sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-07-29 17:39:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge 429352a0ab into 76905e8728

Browse Source
This commit is contained in:
kun 2018-03-06 13:35:50 +00:00 committed by GitHub
commit 0179945391
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
20 changed files with 68 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1,6 +1,7 @@
*.py[cod] *.py[cod]
*.sw[op]
output/ output/
.sqlmap_history .sqlmap_history
traffic.txt traffic.txt
*~ *~
.idea/ .idea/

5
extra/cloak/cloak.py
View File

@ -7,6 +7,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import os import os
import sys import sys
import zlib import zlib
@ -38,7 +39,7 @@ def decloak(inputFile=None, data=None):
try: try:
data = zlib.decompress(hideAscii(data)) data = zlib.decompress(hideAscii(data))
except: except:
print 'ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
sys.exit(1) sys.exit(1)
finally: finally:
f.close() f.close()
@ -63,7 +64,7 @@ def main():
parser.error(e) parser.error(e)
if not os.path.isfile(args.inputFile): if not os.path.isfile(args.inputFile):
print 'ERROR: the provided input file \'%s\' is non existent' % args.inputFile print('ERROR: the provided input file \'%s\' is non existent' % args.inputFile)
sys.exit(1) sys.exit(1)
if not args.decrypt: if not args.decrypt:

7
extra/dbgtool/dbgtool.py
View File

@ -7,6 +7,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import os import os
import sys import sys
import struct import struct
@ -19,7 +20,7 @@ def convert(inputFile):
fileSize = fileStat.st_size fileSize = fileStat.st_size
if fileSize > 65280: if fileSize > 65280:
print "ERROR: the provided input file '%s' is too big for debug.exe" % inputFile print("ERROR: the provided input file '%s' is too big for debug.exe" % inputFile)
sys.exit(1) sys.exit(1)
script = "n %s\nr cx\n" % os.path.basename(inputFile.replace(".", "_")) script = "n %s\nr cx\n" % os.path.basename(inputFile.replace(".", "_"))
@ -59,7 +60,7 @@ def convert(inputFile):
def main(inputFile, outputFile): def main(inputFile, outputFile):
if not os.path.isfile(inputFile): if not os.path.isfile(inputFile):
print "ERROR: the provided input file '%s' is not a regular file" % inputFile print("ERROR: the provided input file '%s' is not a regular file" % inputFile)
sys.exit(1) sys.exit(1)
script = convert(inputFile) script = convert(inputFile)
@ -70,7 +71,7 @@ def main(inputFile, outputFile):
sys.stdout.write(script) sys.stdout.write(script)
sys.stdout.close() sys.stdout.close()
else: else:
print script print(script)
if __name__ == "__main__": if __name__ == "__main__":
usage = "%s -i <input file> [-o <output file>]" % sys.argv[0] usage = "%s -i <input file> [-o <output file>]" % sys.argv[0]

9
extra/mssqlsig/update.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import codecs import codecs
import os import os
import re import re
@ -22,11 +23,11 @@ MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/t
def updateMSSQLXML(): def updateMSSQLXML():
if not os.path.exists(MSSQL_XML): if not os.path.exists(MSSQL_XML):
errMsg = "[ERROR] file '%s' does not exist. Please run the script from its parent directory" % MSSQL_XML errMsg = "[ERROR] file '%s' does not exist. Please run the script from its parent directory" % MSSQL_XML
print errMsg print(errMsg)
return return
infoMsg = "[INFO] retrieving data from '%s'" % MSSQL_VERSIONS_URL infoMsg = "[INFO] retrieving data from '%s'" % MSSQL_VERSIONS_URL
print infoMsg print(infoMsg)
try: try:
req = urllib2.Request(MSSQL_VERSIONS_URL) req = urllib2.Request(MSSQL_VERSIONS_URL)
@ -39,7 +40,7 @@ def updateMSSQLXML():
warnMsg = "[WARNING] sqlmap was unable to connect to %s," % __mssqlHostname warnMsg = "[WARNING] sqlmap was unable to connect to %s," % __mssqlHostname
warnMsg += " check your Internet connection and retry" warnMsg += " check your Internet connection and retry"
print warnMsg print(warnMsg)
return return
@ -131,7 +132,7 @@ def updateMSSQLXML():
mssqlXml.close() mssqlXml.close()
infoMsg = "[INFO] done. retrieved data parsed and saved into '%s'" % MSSQL_XML infoMsg = "[INFO] done. retrieved data parsed and saved into '%s'" % MSSQL_XML
print infoMsg print(infoMsg)
if __name__ == "__main__": if __name__ == "__main__":
updateMSSQLXML() updateMSSQLXML()

