -2858,13 +2839,10 @@ def _basicOptionValidation():
|
|||||||
else:
|
else:
|
||||||
conf.encoding = _
|
conf.encoding = _
|
||||||
|
|
||||||
if conf.fileWrite and not os.path.isfile(conf.fileWrite):
|
if conf.loadCookies:
|
||||||
errMsg = "file '%s' does not exist" % os.path.abspath(conf.fileWrite)
|
if not os.path.exists(conf.loadCookies):
|
||||||
raise SqlmapFilePathException(errMsg)
|
errMsg = "cookies file '%s' does not exist" % conf.loadCookies
|
||||||
|
raise SqlmapFilePathException(errMsg)
|
||||||
if conf.loadCookies and not os.path.exists(conf.loadCookies):
|
|
||||||
errMsg = "cookies file '%s' does not exist" % os.path.abspath(conf.loadCookies)
|
|
||||||
raise SqlmapFilePathException(errMsg)
|
|
||||||
|
|
||||||
def initOptions(inputOptions=AttribDict(), overrideOptions=False):
|
def initOptions(inputOptions=AttribDict(), overrideOptions=False):
|
||||||
_setConfAttributes()
|
_setConfAttributes()
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -39,7 +39,6 @@ optDict = {
|
|||||||
"authType": "string",
|
"authType": "string",
|
||||||
"authCred": "string",
|
"authCred": "string",
|
||||||
"authFile": "string",
|
"authFile": "string",
|
||||||
"abortCode": "string",
|
|
||||||
"ignoreCode": "string",
|
"ignoreCode": "string",
|
||||||
"ignoreProxy": "boolean",
|
"ignoreProxy": "boolean",
|
||||||
"ignoreRedirects": "boolean",
|
"ignoreRedirects": "boolean",
|
||||||
@@ -65,7 +64,6 @@ optDict = {
|
|||||||
"csrfToken": "string",
|
"csrfToken": "string",
|
||||||
"csrfUrl": "string",
|
"csrfUrl": "string",
|
||||||
"csrfMethod": "string",
|
"csrfMethod": "string",
|
||||||
"csrfData": "string",
|
|
||||||
"csrfRetries": "integer",
|
"csrfRetries": "integer",
|
||||||
"forceSSL": "boolean",
|
"forceSSL": "boolean",
|
||||||
"chunked": "boolean",
|
"chunked": "boolean",
|
||||||
@@ -205,7 +203,6 @@ optDict = {
|
|||||||
|
|
||||||
"General": {
|
"General": {
|
||||||
"trafficFile": "string",
|
"trafficFile": "string",
|
||||||
"abortOnEmpty": "boolean",
|
|
||||||
"answers": "string",
|
"answers": "string",
|
||||||
"batch": "boolean",
|
"batch": "boolean",
|
||||||
"base64Parameter": "string",
|
"base64Parameter": "string",
|
||||||
@@ -217,7 +214,6 @@ optDict = {
|
|||||||
"crawlDepth": "integer",
|
"crawlDepth": "integer",
|
||||||
"crawlExclude": "string",
|
"crawlExclude": "string",
|
||||||
"csvDel": "string",
|
"csvDel": "string",
|
||||||
"dumpFile": "string",
|
|
||||||
"dumpFormat": "string",
|
"dumpFormat": "string",
|
||||||
"encoding": "string",
|
"encoding": "string",
|
||||||
"eta": "boolean",
|
"eta": "boolean",
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -20,7 +20,7 @@ from thirdparty import six
|
|||||||
from thirdparty.six import unichr as _unichr
|
from thirdparty.six import unichr as _unichr
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.7.2.0"
|
VERSION = "1.6.6.0"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -363,7 +363,6 @@ BASIC_HELP_ITEMS = (
|
|||||||
"getCurrentUser",
|
"getCurrentUser",
|
||||||
"getCurrentDb",
|
"getCurrentDb",
|
||||||
"getPasswordHashes",
|
"getPasswordHashes",
|
||||||
"getDbs",
|
|
||||||
"getTables",
|
"getTables",
|
||||||
"getColumns",
|
"getColumns",
|
||||||
"getSchema",
|
"getSchema",
|
||||||
@@ -846,7 +845,7 @@ JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*
|
|||||||
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
|
||||||
|
|
||||||
# Regular expression used for detecting Array-like POST data
|
# Regular expression used for detecting Array-like POST data
|
||||||
ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\d*\]=.+%s\2\[\d*\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER)
|
ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\]=.+%s\2\[\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER)
|
||||||
|
|
||||||
# Default POST data content-type
|
# Default POST data content-type
|
||||||
DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8"
|
DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8"
|
||||||
|
|||||||
+4
-4
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -79,7 +79,7 @@ def saveHistory(completion=None):
|
|||||||
readline.write_history_file(historyPath)
|
readline.write_history_file(historyPath)
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
@@ -103,12 +103,12 @@ def loadHistory(completion=None):
|
|||||||
readline.read_history_file(historyPath)
|
readline.read_history_file(historyPath)
|
||||||
except IOError as ex:
|
except IOError as ex:
|
||||||
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex))
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
except UnicodeError:
|
except UnicodeError:
|
||||||
if IS_WIN:
|
if IS_WIN:
|
||||||
warnMsg = "there was a problem loading the history file '%s'. " % historyPath
|
warnMsg = "there was a problem loading the history file '%s'. " % historyPath
|
||||||
warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
|
warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
def autoCompletion(completion=None, os=None, commands=None):
|
def autoCompletion(completion=None, os=None, commands=None):
|
||||||
if not readlineAvailable():
|
if not readlineAvailable():
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+10
-16
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -106,7 +106,7 @@ def _setRequestParams():
|
|||||||
|
|
||||||
# Perform checks on POST parameters
|
# Perform checks on POST parameters
|
||||||
if conf.method == HTTPMETHOD.POST and conf.data is None:
|
if conf.method == HTTPMETHOD.POST and conf.data is None:
