sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-03-23 19:34:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

Update for an Issue #161 (now detecting format error messages too)

Browse Source
This commit is contained in:
Miroslav Stampar 2012-08-22 15:51:47 +02:00
parent dbbfee6c93
commit 52351e5d81
2 changed files with 29 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
lib/controller/checks.py
View File

@ -53,6 +53,7 @@ from lib.core.exception import sqlmapNoneDataException
from lib.core.exception import sqlmapSilentQuitException from lib.core.exception import sqlmapSilentQuitException
from lib.core.exception import sqlmapUserQuitException from lib.core.exception import sqlmapUserQuitException
from lib.core.settings import CONSTANT_RATIO from lib.core.settings import CONSTANT_RATIO
from lib.core.settings import FORMAT_EXCEPTION_STRINGS
from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import UNKNOWN_DBMS_VERSION
from lib.core.settings import LOWER_RATIO_BOUND from lib.core.settings import LOWER_RATIO_BOUND
from lib.core.settings import UPPER_RATIO_BOUND from lib.core.settings import UPPER_RATIO_BOUND
@ -620,6 +621,8 @@ def heuristicCheckSqlInjection(place, parameter):
logger.debug(debugMsg) logger.debug(debugMsg)
return None return None
origValue = conf.paramDict[place][parameter]
prefix = "" prefix = ""
suffix = "" suffix = ""
@ -640,31 +643,25 @@ def heuristicCheckSqlInjection(place, parameter):
infoMsg = "heuristic test shows that %s " % place infoMsg = "heuristic test shows that %s " % place
infoMsg += "parameter '%s' might " % parameter infoMsg += "parameter '%s' might " % parameter
casting = False def _(page):
if not result and kb.dynamicParameter: return any(_ in (page or "") for _ in FORMAT_EXCEPTION_STRINGS)
origValue = conf.paramDict[place][parameter]
if origValue and origValue.isdigit(): casting = _(page) and not _(kb.originalPage)
randInt = int(randomInt())
payload = "%s%s%s" % (prefix, "%d-%d" % (int(origValue) + randInt, randInt), suffix) if not casting and not result and kb.dynamicParameter and origValue.isdigit():
randInt = int(randomInt())
payload = "%s%s%s" % (prefix, "%d-%d" % (int(origValue) + randInt, randInt), suffix)
payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE)
result = Request.queryPage(payload, place, raise404=False)
if not result:
randStr = randomStr()
payload = "%s%s%s" % (prefix, "%s%s" % (origValue, randStr), suffix)
payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE)
result = Request.queryPage(payload, place, raise404=False) casting = Request.queryPage(payload, place, raise404=False)
if not result:
randStr = randomStr()
payload = "%s%s%s" % (prefix, "%s%s" % (origValue, randStr), suffix)
payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE)
casting = Request.queryPage(payload, place, raise404=False)
if result:
infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION)
logger.info(infoMsg)
else:
infoMsg += "not be injectable"
logger.warn(infoMsg)
if casting: if casting:
errMsg = "possible integer casting " errMsg = "possible %scasting " % ("integer " if origValue.isdigit() else "")
errMsg += "detected (e.g. %s=(int)$_REQUEST('%s')) " % (parameter, parameter) errMsg += "detected (e.g. %s=(int)$_REQUEST('%s')) " % (parameter, parameter)
errMsg += "at the back-end web application" errMsg += "at the back-end web application"
logger.error(errMsg) logger.error(errMsg)
@ -672,6 +669,14 @@ def heuristicCheckSqlInjection(place, parameter):
message = "do you want to skip those kind of cases (and save scanning time)? [Y/n] " message = "do you want to skip those kind of cases (and save scanning time)? [Y/n] "
kb.ignoreCasted = readInput(message, default='Y').upper() != 'N' kb.ignoreCasted = readInput(message, default='Y').upper() != 'N'
elif result:
infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION)
logger.info(infoMsg)
else:
infoMsg += "not be injectable"
logger.warn(infoMsg)
kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE
return kb.heuristicTest return kb.heuristicTest

3
lib/core/settings.py
View File

@ -452,3 +452,6 @@ GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "wwwroot", "www")
# Maximum length of a help part containing switch/option name(s) # Maximum length of a help part containing switch/option name(s)
MAX_HELP_OPTION_LENGTH = 18 MAX_HELP_OPTION_LENGTH = 18
# Strings for detecting formatting errors
FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "System.FormatException", "java.lang.NumberFormatException")