From 38541b021a06b88b8af761d2310e5976272db366 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Sat, 26 Sep 2015 00:09:17 +0200 Subject: [PATCH] Implementing hidden switch '--force-threads' on request (to force multi-threading in time-based SQLi) --- lib/parse/cmdline.py | 3 +++ lib/request/inject.py | 2 +- lib/techniques/blind/inference.py | 7 ++++--- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py index 6d417fc21..4eebceb2c 100644 --- a/lib/parse/cmdline.py +++ b/lib/parse/cmdline.py @@ -763,6 +763,9 @@ def cmdLineParser(argv=None): parser.add_option("--force-dns", dest="forceDns", action="store_true", help=SUPPRESS_HELP) + parser.add_option("--force-threads", dest="forceThreads", action="store_true", + help=SUPPRESS_HELP) + parser.add_option("--smoke-test", dest="smokeTest", action="store_true", help=SUPPRESS_HELP) diff --git a/lib/request/inject.py b/lib/request/inject.py index b12517ce4..13b8984d4 100644 --- a/lib/request/inject.py +++ b/lib/request/inject.py @@ -78,7 +78,7 @@ def _goInference(payload, expression, charsetType=None, firstChar=None, lastChar timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) if not (timeBasedCompare and kb.dnsTest): - if (conf.eta or conf.threads > 1) and Backend.getIdentifiedDbms() and not re.search("(COUNT|LTRIM)\(", expression, re.I) and not timeBasedCompare: + if (conf.eta or conf.threads > 1) and Backend.getIdentifiedDbms() and not re.search("(COUNT|LTRIM)\(", expression, re.I) and not (timeBasedCompare and not conf.forceThreads): if field and re.search("\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", expression, re.I): expression = "SELECT %s FROM (%s)" % (field, expression) diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py index e61b65154..3a6a0cdb7 100644 --- a/lib/techniques/blind/inference.py +++ b/lib/techniques/blind/inference.py @@ -146,12 +146,12 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None if showEta: progress = ProgressBar(maxValue=length) - if timeBasedCompare and conf.threads > 1: + if timeBasedCompare and conf.threads > 1 and not conf.forceThreads: warnMsg = "multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically" singleTimeWarnMessage(warnMsg) if numThreads > 1: - if not timeBasedCompare: + if not timeBasedCompare or conf.forceThreads: debugMsg = "starting %d thread%s" % (numThreads, ("s" if numThreads > 1 else "")) logger.debug(debugMsg) else: @@ -597,8 +597,9 @@ def queryOutputLength(expression, payload): infoMsg = "retrieving the length of query output" logger.info(infoMsg) - lengthExprUnescaped = agent.forgeQueryOutputLength(expression) start = time.time() + + lengthExprUnescaped = agent.forgeQueryOutputLength(expression) count, length = bisection(payload, lengthExprUnescaped, charsetType=CHARSET_TYPE.DIGITS) debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start))