|
||||||
logger.warning("detected empty POST body")
|
logger.warn("detected empty POST body")
|
||||||
conf.data = ""
|
conf.data = ""
|
||||||
|
|
||||||
if conf.data is not None:
|
if conf.data is not None:
|
||||||
@@ -120,10 +120,7 @@ def _setRequestParams():
|
|||||||
while True:
|
while True:
|
||||||
_ = re.search(r"\\g<([^>]+)>", retVal)
|
_ = re.search(r"\\g<([^>]+)>", retVal)
|
||||||
if _:
|
if _:
|
||||||
try:
|
retVal = retVal.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
|
||||||
retVal = retVal.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
|
|
||||||
except IndexError:
|
|
||||||
break
|
|
||||||
else:
|
else:
|
||||||
break
|
break
|
||||||
if kb.customInjectionMark in retVal:
|
if kb.customInjectionMark in retVal:
|
||||||
@@ -250,7 +247,7 @@ def _setRequestParams():
|
|||||||
warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') "
|
warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') "
|
||||||
warnMsg += "and without providing any POST parameters "
|
warnMsg += "and without providing any POST parameters "
|
||||||
warnMsg += "through option '--data'"
|
warnMsg += "through option '--data'"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
message = "do you want to try URI injections "
|
message = "do you want to try URI injections "
|
||||||
message += "in the target URL itself? [Y/n/q] "
|
message += "in the target URL itself? [Y/n/q] "
|
||||||
@@ -286,7 +283,7 @@ def _setRequestParams():
|
|||||||
warnMsg = "it seems that you've provided empty parameter value(s) "
|
warnMsg = "it seems that you've provided empty parameter value(s) "
|
||||||
warnMsg += "for testing. Please, always use only valid parameter values "
|
warnMsg += "for testing. Please, always use only valid parameter values "
|
||||||
warnMsg += "so sqlmap could be able to run properly"
|
warnMsg += "so sqlmap could be able to run properly"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if not kb.processUserMarks:
|
if not kb.processUserMarks:
|
||||||
if place == PLACE.URI:
|
if place == PLACE.URI:
|
||||||
@@ -308,9 +305,6 @@ def _setRequestParams():
|
|||||||
testableParameters = True
|
testableParameters = True
|
||||||
|
|
||||||
else:
|
else:
|
||||||
if place == PLACE.URI:
|
|
||||||
value = conf.url = conf.url.replace('+', "%20") # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5123
|
|
||||||
|
|
||||||
conf.parameters[place] = value
|
conf.parameters[place] = value
|
||||||
conf.paramDict[place] = OrderedDict()
|
conf.paramDict[place] = OrderedDict()
|
||||||
|
|
||||||
@@ -588,7 +582,7 @@ def _setResultsFile():
|
|||||||
os.close(handle)
|
os.close(handle)
|
||||||
conf.resultsFP = openFile(conf.resultsFile, "w+", UNICODE_ENCODING, buffering=0)
|
conf.resultsFP = openFile(conf.resultsFile, "w+", UNICODE_ENCODING, buffering=0)
|
||||||
warnMsg += "Using temporary file '%s' instead" % conf.resultsFile
|
warnMsg += "Using temporary file '%s' instead" % conf.resultsFile
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
except IOError as _:
|
except IOError as _:
|
||||||
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
errMsg = "unable to write to the temporary directory ('%s'). " % _
|
||||||
errMsg += "Please make sure that your disk is not full and "
|
errMsg += "Please make sure that your disk is not full and "
|
||||||
@@ -619,7 +613,7 @@ def _createFilesDir():
|
|||||||
warnMsg = "unable to create files directory "
|
warnMsg = "unable to create files directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.filePath = tempDir
|
conf.filePath = tempDir
|
||||||
|
|
||||||
@@ -641,7 +635,7 @@ def _createDumpDir():
|
|||||||
warnMsg = "unable to create dump directory "
|
warnMsg = "unable to create dump directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.dumpPath = tempDir
|
conf.dumpPath = tempDir
|
||||||
|
|
||||||
@@ -664,7 +658,7 @@ def _createTargetDirs():
|
|||||||
warnMsg = "unable to create output directory "
|
warnMsg = "unable to create output directory "
|
||||||
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex))
|
||||||
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.outputPath = tempDir
|
conf.outputPath = tempDir
|
||||||
|
|
||||||
@@ -687,7 +681,7 @@ def _createTargetDirs():
|
|||||||
raise SqlmapMissingPrivileges(errMsg)
|
raise SqlmapMissingPrivileges(errMsg)
|
||||||
except UnicodeError as ex:
|
except UnicodeError as ex:
|
||||||
warnMsg = "something went wrong while saving target data ('%s')" % getSafeExString(ex)
|
warnMsg = "something went wrong while saving target data ('%s')" % getSafeExString(ex)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
_createDumpDir()
|
_createDumpDir()
|
||||||
_createFilesDir()
|
_createFilesDir()
|
||||||
|
|||||||
+5
-5
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -39,7 +39,7 @@ def vulnTest():
|
|||||||
|
|
||||||
TESTS = (
|
TESTS = (
|
||||||
("-h", ("to see full list of options run with '-hh'",)),
|
("-h", ("to see full list of options run with '-hh'",)),
|
||||||
("--dependencies", ("sqlmap requires", "third-party library")),
|
("--dependencies --deprecations", ("sqlmap requires", "third-party library", "~DeprecationWarning:")),
|
||||||
("-u <url> --data=\"reflect=1\" --flush-session --wizard --disable-coloring", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
("-u <url> --data=\"reflect=1\" --flush-session --wizard --disable-coloring", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
|
||||||
