From 5650abbb4a1a35d7b51a53cb62e4f272a2fe69c5 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Tue, 11 Jun 2019 01:45:23 +0200 Subject: [PATCH] Adding support for argparse --- lib/core/settings.py | 2 +- lib/parse/cmdline.py | 603 +++++++++++++++++++++++-------------------- 2 files changed, 319 insertions(+), 286 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 9ea0824be..dba74647d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.3.6.37" +VERSION = "1.3.6.38" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py index d9aae0af0..d730d6951 100644 --- a/lib/parse/cmdline.py +++ b/lib/parse/cmdline.py @@ -12,10 +12,37 @@ import re import shlex import sys -from optparse import OptionError -from optparse import OptionGroup -from optparse import OptionParser -from optparse import SUPPRESS_HELP +try: + from optparse import OptionError as ArgumentError + from optparse import OptionGroup + from optparse import OptionParser as ArgumentParser + from optparse import SUPPRESS_HELP as SUPPRESS + + ArgumentParser.add_argument = ArgumentParser.add_option + + def _add_argument_group(self, *args, **kwargs): + return self.add_option_group(OptionGroup(self, *args, **kwargs)) + + ArgumentParser.add_argument_group = _add_argument_group + + def _add_argument(self, *args, **kwargs): + return self.add_option(*args, **kwargs) + + OptionGroup.add_argument = _add_argument + +except ImportError: + from argparse import ArgumentParser + from argparse import ArgumentError + from argparse import SUPPRESS + +finally: + def get_actions(instance): + for attr in ("option_list", "_group_actions", "_actions"): + if hasattr(instance, attr): + return getattr(instance, attr) + + def get_groups(parser): + return getattr(parser, "option_groups", None) or getattr(parser, "_action_groups") from lib.core.common import checkOldOptions from lib.core.common import checkSystemEncoding @@ -58,726 +85,732 @@ def cmdLineParser(argv=None): _ = getUnicode(os.path.basename(argv[0]), encoding=sys.stdin.encoding) usage = "%s%s [options]" % ("%s " % os.path.basename(sys.executable) if not IS_WIN else "", "\"%s\"" % _ if " " in _ else _) - parser = OptionParser(usage=usage) + parser = ArgumentParser(usage=usage) try: - parser.add_option("--hh", dest="advancedHelp", + parser.add_argument("--hh", dest="advancedHelp", action="store_true", help="Show advanced help message and exit") - parser.add_option("--version", dest="showVersion", + parser.add_argument("--version", dest="showVersion", action="store_true", help="Show program's version number and exit") - parser.add_option("-v", dest="verbose", type=int, + parser.add_argument("-v", dest="verbose", type=int, help="Verbosity level: 0-6 (default %d)" % defaults.verbose) # Target options - target = OptionGroup(parser, "Target", "At least one of these " + target = parser.add_argument_group("Target", "At least one of these " "options has to be provided to define the target(s)") - target.add_option("-d", dest="direct", help="Connection string " + target.add_argument("-d", dest="direct", help="Connection string " "for direct database connection") - target.add_option("-u", "--url", dest="url", help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") + target.add_argument("-u", "--url", dest="url", help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") - target.add_option("-l", dest="logFile", help="Parse target(s) from Burp " + target.add_argument("-l", dest="logFile", help="Parse target(s) from Burp " "or WebScarab proxy log file") - target.add_option("-x", dest="sitemapUrl", help="Parse target(s) from remote sitemap(.xml) file") + target.add_argument("-x", dest="sitemapUrl", help="Parse target(s) from remote sitemap(.xml) file") - target.add_option("-m", dest="bulkFile", help="Scan multiple targets given " + target.add_argument("-m", dest="bulkFile", help="Scan multiple targets given " "in a textual file ") - target.add_option("-r", dest="requestFile", + target.add_argument("-r", dest="requestFile", help="Load HTTP request from a file") - target.add_option("-g", dest="googleDork", + target.add_argument("-g", dest="googleDork", help="Process Google dork results as target URLs") - target.add_option("-c", dest="configFile", + target.add_argument("-c", dest="configFile", help="Load options from a configuration INI file") # Request options - request = OptionGroup(parser, "Request", "These options can be used " + request = parser.add_argument_group("Request", "These options can be used " "to specify how to connect to the target URL") - request.add_option("--method", dest="method", + request.add_argument("--method", dest="method", help="Force usage of given HTTP method (e.g. PUT)") - request.add_option("--data", dest="data", + request.add_argument("--data", dest="data", help="Data string to be sent through POST (e.g. \"id=1\")") - request.add_option("--param-del", dest="paramDel", + request.add_argument("--param-del", dest="paramDel", help="Character used for splitting parameter values (e.g. &)") - request.add_option("--cookie", dest="cookie", + request.add_argument("--cookie", dest="cookie", help="HTTP Cookie header value (e.g. \"PHPSESSID=a8d127e..