3
extra/safe2bin/safe2bin.py
View File

@ -7,6 +7,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import binascii import binascii
import re import re
import string import string
@ -112,7 +113,7 @@ def main():
parser.error(e) parser.error(e)
if not os.path.isfile(args.inputFile): if not os.path.isfile(args.inputFile):
print 'ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile print('ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile)
sys.exit(1) sys.exit(1)
f = open(args.inputFile, 'r') f = open(args.inputFile, 'r')

3
extra/shutils/duplicates.py
View File

@ -5,6 +5,7 @@
# Removes duplicate entries in wordlist like files # Removes duplicate entries in wordlist like files
from __future__ import print_function
import sys import sys
if len(sys.argv) > 0: if len(sys.argv) > 0:
@ -17,7 +18,7 @@ if len(sys.argv) > 0:
str.encode(item) str.encode(item)
if item in items: if item in items:
if item: if item:
print item print(item)
else: else:
items.append(item) items.append(item)
except: except:

19
extra/shutils/pylint.py
View File

@ -3,6 +3,7 @@
# Runs pylint on all python scripts found in a directory tree # Runs pylint on all python scripts found in a directory tree
# Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html # Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html
from __future__ import print_function
import os import os
import re import re
import sys import sys
@ -17,26 +18,26 @@ def check(module):
if module[-3:] == ".py": if module[-3:] == ".py":
print "CHECKING ", module print("CHECKING ", module)
pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r') pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r')
for line in pout: for line in pout:
if re.match(r"\AE:", line): if re.match(r"\AE:", line):
print line.strip() print(line.strip())
if __RATING__ and "Your code has been rated at" in line: if __RATING__ and "Your code has been rated at" in line:
print line print(line)
score = re.findall(r"\d.\d\d", line)[0] score = re.findall(r"\d.\d\d", line)[0]
total += float(score) total += float(score)
count += 1 count += 1
if __name__ == "__main__": if __name__ == "__main__":
try: try:
print sys.argv print(sys.argv)
BASE_DIRECTORY = sys.argv[1] BASE_DIRECTORY = sys.argv[1]
except IndexError: except IndexError:
print "no directory specified, defaulting to current working directory" print("no directory specified, defaulting to current working directory")
BASE_DIRECTORY = os.getcwd() BASE_DIRECTORY = os.getcwd()
print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY print("looking for *.py scripts in subdirectories of ", BASE_DIRECTORY)
for root, dirs, files in os.walk(BASE_DIRECTORY): for root, dirs, files in os.walk(BASE_DIRECTORY):
if any(_ in root for _ in ("extra", "thirdparty")): if any(_ in root for _ in ("extra", "thirdparty")):
continue continue
@ -45,6 +46,6 @@ if __name__ == "__main__":
check(filepath) check(filepath)
if __RATING__: if __RATING__:
print "==" * 50 print("==" * 50)
print "%d modules found" % count print("%d modules found" % count)
print "AVERAGE SCORE = %.02f" % (total / count) print("AVERAGE SCORE = %.02f" % (total / count))

3
extra/shutils/regressiontest.py
View File

@ -3,6 +3,7 @@
# Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/) # Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
# See the file 'LICENSE' for copying permission # See the file 'LICENSE' for copying permission
from __future__ import print_function
import codecs import codecs
import inspect import inspect
import os import os
@ -57,7 +58,7 @@ def send_email(msg):
s.quit() s.quit()
# Catch all for SMTP exceptions # Catch all for SMTP exceptions
except smtplib.SMTPException, e: except smtplib.SMTPException, e:
print "Failure to send email: %s" % str(e) print("Failure to send email: %s" % str(e))
def failure_email(msg): def failure_email(msg):
msg = prepare_email(msg) msg = prepare_email(msg)

7
extra/sqlharvest/sqlharvest.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import cookielib import cookielib
import re import re
import socket import socket
@ -76,7 +77,7 @@ def main():
raise raise
except Exception, msg: except Exception, msg:
print msg print(msg)
if abort: if abort:
break break
@ -86,7 +87,7 @@ def main():
sys.stdout.write("---------------\n") sys.stdout.write("---------------\n")
for sqlfile in files: for sqlfile in files:
print sqlfile print(sqlfile)
try: try:
req = urllib2.Request(sqlfile) req = urllib2.Request(sqlfile)
@ -119,7 +120,7 @@ def main():
raise raise
except Exception, msg: except Exception, msg:
print msg print(msg)
else: else:
i += 1 i += 1