("-u <url> --data=\"code=1\" --code=200 --technique=B --banner --no-cast --flush-session", ("back-end DBMS: SQLite", "banner: '3.", "~COALESCE(CAST(")),
|
("-u <url> --data=\"code=1\" --code=200 --technique=B --banner --no-cast --flush-session", ("back-end DBMS: SQLite", "banner: '3.", "~COALESCE(CAST(")),
|
||||||
(u"-c <config> --flush-session --output-dir=\"<tmpdir>\" --smart --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible", "as the output directory")),
|
(u"-c <config> --flush-session --output-dir=\"<tmpdir>\" --smart --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible", "as the output directory")),
|
||||||
@@ -58,9 +58,9 @@ def vulnTest():
|
|||||||
("-u <url> --flush-session --banner --technique=B --disable-precon --not-string \"no results\"", ("banner: '3.",)),
|
("-u <url> --flush-session --banner --technique=B --disable-precon --not-string \"no results\"", ("banner: '3.",)),
|
||||||
("-u <url> --flush-session --encoding=gbk --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
("-u <url> --flush-session --encoding=gbk --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
|
||||||
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
|
||||||
("-u <base> --flush-session --technique=BU --data=\"{\\\"id\\\": 1}\" --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: UNION query", "banner: '3.")),
|
("-u <base> --flush-session --data=\"{\\\"id\\\": 1}\" --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
|
||||||
("-u <base> --flush-session -H \"Foo: Bar\" -H \"Sna: Fu\" --data=\"<root><param name=\\\"id\\\" value=\\\"1*\\\"/></root>\" --union-char=1 --mobile --answers=\"smartphone=3\" --banner --smart -v 5", ("might be injectable", "Payload: <root><param name=\"id\" value=\"1", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.", "Nexus", "Sna: Fu", "Foo: Bar")),
|
("-u <base> --flush-session -H \"Foo: Bar\" -H \"Sna: Fu\" --data=\"<root><param name=\\\"id\\\" value=\\\"1*\\\"/></root>\" --union-char=1 --mobile --answers=\"smartphone=3\" --banner --smart -v 5", ("might be injectable", "Payload: <root><param name=\"id\" value=\"1", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.", "Nexus", "Sna: Fu", "Foo: Bar")),
|
||||||
("-u <base> --flush-session --technique=BU --method=PUT --data=\"a=1;id=1;b=2\" --param-del=\";\" --skip-static --har=<tmpfile> --dump -T users --start=1 --stop=2", ("might be injectable", "Parameter: id (PUT)", "Type: boolean-based blind", "Type: UNION query", "2 entries")),
|
("-u <base> --flush-session --method=PUT --data=\"a=1;id=1;b=2\" --param-del=\";\" --skip-static --har=<tmpfile> --dump -T users --start=1 --stop=2", ("might be injectable", "Parameter: id (PUT)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "2 entries")),
|
||||||
("-u <url> --flush-session -H \"id: 1*\" --tables -t <tmpfile>", ("might be injectable", "Parameter: id #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
("-u <url> --flush-session -H \"id: 1*\" --tables -t <tmpfile>", ("might be injectable", "Parameter: id #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
||||||
("-u <url> --flush-session --banner --invalid-logical --technique=B --predict-output --test-filter=\"OR boolean\" --tamper=space2dash", ("banner: '3.", " LIKE ")),
|
("-u <url> --flush-session --banner --invalid-logical --technique=B --predict-output --test-filter=\"OR boolean\" --tamper=space2dash", ("banner: '3.", " LIKE ")),
|
||||||
("-u <url> --flush-session --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e; id=1*; id2=2\" --tables --union-cols=3", ("might be injectable", "Cookie #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
("-u <url> --flush-session --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e; id=1*; id2=2\" --tables --union-cols=3", ("might be injectable", "Cookie #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")),
|
||||||
@@ -69,7 +69,7 @@ def vulnTest():
|
|||||||
("-u <url> --flush-session --parse-errors --test-filter=\"subquery\" --eval=\"import hashlib; id2=2; id3=hashlib.md5(id.encode()).hexdigest()\" --referer=\"localhost\"", ("might be injectable", ": syntax error", "back-end DBMS: SQLite", "WHERE or HAVING clause (subquery")),
|
("-u <url> --flush-session --parse-errors --test-filter=\"subquery\" --eval=\"import hashlib; id2=2; id3=hashlib.md5(id.encode()).hexdigest()\" --referer=\"localhost\"", ("might be injectable", ": syntax error", "back-end DBMS: SQLite", "WHERE or HAVING clause (subquery")),
|
||||||
("-u <url> --banner --schema --dump -T users --binary-fields=surname --where \"id>3\"", ("banner: '3.", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
|
("-u <url> --banner --schema --dump -T users --binary-fields=surname --where \"id>3\"", ("banner: '3.", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
|
||||||
("-u <url> --technique=U --fresh-queries --force-partial --dump -T users --dump-format=HTML --answers=\"crack=n\" -v 3", ("performed 6 queries", "nameisnull", "~using default dictionary", "dumped to HTML file")),
|
("-u <url> --technique=U --fresh-queries --force-partial --dump -T users --dump-format=HTML --answers=\"crack=n\" -v 3", ("performed 6 queries", "nameisnull", "~using default dictionary", "dumped to HTML file")),
|
||||||
("-u <url> --flush-session --technique=BU --all", ("5 entries", "Type: boolean-based blind", "Type: UNION query", "luther", "blisset", "fluffy", "179ad45c6ce2cb97cf1029e212046e81", "NULL", "nameisnull", "testpass")),
|
("-u <url> --flush-session --all", ("5 entries", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "luther", "blisset", "fluffy", "179ad45c6ce2cb97cf1029e212046e81", "NULL", "nameisnull", "testpass")),
