sqlmap/lib/controller/action.py

171 lines
5.0 KiB
Python
Raw Normal View History

2008-10-15 19:38:22 +04:00
#!/usr/bin/env python
"""
2008-10-15 19:56:32 +04:00
$Id$
2008-10-15 19:38:22 +04:00
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
2010-10-15 03:18:29 +04:00
See the file 'doc/COPYING' for copying permission
2008-10-15 19:38:22 +04:00
"""
from lib.controller.handler import setHandler
from lib.core.common import getHtmlErrorFp
2010-09-26 18:02:13 +04:00
from lib.core.common import dataToStdout
2008-10-15 19:38:22 +04:00
from lib.core.data import conf
from lib.core.data import kb
2010-09-30 16:35:45 +04:00
from lib.core.data import paths
2008-10-15 19:38:22 +04:00
from lib.core.exception import sqlmapUnsupportedDBMSException
from lib.core.settings import SUPPORTED_DBMS
from lib.techniques.blind.timebased import timeTest
2010-10-20 13:09:04 +04:00
from lib.techniques.error.test import errorTest
2008-10-15 19:38:22 +04:00
from lib.techniques.inband.union.test import unionTest
from lib.techniques.outband.stacked import stackedTest
2008-10-15 19:38:22 +04:00
def action():
"""
This function exploit the SQL injection on the affected
url parameter and extract requested data from the
back-end database management system or operating system
if possible
"""
# First of all we have to identify the back-end database management
# system to be able to go ahead with the injection
setHandler()
2008-10-15 19:38:22 +04:00
if not conf.dbmsHandler:
htmlParsed = getHtmlErrorFp()
errMsg = "sqlmap was not able to fingerprint the "
errMsg += "back-end database management system"
if htmlParsed:
errMsg += ", but from the HTML error page it was "
errMsg += "possible to determinate that the "
errMsg += "back-end DBMS is %s" % htmlParsed
if htmlParsed and htmlParsed.lower() in SUPPORTED_DBMS:
errMsg += ". Do not specify the back-end DBMS manually, "
errMsg += "sqlmap will fingerprint the DBMS for you"
else:
2010-10-18 15:34:53 +04:00
errMsg += ". Support for this DBMS will be implemented at "
errMsg += "some point"
2008-10-15 19:38:22 +04:00
raise sqlmapUnsupportedDBMSException, errMsg
2010-09-26 18:02:13 +04:00
dataToStdout("%s\n" % conf.dbmsHandler.getFingerprint())
2008-10-15 19:38:22 +04:00
# Techniques options
if conf.stackedTest:
conf.dumper.technic("stacked queries injection payload", stackedTest())
if conf.errorTest:
conf.dumper.technic("error-based injection payload", errorTest())
if conf.timeTest:
conf.dumper.technic("time-based blind injection payload", timeTest())
2010-10-26 03:39:55 +04:00
if conf.unionTest and kb.unionPosition is None:
conf.dumper.technic("inband injection payload", unionTest())
2008-10-15 19:38:22 +04:00
# Enumeration options
if conf.getBanner:
conf.dumper.banner(conf.dbmsHandler.getBanner())
2008-10-15 19:38:22 +04:00
if conf.getCurrentUser:
conf.dumper.currentUser(conf.dbmsHandler.getCurrentUser())
2008-10-15 19:38:22 +04:00
if conf.getCurrentDb:
conf.dumper.currentDb(conf.dbmsHandler.getCurrentDb())
2008-10-15 19:38:22 +04:00
if conf.isDba:
conf.dumper.dba(conf.dbmsHandler.isDba())
2008-10-15 19:38:22 +04:00
if conf.getUsers:
conf.dumper.users(conf.dbmsHandler.getUsers())
2008-10-15 19:38:22 +04:00
if conf.getPasswordHashes:
conf.dumper.userSettings("database management system users password hashes",
conf.dbmsHandler.getPasswordHashes(), "password hash")
2008-10-15 19:38:22 +04:00
if conf.getPrivileges:
conf.dumper.userSettings("database management system users privileges",
conf.dbmsHandler.getPrivileges(), "privilege")
2008-10-15 19:38:22 +04:00
if conf.getRoles:
conf.dumper.userSettings("database management system users roles",
conf.dbmsHandler.getRoles(), "role")
2008-10-15 19:38:22 +04:00
if conf.getDbs:
conf.dumper.dbs(conf.dbmsHandler.getDbs())
2008-10-15 19:38:22 +04:00
if conf.getTables:
conf.dumper.dbTables(conf.dbmsHandler.getTables())
2008-10-15 19:38:22 +04:00
2010-09-30 16:35:45 +04:00
if conf.cExists:
conf.dumper.dbTables(conf.dbmsHandler.tableExists(paths.COMMON_TABLES))
if conf.tableFile:
conf.dumper.dbTables(conf.dbmsHandler.tableExists(conf.tableFile))
2008-10-15 19:38:22 +04:00
if conf.getColumns:
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns())
2008-10-15 19:38:22 +04:00
if conf.dumpTable:
conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
2008-10-15 19:38:22 +04:00
if conf.dumpAll:
conf.dbmsHandler.dumpAll()
if conf.search:
conf.dbmsHandler.search()
2008-10-15 19:38:22 +04:00
if conf.query:
conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
2008-10-15 19:38:22 +04:00
if conf.sqlShell:
conf.dbmsHandler.sqlShell()
# User-defined function options
if conf.udfInject:
conf.dbmsHandler.udfInjectCustom()
2008-10-15 19:38:22 +04:00
# File system options
if conf.rFile:
conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
2008-10-15 19:38:22 +04:00
if conf.wFile:
conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
# Operating system options
if conf.osCmd:
conf.dbmsHandler.osCmd()
2008-10-15 19:38:22 +04:00
if conf.osShell:
conf.dbmsHandler.osShell()
if conf.osPwn:
conf.dbmsHandler.osPwn()
if conf.osSmb:
conf.dbmsHandler.osSmb()
if conf.osBof:
conf.dbmsHandler.osBof()
# Windows registry options
if conf.regRead:
conf.dumper.registerValue(conf.dbmsHandler.regRead())
if conf.regAdd:
conf.dbmsHandler.regAdd()
if conf.regDel:
conf.dbmsHandler.regDel()
# Miscellaneous options
if conf.cleanup:
conf.dbmsHandler.cleanup()
if conf.direct:
conf.dbmsConnector.close()