sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 19:13:48 +03:00
Code Issues Packages Projects Releases Wiki Activity

getPageTextWordsSet on tableExists is pretty powerful stuff

Browse Source
This commit is contained in:
Miroslav Stampar 2010-12-25 09:37:33 +00:00
parent 9853c1ec7f
commit 272476773f
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/techniques/brute/use.py
View File

@ -13,6 +13,7 @@ import time
from lib.core.common import clearConsoleLine from lib.core.common import clearConsoleLine
from lib.core.common import dataToStdout from lib.core.common import dataToStdout
from lib.core.common import getFileItems from lib.core.common import getFileItems
from lib.core.common import getPageTextWordsSet
from lib.core.common import popValue from lib.core.common import popValue
from lib.core.common import pushValue from lib.core.common import pushValue
from lib.core.common import randomInt from lib.core.common import randomInt
@ -21,15 +22,25 @@ from lib.core.data import conf
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import logger from lib.core.data import logger
from lib.core.exception import sqlmapMissingMandatoryOptionException from lib.core.exception import sqlmapMissingMandatoryOptionException
from lib.core.exception import sqlmapThreadException
from lib.core.settings import METADB_SUFFIX from lib.core.settings import METADB_SUFFIX
from lib.request import inject from lib.request import inject
def tableExists(tableFile): def tableExists(tableFile):
tables = getFileItems(tableFile) tables = getFileItems(tableFile)
tableSet = set(tables)
retVal = [] retVal = []
infoMsg = "checking table existence using items from '%s'" % tableFile infoMsg = "checking table existence using items from '%s'" % tableFile
logger.info(infoMsg) logger.info(infoMsg)
infoMsg = "adding words used on web page to check list"
logger.info(infoMsg)
pageWords = getPageTextWordsSet(kb.originalPage)
for word in pageWords:
word = word.lower()
if len(word) > 1 and not word[0].isdigit() and word not in tableSet:
tables.append(word)
count = [0] count = [0]
length = len(tables) length = len(tables)
threads = [] threads = []

2
xml/queries.xml
View File

@ -359,7 +359,7 @@
<tables/> <tables/>
<dump_table> <dump_table>
<inband query="SELECT %s FROM %s"/> <inband query="SELECT %s FROM %s"/>
<blind query="SELECT MIN(%s) FROM %s WHERE CVAR(%s) > '%s'" query2="SELECT %s FROM %s WHERE %s = '%s'" count="SELECT COUNT(*) FROM %s"/> <blind query="SELECT MIN(%s) FROM %s WHERE CVAR(%s) > '%s'" query2="SELECT TOP 1 %s FROM %s WHERE %s LIKE '%s'" count="SELECT COUNT(*) FROM %s"/>
</dump_table> </dump_table>
</dbms> </dbms>