|
||||||
("-u <url> -z \"tec=B\" --hex --fresh-queries --threads=4 --sql-query=\"SELECT * FROM users\"", ("SELECT * FROM users [5]", "nameisnull")),
|
("-u <url> -z \"tec=B\" --hex --fresh-queries --threads=4 --sql-query=\"SELECT * FROM users\"", ("SELECT * FROM users [5]", "nameisnull")),
|
||||||
("-u \"<url>&echo=foobar*\" --flush-session", ("might be vulnerable to cross-site scripting",)),
|
("-u \"<url>&echo=foobar*\" --flush-session", ("might be vulnerable to cross-site scripting",)),
|
||||||
("-u \"<url>&query=*\" --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3.")),
|
("-u \"<url>&query=*\" --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3.")),
|
||||||
|
|||||||
+4
-8
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -154,19 +154,15 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
|
|||||||
|
|
||||||
if numThreads == 1:
|
if numThreads == 1:
|
||||||
warnMsg = "running in a single-thread mode. This could take a while"
|
warnMsg = "running in a single-thread mode. This could take a while"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if numThreads > 1:
|
if numThreads > 1:
|
||||||
if startThreadMsg:
|
if startThreadMsg:
|
||||||
infoMsg = "starting %d threads" % numThreads
|
infoMsg = "starting %d threads" % numThreads
|
||||||
logger.info(infoMsg)
|
logger.info(infoMsg)
|
||||||
else:
|
else:
|
||||||
try:
|
_threadFunction()
|
||||||
_threadFunction()
|
return
|
||||||
except (SqlmapUserQuitException, SqlmapSkipTargetException):
|
|
||||||
pass
|
|
||||||
finally:
|
|
||||||
return
|
|
||||||
|
|
||||||
kb.multiThreadMode = True
|
kb.multiThreadMode = True
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+2
-2
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -68,7 +68,7 @@ def update():
|
|||||||
elif not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
elif not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")):
|
||||||
warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository "
|
warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository "
|
||||||
warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
if VERSION == getLatestRevision():
|
if VERSION == getLatestRevision():
|
||||||
logger.info("already at the latest revision '%s'" % getRevisionNumber())
|
logger.info("already at the latest revision '%s'" % getRevisionNumber())
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+3
-18
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -201,11 +201,8 @@ def cmdLineParser(argv=None):
|
|||||||
request.add_argument("--auth-file", dest="authFile",
|
request.add_argument("--auth-file", dest="authFile",
|
||||||
help="HTTP authentication PEM cert/private key file")
|
help="HTTP authentication PEM cert/private key file")
|
||||||
|
|
||||||
request.add_argument("--abort-code", dest="abortCode",
|
|
||||||
help="Abort on (problematic) HTTP error code(s) (e.g. 401)")
|
|
||||||
|
|
||||||
request.add_argument("--ignore-code", dest="ignoreCode",
|
request.add_argument("--ignore-code", dest="ignoreCode",
|
||||||
help="Ignore (problematic) HTTP error code(s) (e.g. 401)")
|
help="Ignore (problematic) HTTP error code (e.g. 401)")
|
||||||
|
|
||||||
request.add_argument("--ignore-proxy", dest="ignoreProxy", action="store_true",
|
request.add_argument("--ignore-proxy", dest="ignoreProxy", action="store_true",
|
||||||
help="Ignore system default proxy settings")
|
help="Ignore system default proxy settings")
|
||||||
@@ -279,9 +276,6 @@ def cmdLineParser(argv=None):
|
|||||||
request.add_argument("--csrf-method", dest="csrfMethod",
|
request.add_argument("--csrf-method", dest="csrfMethod",
|
||||||
help="HTTP method to use during anti-CSRF token page visit")
|
help="HTTP method to use during anti-CSRF token page visit")
|
||||||
|
|
||||||
request.add_argument("--csrf-data", dest="csrfData",
|
|
||||||
help="POST data to send during anti-CSRF token page visit")
|
|
||||||
|
|
||||||
request.add_argument("--csrf-retries", dest="csrfRetries", type=int,
|
request.add_argument("--csrf-retries", dest="csrfRetries", type=int,
|
||||||
help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries)
|
help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries)
|
||||||
|
|
||||||
@@ -631,9 +625,6 @@ def cmdLineParser(argv=None):
|
|||||||
general.add_argument("-t", dest="trafficFile",
|
general.add_argument("-t", dest="trafficFile",
|
||||||
help="Log all HTTP traffic into a textual file")
|
help="Log all HTTP traffic into a textual file")
|
||||||
|
|
||||||
general.add_argument("--abort-on-empty", dest="abortOnEmpty", action="store_true",
|
|
||||||
help="Abort data retrieval on empty results")
|
|
||||||
|
|
||||||
general.add_argument("--answers", dest="answers",
|
general.add_argument("--answers", dest="answers",
|
||||||
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
|
help="Set predefined answers (e.g. \"quit=N,follow=N\")")
|
||||||
|
|
||||||
@@ -667,9 +658,6 @@ def cmdLineParser(argv=None):
|
|||||||
general.add_argument("--charset", dest="charset",
|
general.add_argument("--charset", dest="charset",
|
||||||
help="Blind SQL injection charset (e.g. \"0123456789abcdef\")")
|
help="Blind SQL injection charset (e.g. \"0123456789abcdef\")")
|
||||||
|
|
||||||
general.add_argument("--dump-file", dest="dumpFile",
|
|
||||||
help="Store dumped data to a custom file")
|
|
||||||
|
|
||||||
general.add_argument("--dump-format", dest="dumpFormat",
|
general.add_argument("--dump-format", dest="dumpFormat",
