diff --git a/lib/core/agent.py b/lib/core/agent.py index 8ea2ceef9..0e0770b01 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -535,7 +535,7 @@ class Agent(object): elif fieldsNoSelect: concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop) - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2): + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop diff --git a/lib/techniques/error/use.py b/lib/techniques/error/use.py index d2edbb1ec..44e662043 100644 --- a/lib/techniques/error/use.py +++ b/lib/techniques/error/use.py @@ -23,6 +23,7 @@ from lib.core.common import incrementCounter from lib.core.common import initTechnique from lib.core.common import isListLike from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable from lib.core.common import listToStrValue from lib.core.common import readInput from lib.core.common import unArrayizeValue @@ -34,6 +35,7 @@ from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS +from lib.core.enums import PAYLOAD from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD from lib.core.settings import MYSQL_ERROR_CHUNK_LENGTH from lib.core.settings import MSSQL_ERROR_CHUNK_LENGTH @@ -180,6 +182,9 @@ def _errorFields(expression, expressionFields, expressionFieldsList, num=None, e else: expressionReplaced = expression.replace(expressionFields, field, 1) + if isTechniqueAvailable(PAYLOAD.TECHNIQUE.QUERY) and Backend.isDbms(DBMS.FIREBIRD) and expressionReplaced.startswith("SELECT "): + expressionReplaced = "SELECT %s" % agent.concatQuery(expressionReplaced) + output = NULL if emptyFields and field in emptyFields else _oneShotErrorUse(expressionReplaced, field) if not kb.threadContinue: diff --git a/xml/payloads.xml b/xml/payloads.xml index ad3c4c9e9..e574d12be 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -2004,7 +2004,7 @@ Formats: 1,2,3,8 3 - SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' + [QUERY] SELECT '[DELIMITER_START]'||(CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' FROM RDB$DATABASE