7
lib/core/threads.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import difflib import difflib
import random import random
import threading import threading
@ -167,7 +168,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
time.sleep(0.1) time.sleep(0.1)
except (KeyboardInterrupt, SqlmapUserQuitException), ex: except (KeyboardInterrupt, SqlmapUserQuitException), ex:
print print()
kb.threadContinue = False kb.threadContinue = False
kb.threadException = True kb.threadException = True
@ -184,7 +185,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
raise raise
except (SqlmapConnectionException, SqlmapValueException), ex: except (SqlmapConnectionException, SqlmapValueException), ex:
print print()
kb.threadException = True kb.threadException = True
logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message)) logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message))
@ -194,7 +195,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
except: except:
from lib.core.common import unhandledExceptionMessage from lib.core.common import unhandledExceptionMessage
print print()
kb.threadException = True kb.threadException = True
errMsg = unhandledExceptionMessage() errMsg = unhandledExceptionMessage()
logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg))

5
lib/parse/cmdline.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import os import os
import re import re
import shlex import shlex
@ -886,7 +887,7 @@ def cmdLineParser(argv=None):
command = raw_input("sqlmap-shell> ").strip() command = raw_input("sqlmap-shell> ").strip()
command = getUnicode(command, encoding=sys.stdin.encoding) command = getUnicode(command, encoding=sys.stdin.encoding)
except (KeyboardInterrupt, EOFError): except (KeyboardInterrupt, EOFError):
print print()
raise SqlmapShellQuitException raise SqlmapShellQuitException
if not command: if not command:
@ -930,7 +931,7 @@ def cmdLineParser(argv=None):
argv[i] = argv[i][:-1] argv[i] = argv[i][:-1]
conf.skipThreadCheck = True conf.skipThreadCheck = True
elif argv[i] == "--version": elif argv[i] == "--version":
print VERSION_STRING.split('/')[-1] print(VERSION_STRING.split('/')[-1])
raise SystemExit raise SystemExit
elif argv[i] in ("-h", "--help"): elif argv[i] in ("-h", "--help"):
advancedHelp = False advancedHelp = False

5
lib/request/dns.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import os import os
import re import re
import socket import socket
@ -145,13 +146,13 @@ if __name__ == "__main__":
if _ is None: if _ is None:
break break
else: else:
print "[i] %s" % _ print("[i] %s" % _)
time.sleep(1) time.sleep(1)
except socket.error, ex: except socket.error, ex:
if 'Permission' in str(ex): if 'Permission' in str(ex):
print "[x] Please run with sudo/Administrator privileges" print("[x] Please run with sudo/Administrator privileges")
else: else:
raise raise
except KeyboardInterrupt: except KeyboardInterrupt:

3
lib/request/inject.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import re import re
import time import time
@ -276,7 +277,7 @@ def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, char
raise SqlmapDataException(errMsg) raise SqlmapDataException(errMsg)
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
warnMsg = "user aborted during dumping phase" warnMsg = "user aborted during dumping phase"
logger.warn(warnMsg) logger.warn(warnMsg)

5
lib/takeover/abstraction.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import sys import sys
from extra.safe2bin.safe2bin import safechardecode from extra.safe2bin.safe2bin import safechardecode
@ -130,11 +131,11 @@ class Abstraction(Web, UDF, XP_cmdshell):
command = raw_input("os-shell> ") command = raw_input("os-shell> ")
command = getUnicode(command, encoding=sys.stdin.encoding) command = getUnicode(command, encoding=sys.stdin.encoding)
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
errMsg = "user aborted" errMsg = "user aborted"
logger.error(errMsg) logger.error(errMsg)
except EOFError: except EOFError:
print print()
errMsg = "exit" errMsg = "exit"
logger.error(errMsg) logger.error(errMsg)
break break

3
lib/takeover/metasploit.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import os import os
import re import re
import select import select
@ -492,7 +493,7 @@ class Metasploit:
send_all(proc, "getuid\n") send_all(proc, "getuid\n")
if conf.privEsc: if conf.privEsc:
print print()
infoMsg = "trying to escalate privileges using Meterpreter " infoMsg = "trying to escalate privileges using Meterpreter "
infoMsg += "'getsystem' command which tries different " infoMsg += "'getsystem' command which tries different "