|
||||||
help="Format of dumped data (CSV (default), HTML or SQLITE)")
|
help="Format of dumped data (CSV (default), HTML or SQLITE)")
|
||||||
|
|
||||||
@@ -845,9 +833,6 @@ def cmdLineParser(argv=None):
|
|||||||
parser.add_argument("--vuln-test", dest="vulnTest", action="store_true",
|
parser.add_argument("--vuln-test", dest="vulnTest", action="store_true",
|
||||||
help=SUPPRESS)
|
help=SUPPRESS)
|
||||||
|
|
||||||
parser.add_argument("--disable-json", dest="disableJson", action="store_true",
|
|
||||||
help=SUPPRESS)
|
|
||||||
|
|
||||||
# API options
|
# API options
|
||||||
parser.add_argument("--api", dest="api", action="store_true",
|
parser.add_argument("--api", dest="api", action="store_true",
|
||||||
help=SUPPRESS)
|
help=SUPPRESS)
|
||||||
@@ -1001,7 +986,7 @@ def cmdLineParser(argv=None):
|
|||||||
argv[i] = argv[i].replace("--auth-creds", "--auth-cred", 1)
|
argv[i] = argv[i].replace("--auth-creds", "--auth-cred", 1)
|
||||||
elif argv[i].startswith("--drop-cookie"):
|
elif argv[i].startswith("--drop-cookie"):
|
||||||
argv[i] = argv[i].replace("--drop-cookie", "--drop-set-cookie", 1)
|
argv[i] = argv[i].replace("--drop-cookie", "--drop-set-cookie", 1)
|
||||||
elif re.search(r"\A(--(tamper|ignore-code|skip))(?!-)", argv[i]):
|
elif any(argv[i].startswith(_) for _ in ("--tamper", "--ignore-code", "--skip")):
|
||||||
key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1)
|
key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1)
|
||||||
index = auxIndexes.get(key, None)
|
index = auxIndexes.get(key, None)
|
||||||
if index is None:
|
if index is None:
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -51,6 +51,6 @@ def parseSitemap(url, retVal=None):
|
|||||||
abortedFlag = True
|
abortedFlag = True
|
||||||
warnMsg = "user aborted during sitemap parsing. sqlmap "
|
warnMsg = "user aborted during sitemap parsing. sqlmap "
|
||||||
warnMsg += "will use partial list"
|
warnMsg += "will use partial list"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+10
-13
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -108,7 +108,7 @@ def forgeHeaders(items=None, base=None):
|
|||||||
if conf.cj:
|
if conf.cj:
|
||||||
if HTTP_HEADER.COOKIE in headers:
|
if HTTP_HEADER.COOKIE in headers:
|
||||||
for cookie in conf.cj:
|
for cookie in conf.cj:
|
||||||
if cookie is None or cookie.domain_specified and not (conf.hostname or "").endswith(cookie.domain):
|
if cookie.domain_specified and not (conf.hostname or "").endswith(cookie.domain):
|
||||||
continue
|
continue
|
||||||
|
|
||||||
if ("%s=" % getUnicode(cookie.name)) in getUnicode(headers[HTTP_HEADER.COOKIE]):
|
if ("%s=" % getUnicode(cookie.name)) in getUnicode(headers[HTTP_HEADER.COOKIE]):
|
||||||
@@ -275,8 +275,6 @@ def decodePage(page, contentEncoding, contentType, percentDecode=True):
|
|||||||
|
|
||||||
>>> getText(decodePage(b"<html>foo&bar</html>", None, "text/html; charset=utf-8"))
|
>>> getText(decodePage(b"<html>foo&bar</html>", None, "text/html; charset=utf-8"))
|
||||||
'<html>foo&bar</html>'
|
'<html>foo&bar</html>'
|
||||||
>>> getText(decodePage(b"	", None, "text/html; charset=utf-8"))
|
|
||||||
'\\t'
|
|
||||||
"""
|
"""
|
||||||
|
|
||||||
if not page or (conf.nullConnection and len(page) < 2):
|
if not page or (conf.nullConnection and len(page) < 2):
|
||||||
@@ -341,7 +339,7 @@ def decodePage(page, contentEncoding, contentType, percentDecode=True):
|
|||||||
if not kb.disableHtmlDecoding:
|
if not kb.disableHtmlDecoding:
|
||||||
# e.g. 	Ãëàâà
|
# e.g. 	Ãëàâà
|
||||||
if b"&#" in page:
|
if b"&#" in page:
|
||||||
page = re.sub(b"&#x([0-9a-f]{1,2});", lambda _: decodeHex(_.group(1) if len(_.group(1)) == 2 else b"0%s" % _.group(1)), page)
|
page = re.sub(b"&#x([0-9a-f]{1,2});", lambda _: decodeHex(_.group(1) if len(_.group(1)) == 2 else "0%s" % _.group(1)), page)
|
||||||
page = re.sub(b"&#(\\d{1,3});", lambda _: six.int2byte(int(_.group(1))) if int(_.group(1)) < 256 else _.group(0), page)
|
page = re.sub(b"&#(\\d{1,3});", lambda _: six.int2byte(int(_.group(1))) if int(_.group(1)) < 256 else _.group(0), page)
|
||||||
|
|
||||||
# e.g. %20%28%29
|
# e.g. %20%28%29
|
||||||
@@ -401,14 +399,13 @@ def processResponse(page, responseHeaders, code=None, status=None):
|
|||||||
if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
|
||||||
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", "".join(getUnicode(responseHeaders.headers if responseHeaders else [])), page[:HEURISTIC_PAGE_SIZE_THRESHOLD])
|
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", "".join(getUnicode(responseHeaders.headers if responseHeaders else [])), page[:HEURISTIC_PAGE_SIZE_THRESHOLD])
|
||||||
|
|
||||||
with kb.locks.identYwaf:
|
identYwaf.non_blind.clear()
|
||||||
identYwaf.non_blind.clear()
|
if identYwaf.non_blind_check(rawResponse, silent=True):
|
||||||
if identYwaf.non_blind_check(rawResponse, silent=True):
|
for waf in identYwaf.non_blind:
|
||||||
for waf in set(identYwaf.non_blind):
|
if waf not in kb.identifiedWafs:
|
||||||
if waf not in kb.identifiedWafs:
|
kb.identifiedWafs.add(waf)
|
||||||
kb.identifiedWafs.add(waf)
|
errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf)
|
||||||
errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf)
|
singleTimeLogMessage(errMsg, logging.CRITICAL)
|
||||||
singleTimeLogMessage(errMsg, logging.CRITICAL)
|
|
||||||
|
|
||||||
if kb.originalPage is None:
|
if kb.originalPage is None:
|
||||||
for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX):
|
