diff --git a/plugins/dbms/sqlite/enumeration.py b/plugins/dbms/sqlite/enumeration.py index 9a43db908..40a0f0ef2 100644 --- a/plugins/dbms/sqlite/enumeration.py +++ b/plugins/dbms/sqlite/enumeration.py @@ -56,7 +56,7 @@ class Enumeration(GenericEnumeration): return [] def searchColumn(self): - errMsg = "on SQLite you must specify the table and columns to dump" + errMsg = "on SQLite it is not possible to search columns" raise SqlmapUnsupportedFeatureException(errMsg) def getHostname(self): diff --git a/plugins/generic/search.py b/plugins/generic/search.py index 4edbfa8c6..a79ff9093 100644 --- a/plugins/generic/search.py +++ b/plugins/generic/search.py @@ -193,6 +193,16 @@ class Search: query += whereDbsQuery values = inject.getValue(query, blind=False, time=False) + if Backend.isDbms(DBMS.SQLITE): + newValues = [] + + if isinstance(values, basestring): + values = [values] + for value in values: + newValues.append(["SQLite_masterdb", value]) + + values = newValues + for foundDb, foundTbl in filterPairValues(values): foundDb = safeSQLIdentificatorNaming(foundDb) foundTbl = safeSQLIdentificatorNaming(foundTbl, True) @@ -205,47 +215,50 @@ class Search: else: foundTbls[foundDb] = [foundTbl] else: - infoMsg = "fetching number of databases with table" - if tblConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) - logger.info(infoMsg) - - query = rootQuery.blind.count - query += tblQuery - query += whereDbsQuery - count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no databases have table" + if not Backend.isDbms(DBMS.SQLITE): + infoMsg = "fetching number of databases with table" if tblConsider == "1": - warnMsg += "s like" - warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) - logger.warn(warnMsg) + infoMsg += "s like" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) + logger.info(infoMsg) - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - query = rootQuery.blind.query + query = rootQuery.blind.count query += tblQuery query += whereDbsQuery - if Backend.isDbms(DBMS.DB2): - query += ") AS foobar" - query = agent.limitQuery(index, query) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - foundDb = unArrayizeValue(inject.getValue(query, union=False, error=False)) - foundDb = safeSQLIdentificatorNaming(foundDb) + if not isNumPosStrValue(count): + warnMsg = "no databases have table" + if tblConsider == "1": + warnMsg += "s like" + warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) + logger.warn(warnMsg) - if foundDb not in foundTbls: - foundTbls[foundDb] = [] + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + query = rootQuery.blind.query + query += tblQuery + query += whereDbsQuery + if Backend.isDbms(DBMS.DB2): + query += ") AS foobar" + query = agent.limitQuery(index, query) + + foundDb = unArrayizeValue(inject.getValue(query, union=False, error=False)) + foundDb = safeSQLIdentificatorNaming(foundDb) + + if foundDb not in foundTbls: + foundTbls[foundDb] = [] + + if tblConsider == "2": + foundTbls[foundDb].append(tbl) if tblConsider == "2": - foundTbls[foundDb].append(tbl) - - if tblConsider == "2": - continue + continue + else: + foundTbls["SQLite_masterdb"] = [] for db in foundTbls.keys(): db = safeSQLIdentificatorNaming(db) @@ -257,7 +270,8 @@ class Search: logger.info(infoMsg) query = rootQuery.blind.count2 - query = query % unsafeSQLIdentificatorNaming(db) + if not Backend.isDbms(DBMS.SQLITE): + query = query % unsafeSQLIdentificatorNaming(db) query += " AND %s" % tblQuery count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) @@ -275,7 +289,8 @@ class Search: for index in indexRange: query = rootQuery.blind.query2 - query = query % unsafeSQLIdentificatorNaming(db) + if not Backend.isDbms(DBMS.SQLITE): + query = query % unsafeSQLIdentificatorNaming(db) query += " AND %s" % tblQuery query = agent.limitQuery(index, query) diff --git a/xml/livetests.xml b/xml/livetests.xml index 84fafe529..21015e621 100644 --- a/xml/livetests.xml +++ b/xml/livetests.xml @@ -10,6 +10,7 @@ + @@ -48,7 +49,7 @@ - + @@ -92,7 +93,7 @@ - + @@ -136,7 +137,7 @@ - + @@ -180,7 +181,7 @@ - + @@ -238,7 +239,7 @@ - + @@ -473,6 +474,383 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -578,6 +956,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1172,6 +1583,43 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1183,7 +1631,7 @@ - + @@ -1194,7 +1642,7 @@ - + @@ -1205,7 +1653,7 @@ - + @@ -1216,7 +1664,7 @@ - + @@ -1227,7 +1675,7 @@ - + @@ -1239,7 +1687,7 @@ - + @@ -1250,7 +1698,7 @@ - + @@ -1261,7 +1709,7 @@ - + @@ -1272,7 +1720,7 @@ - + @@ -1283,7 +1731,7 @@ - + @@ -1294,7 +1742,7 @@ - + @@ -1306,7 +1754,52 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xml/payloads.xml b/xml/payloads.xml index 6e9155ff2..d9cb48b22 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -1977,6 +1977,25 @@ Formats: Oracle + + + SQLite inline queries + 6 + 1 + 1 + 1,2,3,8 + 3 + SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' + + SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))||'[DELIMITER_STOP]' + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ SQLite +
+
diff --git a/xml/queries.xml b/xml/queries.xml index d7db742c0..3a186642e 100644 --- a/xml/queries.xml +++ b/xml/queries.xml @@ -347,7 +347,10 @@ - + + + +