3
lib/techniques/error/use.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import re import re
import time import time
@ -239,7 +240,7 @@ def _errorFields(expression, expressionFields, expressionFieldsList, num=None, e
if not suppressOutput: if not suppressOutput:
if kb.fileReadMode and output and output.strip(): if kb.fileReadMode and output and output.strip():
print print()
elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields): elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields):
status = "[%s] [INFO] %s: %s" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", output if kb.safeCharEncode else safecharencode(output)) status = "[%s] [INFO] %s: %s" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", output if kb.safeCharEncode else safecharencode(output))

3
lib/utils/api.py
View File

@ -6,6 +6,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import contextlib import contextlib
import httplib import httplib
import logging import logging
@ -769,7 +770,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
command = raw_input("api%s> " % (" (%s)" % taskid if taskid else "")).strip() command = raw_input("api%s> " % (" (%s)" % taskid if taskid else "")).strip()
command = re.sub(r"\A(\w+)", lambda match: match.group(1).lower(), command) command = re.sub(r"\A(\w+)", lambda match: match.group(1).lower(), command)
except (EOFError, KeyboardInterrupt): except (EOFError, KeyboardInterrupt):
print print()
break break
if command in ("data", "log", "status", "stop", "kill"): if command in ("data", "log", "status", "stop", "kill"):

5
lib/utils/hash.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
try: try:
from crypt import crypt from crypt import crypt
except ImportError: except ImportError:
@ -1061,7 +1062,7 @@ def dictionaryAttack(attack_dict):
_bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, 0, 1, kb.wordlists, custom_wordlist, conf.api) _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, 0, 1, kb.wordlists, custom_wordlist, conf.api)
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
processException = True processException = True
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
logger.warn(warnMsg) logger.warn(warnMsg)
@ -1155,7 +1156,7 @@ def dictionaryAttack(attack_dict):
found = found_.value found = found_.value
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
processException = True processException = True
warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)"
logger.warn(warnMsg) logger.warn(warnMsg)

5
plugins/generic/custom.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import re import re
import sys import sys
@ -89,11 +90,11 @@ class Custom:
query = raw_input("sql-shell> ") query = raw_input("sql-shell> ")
query = getUnicode(query, encoding=sys.stdin.encoding) query = getUnicode(query, encoding=sys.stdin.encoding)
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
errMsg = "user aborted" errMsg = "user aborted"
logger.error(errMsg) logger.error(errMsg)
except EOFError: except EOFError:
print print()
errMsg = "exit" errMsg = "exit"
logger.error(errMsg) logger.error(errMsg)
break break

13
sqlmap.py
View File

@ -5,6 +5,7 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from __future__ import print_function
import sys import sys
sys.dont_write_bytecode = True sys.dont_write_bytecode = True
@ -185,7 +186,7 @@ def main():
raise SystemExit raise SystemExit
except KeyboardInterrupt: except KeyboardInterrupt:
print print()
errMsg = "user aborted" errMsg = "user aborted"
try: try:
@ -194,7 +195,7 @@ def main():
pass pass
except EOFError: except EOFError:
print print()
errMsg = "exit" errMsg = "exit"
try: try:
@ -206,7 +207,7 @@ def main():
pass pass
except: except:
print print()
errMsg = unhandledExceptionMessage() errMsg = unhandledExceptionMessage()
excMsg = traceback.format_exc() excMsg = traceback.format_exc()
valid = checkIntegrity() valid = checkIntegrity()
@ -217,13 +218,13 @@ def main():
errMsg += "You should retrieve the latest development version from official GitHub " errMsg += "You should retrieve the latest development version from official GitHub "
errMsg += "repository at '%s'" % GIT_PAGE errMsg += "repository at '%s'" % GIT_PAGE
logger.critical(errMsg) logger.critical(errMsg)
print print()
dataToStdout(excMsg) dataToStdout(excMsg)
raise SystemExit raise SystemExit
elif any(_ in excMsg for _ in ("tamper/", "waf/")): elif any(_ in excMsg for _ in ("tamper/", "waf/")):
logger.critical(errMsg) logger.critical(errMsg)
print print()
dataToStdout(excMsg) dataToStdout(excMsg)
raise SystemExit raise SystemExit
@ -391,4 +392,4 @@ if __name__ == "__main__":
main() main()
else: else:
# cancelling postponed imports (because of Travis CI checks) # cancelling postponed imports (because of Travis CI checks)
from lib.controller.controller import start from lib.controller.controller import start