for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX):
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+17
-36
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -154,7 +154,7 @@ class Connect(object):
|
|||||||
if (len(inspect.stack()) > sys.getrecursionlimit() // 2): # Note: https://github.com/sqlmapproject/sqlmap/issues/4525
|
if (len(inspect.stack()) > sys.getrecursionlimit() // 2): # Note: https://github.com/sqlmapproject/sqlmap/issues/4525
|
||||||
warnMsg = "unable to connect to the target URL"
|
warnMsg = "unable to connect to the target URL"
|
||||||
raise SqlmapConnectionException(warnMsg)
|
raise SqlmapConnectionException(warnMsg)
|
||||||
except (TypeError, UnicodeError):
|
except TypeError:
|
||||||
pass
|
pass
|
||||||
|
|
||||||
try:
|
try:
|
||||||
@@ -169,7 +169,7 @@ class Connect(object):
|
|||||||
|
|
||||||
if conf.proxyList and threadData.retriesCount >= conf.retries and not kb.locks.handlers.locked():
|
if conf.proxyList and threadData.retriesCount >= conf.retries and not kb.locks.handlers.locked():
|
||||||
warnMsg = "changing proxy"
|
warnMsg = "changing proxy"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
conf.proxy = None
|
conf.proxy = None
|
||||||
threadData.retriesCount = 0
|
threadData.retriesCount = 0
|
||||||
@@ -308,11 +308,11 @@ class Connect(object):
|
|||||||
threadData.lastRequestUID = kb.requestCounter
|
threadData.lastRequestUID = kb.requestCounter
|
||||||
|
|
||||||
if conf.proxyFreq:
|
if conf.proxyFreq:
|
||||||
if kb.requestCounter % conf.proxyFreq == 0:
|
if kb.requestCounter % conf.proxyFreq == 1:
|
||||||
conf.proxy = None
|
conf.proxy = None
|
||||||
|
|
||||||
warnMsg = "changing proxy"
|
warnMsg = "changing proxy"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
setHTTPHandlers()
|
setHTTPHandlers()
|
||||||
|
|
||||||
@@ -501,9 +501,6 @@ class Connect(object):
|
|||||||
headers[HTTP_HEADER.HOST] = "localhost"
|
headers[HTTP_HEADER.HOST] = "localhost"
|
||||||
|
|
||||||
for key, value in list(headers.items()):
|
for key, value in list(headers.items()):
|
||||||
if key.upper() == HTTP_HEADER.ACCEPT_ENCODING.upper():
|
|
||||||
value = re.sub(r"(?i)(,)br(,)?", lambda match: ',' if match.group(1) and match.group(2) else "", value) or "identity"
|
|
||||||
|
|
||||||
del headers[key]
|
del headers[key]
|
||||||
if isinstance(value, six.string_types):
|
if isinstance(value, six.string_types):
|
||||||
for char in (r"\r", r"\n"):
|
for char in (r"\r", r"\n"):
|
||||||
@@ -587,8 +584,7 @@ class Connect(object):
|
|||||||
|
|
||||||
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
|
||||||
conf.cj._policy._now = conf.cj._now = int(time.time())
|
conf.cj._policy._now = conf.cj._now = int(time.time())
|
||||||
with conf.cj._cookies_lock:
|
cookies = conf.cj._cookies_for_request(req)
|
||||||
cookies = conf.cj._cookies_for_request(req)
|
|
||||||
requestHeaders += "\r\n%s" % ("Cookie: %s" % ";".join("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value)) for cookie in cookies))
|
requestHeaders += "\r\n%s" % ("Cookie: %s" % ";".join("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value)) for cookie in cookies))
|
||||||
|
|
||||||
if post is not None:
|
if post is not None:
|
||||||
@@ -707,7 +703,7 @@ class Connect(object):
|
|||||||
conn.close()
|
conn.close()
|
||||||
except Exception as ex:
|
except Exception as ex:
|
||||||
warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex)
|
warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex)
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
except SqlmapConnectionException as ex:
|
except SqlmapConnectionException as ex:
|
||||||
if conf.proxyList and not kb.threadException:
|
if conf.proxyList and not kb.threadException:
|
||||||
@@ -734,7 +730,7 @@ class Connect(object):
|
|||||||
except socket.timeout:
|
except socket.timeout:
|
||||||
warnMsg = "connection timed out while trying "
|
warnMsg = "connection timed out while trying "
|
||||||
warnMsg += "to get error page information (%d)" % ex.code
|
warnMsg += "to get error page information (%d)" % ex.code
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
return None, None, None
|
return None, None, None
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
raise
|
raise
|
||||||
@@ -767,11 +763,6 @@ class Connect(object):
|
|||||||
if not multipart:
|
if not multipart:
|
||||||
logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg)
|
logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg)
|
||||||
|
|
||||||
if code in conf.abortCode:
|
|
||||||
errMsg = "aborting due to detected HTTP code '%d'" % code
|
|
||||||
singleTimeLogMessage(errMsg, logging.CRITICAL)
|
|
||||||
raise SystemExit
|
|
||||||
|
|
||||||
if ex.code not in (conf.ignoreCode or []):
|
if ex.code not in (conf.ignoreCode or []):
|
||||||
if ex.code == _http_client.UNAUTHORIZED:
|
if ex.code == _http_client.UNAUTHORIZED:
|
||||||
errMsg = "not authorized, try to provide right HTTP "
|
errMsg = "not authorized, try to provide right HTTP "
|
||||||
@@ -814,7 +805,7 @@ class Connect(object):
|
|||||||
debugMsg = "got HTTP error code: %d ('%s')" % (code, status)
|
debugMsg = "got HTTP error code: %d ('%s')" % (code, status)
|
||||||
logger.debug(debugMsg)
|
logger.debug(debugMsg)
|
||||||
|
|
||||||
except (_urllib.error.URLError, socket.error, socket.timeout, _http_client.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError, ValueError, OverflowError, AttributeError, OSError):
|
