sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-01-24 08:14:24 +03:00
Code Issues Packages Projects Releases Wiki Activity

update regarding safe character output together with a small fix for newlines

Browse Source
This commit is contained in:
Miroslav Stampar 2011-04-14 09:31:45 +00:00
parent 5dfb55effc
commit 04986be4b9
5 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/core/convert.py
View File

@ -134,20 +134,22 @@ def htmlescape(value):
def htmlunescape(value): def htmlunescape(value):
return value.replace('&amp;', '&').replace('&lt;', '<').replace('&gt;', '>').replace('&quot;', '"').replace('&#39;', "'").replace('&nbsp;', ' ') return value.replace('&amp;', '&').replace('&lt;', '<').replace('&gt;', '>').replace('&quot;', '"').replace('&#39;', "'").replace('&nbsp;', ' ')
def safehexencode(value): def safecharencode(value):
""" """
Returns safe hex representation of a given basestring value Returns safe representation of a given basestring value
>>> safehexencode(u'test123') >>> safecharencode(u'test123')
u'test123' u'test123'
>>> safehexencode(u'test\x01\x02\xff') >>> safecharencode(u'test\x01\x02\xff')
u'test\\01\\02\\03\\ff' u'test\\01\\02\\03\\ff'
""" """
retVal = value retVal = value
if isinstance(value, basestring): if isinstance(value, basestring):
retVal = reduce(lambda x, y: x + (y if (y in string.printable or ord(y) > 255) else '\%02x' % ord(y)), value, unicode()) retVal = reduce(lambda x, y: x + (y if (y in string.printable or ord(y) > 255) else '\%02x' % ord(y)), value, unicode())
for char in "\t\n\r\x0b\x0c":
retVal = retVal.replace(char, repr(char).strip('\''))
elif isinstance(value, list): elif isinstance(value, list):
for i in xrange(len(value)): for i in xrange(len(value)):
retVal[i] = safehexencode(value[i]) retVal[i] = safecharencode(value[i])
return retVal return retVal

8
lib/request/inject.py
View File

@ -27,7 +27,7 @@ from lib.core.common import randomInt
from lib.core.common import readInput from lib.core.common import readInput
from lib.core.common import replaceNewlineTabs from lib.core.common import replaceNewlineTabs
from lib.core.common import safeStringFormat from lib.core.common import safeStringFormat
from lib.core.convert import safehexencode from lib.core.convert import safecharencode
from lib.core.data import conf from lib.core.data import conf
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import logger from lib.core.data import logger
@ -388,7 +388,7 @@ def __goInband(expression, expected=None, sort=True, resumeValue=True, unpack=Tr
return data return data
def getValue(expression, blind=True, inband=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, sort=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeHexEncode=True): def getValue(expression, blind=True, inband=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, sort=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeCharEncode=True):
""" """
Called each time sqlmap inject a SQL query on the SQL injection Called each time sqlmap inject a SQL query on the SQL injection
affected parameter. It can call a function to retrieve the output affected parameter. It can call a function to retrieve the output
@ -494,8 +494,8 @@ def getValue(expression, blind=True, inband=True, error=True, time=True, fromUse
elif value == [None]: elif value == [None]:
value = None value = None
if safeHexEncode: if safeCharEncode:
value = safehexencode(value) value = safecharencode(value)
return value return value

4
lib/techniques/brute/use.py
View File

@ -87,7 +87,7 @@ def tableExists(tableFile, regex=None):
if conf.verbose in (1, 2): if conf.verbose in (1, 2):
clearConsoleLine(True) clearConsoleLine(True)
infoMsg = "\r[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), table) infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), table)
dataToStdout(infoMsg, True) dataToStdout(infoMsg, True)
if conf.verbose in (1, 2): if conf.verbose in (1, 2):
@ -205,7 +205,7 @@ def columnExists(columnFile, regex=None):
if conf.verbose in (1, 2): if conf.verbose in (1, 2):
clearConsoleLine(True) clearConsoleLine(True)
infoMsg = "\r[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), column) infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), column)
dataToStdout(infoMsg, True) dataToStdout(infoMsg, True)
if conf.verbose in (1, 2): if conf.verbose in (1, 2):

4
lib/techniques/error/use.py
View File

@ -24,7 +24,7 @@ from lib.core.common import randomInt
from lib.core.common import replaceNewlineTabs from lib.core.common import replaceNewlineTabs
from lib.core.common import safeStringFormat from lib.core.common import safeStringFormat
from lib.core.convert import htmlunescape from lib.core.convert import htmlunescape
from lib.core.convert import safehexencode from lib.core.convert import safecharencode
from lib.core.data import conf from lib.core.data import conf
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import logger from lib.core.data import logger
@ -136,7 +136,7 @@ def __errorFields(expression, expressionFields, expressionFieldsList, expected=N
output = __oneShotErrorUse(expressionReplaced, field) output = __oneShotErrorUse(expressionReplaced, field)
if output is not None: if output is not None:
dataToStdout("[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), safehexencode(replaceNewlineTabs(output, stdout=True)))) dataToStdout("[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), safecharencode(replaceNewlineTabs(output, stdout=True))))
if isinstance(num, int): if isinstance(num, int):
expression = origExpr expression = origExpr

2
lib/techniques/inband/union/use.py
View File

@ -253,7 +253,7 @@ def unionUse(expression, unpack=True, dump=False):
if conf.verbose == 1: if conf.verbose == 1:
items = output.replace(kb.misc.start, "").replace(kb.misc.stop, "").split(kb.misc.delimiter) items = output.replace(kb.misc.start, "").replace(kb.misc.stop, "").split(kb.misc.delimiter)
status = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), ",".join(map(lambda x: "\"%s\"" % x, items))) status = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), ",".join(map(lambda x: "\"%s\"" % x, items)))
if len(status) > width: if len(status) > width:
status = "%s..." % status[:width - 3] status = "%s..." % status[:width - 3]
dataToStdout(status, True) dataToStdout(status, True)