except (_urllib.error.URLError, socket.error, socket.timeout, _http_client.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError, ValueError, OverflowError, AttributeError):
|
||||||
tbMsg = traceback.format_exc()
|
tbMsg = traceback.format_exc()
|
||||||
|
|
||||||
if conf.debug:
|
if conf.debug:
|
||||||
@@ -830,7 +821,7 @@ class Connect(object):
|
|||||||
elif "no host given" in tbMsg:
|
elif "no host given" in tbMsg:
|
||||||
warnMsg = "invalid URL address used (%s)" % repr(url)
|
warnMsg = "invalid URL address used (%s)" % repr(url)
|
||||||
raise SqlmapSyntaxException(warnMsg)
|
raise SqlmapSyntaxException(warnMsg)
|
||||||
elif any(_ in tbMsg for _ in ("forcibly closed", "Connection is already closed", "ConnectionAbortedError")):
|
elif "forcibly closed" in tbMsg or "Connection is already closed" in tbMsg:
|
||||||
warnMsg = "connection was forcibly closed by the target URL"
|
warnMsg = "connection was forcibly closed by the target URL"
|
||||||
elif "timed out" in tbMsg:
|
elif "timed out" in tbMsg:
|
||||||
if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED):
|
if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED):
|
||||||
@@ -926,12 +917,6 @@ class Connect(object):
|
|||||||
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
|
||||||
raise SqlmapGenericException(errMsg)
|
raise SqlmapGenericException(errMsg)
|
||||||
|
|
||||||
for _ in (getattr(conn, "redcode", None), code):
|
|
||||||
if _ is not None and _ in conf.abortCode:
|
|
||||||
errMsg = "aborting due to detected HTTP code '%d'" % _
|
|
||||||
singleTimeLogMessage(errMsg, logging.CRITICAL)
|
|
||||||
raise SystemExit
|
|
||||||
|
|
||||||
threadData.lastPage = page
|
threadData.lastPage = page
|
||||||
threadData.lastCode = code
|
threadData.lastCode = code
|
||||||
|
|
||||||
@@ -942,7 +927,7 @@ class Connect(object):
|
|||||||
if conf.retryOn and re.search(conf.retryOn, page, re.I):
|
if conf.retryOn and re.search(conf.retryOn, page, re.I):
|
||||||
if threadData.retriesCount < conf.retries:
|
if threadData.retriesCount < conf.retries:
|
||||||
warnMsg = "forced retry of the request because of undesired page content"
|
warnMsg = "forced retry of the request because of undesired page content"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
return Connect._retryProxy(**kwargs)
|
return Connect._retryProxy(**kwargs)
|
||||||
|
|
||||||
processResponse(page, responseHeaders, code, status)
|
processResponse(page, responseHeaders, code, status)
|
||||||
@@ -1023,10 +1008,9 @@ class Connect(object):
|
|||||||
|
|
||||||
if (kb.postHint or conf.skipUrlEncode) and postUrlEncode:
|
if (kb.postHint or conf.skipUrlEncode) and postUrlEncode:
|
||||||
postUrlEncode = False
|
postUrlEncode = False
|
||||||
if not (conf.skipUrlEncode and contentType): # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5092
|
conf.httpHeaders = [_ for _ in conf.httpHeaders if _[1] != contentType]
|
||||||
conf.httpHeaders = [_ for _ in conf.httpHeaders if _[1] != contentType]
|
contentType = POST_HINT_CONTENT_TYPES.get(kb.postHint, PLAIN_TEXT_CONTENT_TYPE)
|
||||||
contentType = POST_HINT_CONTENT_TYPES.get(kb.postHint, PLAIN_TEXT_CONTENT_TYPE)
|
conf.httpHeaders.append((HTTP_HEADER.CONTENT_TYPE, contentType))
|
||||||
conf.httpHeaders.append((HTTP_HEADER.CONTENT_TYPE, contentType))
|
|
||||||
|
|
||||||
if payload:
|
if payload:
|
||||||
delimiter = conf.paramDel or (DEFAULT_GET_POST_DELIMITER if place != PLACE.COOKIE else DEFAULT_COOKIE_DELIMITER)
|
delimiter = conf.paramDel or (DEFAULT_GET_POST_DELIMITER if place != PLACE.COOKIE else DEFAULT_COOKIE_DELIMITER)
|
||||||
@@ -1190,9 +1174,9 @@ class Connect(object):
|
|||||||
if attempt > 0:
|
if attempt > 0:
|
||||||
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
|
||||||
warnMsg += ". sqlmap is going to retry the request"
|
warnMsg += ". sqlmap is going to retry the request"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.csrfData or (conf.data if conf.csrfUrl == conf.url else None), method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
|
||||||
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
|
||||||
|
|
||||||
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
|
||||||
@@ -1557,10 +1541,7 @@ class Connect(object):
|
|||||||
if payload is None:
|
if payload is None:
|
||||||
value = value.replace(kb.customInjectionMark, "")
|
value = value.replace(kb.customInjectionMark, "")
|
||||||
else:
|
else:
|
||||||
try:
|
value = re.sub(r"\w*%s" % re.escape(kb.customInjectionMark), payload, value)
|
||||||
value = re.sub(r"\w*%s" % re.escape(kb.customInjectionMark), payload, value)
|
|
||||||
except re.error:
|
|
||||||
value = re.sub(r"\w*%s" % re.escape(kb.customInjectionMark), re.escape(payload), value)
|
|
||||||
return value
|
return value
|
||||||
page, headers, code = Connect.getPage(url=_(kb.secondReq[0]), post=_(kb.secondReq[2]), method=kb.secondReq[1], cookie=kb.secondReq[3], silent=silent, auxHeaders=dict(auxHeaders, **dict(kb.secondReq[4])), response=response, raise404=False, ignoreTimeout=timeBasedCompare, refreshing=True)
|
page, headers, code = Connect.getPage(url=_(kb.secondReq[0]), post=_(kb.secondReq[2]), method=kb.secondReq[1], cookie=kb.secondReq[3], silent=silent, auxHeaders=dict(auxHeaders, **dict(kb.secondReq[4])), response=response, raise404=False, ignoreTimeout=timeBasedCompare, refreshing=True)
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -36,8 +36,6 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
Connection class that enables usage of newer SSL protocols.
|
Connection class that enables usage of newer SSL protocols.
|
||||||
|
|
||||||
Reference: http://bugs.python.org/msg128686
|
Reference: http://bugs.python.org/msg128686
|
||||||
|
|
||||||
NOTE: use https://check-tls.akamaized.net/ to check if (e.g.) TLS/SNI is working properly
|
|
||||||
"""
|
"""
|
||||||
|
|
||||||
def __init__(self, *args, **kwargs):
|
def __init__(self, *args, **kwargs):
|
||||||
@@ -63,21 +61,19 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
|
|
||||||
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
# Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
|
||||||
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
# https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
|
||||||
if hasattr(ssl, "SSLContext"):
|
if re.search(r"\A[\d.]+\Z", conf.hostname or "") is None and kb.tlsSNI.get(conf.hostname) is not False and hasattr(ssl, "SSLContext"):
|
||||||
for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1):
|
for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1):
|
||||||
try:
|
try:
|
||||||
sock = create_sock()
|
sock = create_sock()
|
||||||
if protocol not in _contexts:
|
if protocol not in _contexts:
|
||||||
_contexts[protocol] = ssl.SSLContext(protocol)
|
_contexts[protocol] = ssl.SSLContext(protocol)
|
||||||
if getattr(self, "cert_file", None) and getattr(self, "key_file", None):
|
|
||||||
_contexts[protocol].load_cert_chain(certfile=self.cert_file, keyfile=self.key_file)
|
|
||||||
try:
|
try:
|
||||||
# Reference(s): https://askubuntu.com/a/1263098
|
# Reference(s): https://askubuntu.com/a/1263098
|
||||||
# https://askubuntu.com/a/1250807
|
# https://askubuntu.com/a/1250807
|
||||||
_contexts[protocol].set_ciphers("DEFAULT@SECLEVEL=1")
|
_contexts[protocol].set_ciphers("DEFAULT@SECLEVEL=1")
|
||||||
except ssl.SSLError:
|
except ssl.SSLError:
|
||||||
pass
|
pass
|
||||||
result = _contexts[protocol].wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host if re.search(r"\A[\d.]+\Z", self.host or "") is None else None)
|
result = _contexts[protocol].wrap_socket(sock, do_handshake_on_connect=True, server_hostname=conf.hostname)
|
||||||
if result:
|
if result:
|
||||||
success = True
|
success = True
|
||||||
self.sock = result
|
self.sock = result
|
||||||
@@ -90,11 +86,14 @@ class HTTPSConnection(_http_client.HTTPSConnection):
|
|||||||
self._tunnel_host = None
|
self._tunnel_host = None
|
||||||
logger.debug("SSL connection error occurred for '%s' ('%s')" % (_lut[protocol], getSafeExString(ex)))
|
logger.debug("SSL connection error occurred for '%s' ('%s')" % (_lut[protocol], getSafeExString(ex)))
|
||||||
|
|
||||||
elif hasattr(ssl, "wrap_socket"):
|
if kb.tlsSNI.get(conf.hostname) is None:
|
||||||
|
kb.tlsSNI[conf.hostname] = success
|
||||||
|
|
||||||
|
if not success:
|
||||||
for protocol in _protocols:
|
for protocol in _protocols:
|
||||||
try:
|
try:
|
||||||
sock = create_sock()
|
sock = create_sock()
|
||||||
_ = ssl.wrap_socket(sock, keyfile=getattr(self, "key_file"), certfile=getattr(self, "cert_file"), ssl_version=protocol)
|
_ = ssl.wrap_socket(sock, self.key_file, self.cert_file, ssl_version=protocol)
|
||||||
if _:
|
if _:
|
||||||
success = True
|
success = True
|
||||||
self.sock = _
|
self.sock = _
|
||||||
|
|||||||
+8
-13
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
@@ -270,7 +270,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
warnMsg += "of entries for the SQL query provided. "
|
warnMsg += "of entries for the SQL query provided. "
|
||||||
warnMsg += "sqlmap will assume that it returns only "
|
warnMsg += "sqlmap will assume that it returns only "
|
||||||
warnMsg += "one entry"
|
warnMsg += "one entry"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
stopLimit = 1
|
stopLimit = 1
|
||||||
|
|
||||||
@@ -278,7 +278,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
if not count:
|
if not count:
|
||||||
warnMsg = "the SQL query provided does not "
|
warnMsg = "the SQL query provided does not "
|
||||||
warnMsg += "return any output"
|
warnMsg += "return any output"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
return None
|
return None
|
||||||
|
|
||||||
@@ -298,7 +298,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
|
|||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
print()
|
print()
|
||||||
warnMsg = "user aborted during dumping phase"
|
warnMsg = "user aborted during dumping phase"
|
||||||
logger.warning(warnMsg)
|
logger.warn(warnMsg)
|
||||||
|
|
||||||
return outputs
|
return outputs
|
||||||
|
|
||||||
@@ -501,15 +501,10 @@ def getValue(expression, blind=True, union=True, error=True, time=True, fromUser
|
|||||||
kb.safeCharEncode = False
|
kb.safeCharEncode = False
|
||||||
|
|
||||||
if not any((kb.testMode, conf.dummy, conf.offline, conf.noCast, conf.hexConvert)) and value is None and Backend.getDbms() and conf.dbmsHandler and kb.fingerprinted:
|
if not any((kb.testMode, conf.dummy, conf.offline, conf.noCast, conf.hexConvert)) and value is None and Backend.getDbms() and conf.dbmsHandler and kb.fingerprinted:
|
||||||
if conf.abortOnEmpty:
|
warnMsg = "in case of continuous data retrieval problems you are advised to try "
|
||||||
errMsg = "aborting due to empty data retrieval"
|
warnMsg += "a switch '--no-cast' "
|
||||||
logger.critical(errMsg)
|
warnMsg += "or switch '--hex'" if hasattr(queries[Backend.getIdentifiedDbms()], "hex") else ""
|
||||||
raise SystemExit
|
singleTimeWarnMessage(warnMsg)
|
||||||
else:
|
|
||||||
warnMsg = "in case of continuous data retrieval problems you are advised to try "
|
|
||||||
warnMsg += "a switch '--no-cast' "
|
|
||||||
warnMsg += "or switch '--hex'" if hasattr(queries[Backend.getIdentifiedDbms()], "hex") else ""
|
|
||||||
singleTimeWarnMessage(warnMsg)
|
|
||||||
|
|
||||||
# Dirty patch (MSSQL --binary-fields with 0x31003200...)
|
# Dirty patch (MSSQL --binary-fields with 0x31003200...)
|
||||||
if Backend.isDbms(DBMS.MSSQL) and conf.binaryFields:
|
if Backend.isDbms(DBMS.MSSQL) and conf.binaryFields:
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
"""
|
"""
|
||||||
Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/)
|
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
|
||||||
See the file 'LICENSE' for copying permission
|
See the file 'LICENSE' for copying permission
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user