\")") - request.add_option("--cookie-del", dest="cookieDel", + request.add_argument("--cookie-del", dest="cookieDel", help="Character used for splitting cookie values (e.g. ;)") - request.add_option("--load-cookies", dest="loadCookies", + request.add_argument("--load-cookies", dest="loadCookies", help="File containing cookies in Netscape/wget format") - request.add_option("--drop-set-cookie", dest="dropSetCookie", action="store_true", + request.add_argument("--drop-set-cookie", dest="dropSetCookie", action="store_true", help="Ignore Set-Cookie header from response") - request.add_option("--user-agent", dest="agent", + request.add_argument("--user-agent", dest="agent", help="HTTP User-Agent header value") - request.add_option("--random-agent", dest="randomAgent", action="store_true", + request.add_argument("--random-agent", dest="randomAgent", action="store_true", help="Use randomly selected HTTP User-Agent header value") - request.add_option("--host", dest="host", + request.add_argument("--host", dest="host", help="HTTP Host header value") - request.add_option("--referer", dest="referer", + request.add_argument("--referer", dest="referer", help="HTTP Referer header value") - request.add_option("-H", "--header", dest="header", + request.add_argument("-H", "--header", dest="header", help="Extra header (e.g. \"X-Forwarded-For: 127.0.0.1\")") - request.add_option("--headers", dest="headers", + request.add_argument("--headers", dest="headers", help="Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")") - request.add_option("--auth-type", dest="authType", + request.add_argument("--auth-type", dest="authType", help="HTTP authentication type (Basic, Digest, NTLM or PKI)") - request.add_option("--auth-cred", dest="authCred", + request.add_argument("--auth-cred", dest="authCred", help="HTTP authentication credentials (name:password)") - request.add_option("--auth-file", dest="authFile", + request.add_argument("--auth-file", dest="authFile", help="HTTP authentication PEM cert/private key file") - request.add_option("--ignore-code", dest="ignoreCode", type=int, + request.add_argument("--ignore-code", dest="ignoreCode", type=int, help="Ignore (problematic) HTTP error code (e.g. 401)") - request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true", + request.add_argument("--ignore-proxy", dest="ignoreProxy", action="store_true", help="Ignore system default proxy settings") - request.add_option("--ignore-redirects", dest="ignoreRedirects", action="store_true", + request.add_argument("--ignore-redirects", dest="ignoreRedirects", action="store_true", help="Ignore redirection attempts") - request.add_option("--ignore-timeouts", dest="ignoreTimeouts", action="store_true", + request.add_argument("--ignore-timeouts", dest="ignoreTimeouts", action="store_true", help="Ignore connection timeouts") - request.add_option("--proxy", dest="proxy", + request.add_argument("--proxy", dest="proxy", help="Use a proxy to connect to the target URL") - request.add_option("--proxy-cred", dest="proxyCred", + request.add_argument("--proxy-cred", dest="proxyCred", help="Proxy authentication credentials (name:password)") - request.add_option("--proxy-file", dest="proxyFile", + request.add_argument("--proxy-file", dest="proxyFile", help="Load proxy list from a file") - request.add_option("--tor", dest="tor", action="store_true", + request.add_argument("--tor", dest="tor", action="store_true", help="Use Tor anonymity network") - request.add_option("--tor-port", dest="torPort", + request.add_argument("--tor-port", dest="torPort", help="Set Tor proxy port other than default") - request.add_option("--tor-type", dest="torType", + request.add_argument("--tor-type", dest="torType", help="Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))") - request.add_option("--check-tor", dest="checkTor", action="store_true", + request.add_argument("--check-tor", dest="checkTor", action="store_true", help="Check to see if Tor is used properly") - request.add_option("--delay", dest="delay", type=float, + request.add_argument("--delay", dest="delay", type=float, help="Delay in seconds between each HTTP request") - request.add_option("--timeout", dest="timeout", type=float, + request.add_argument("--timeout", dest="timeout", type=float, help="Seconds to wait before timeout connection (default %d)" % defaults.timeout) - request.add_option("--retries", dest="retries", type=int, + request.add_argument("--retries", dest="retries", type=int, help="Retries when the connection timeouts (default %d)" % defaults.retries) - request.add_option("--randomize", dest="rParam", + request.add_argument("--randomize", dest="rParam", help="Randomly change value for given parameter(s)") - request.add_option("--safe-url", dest="safeUrl", + request.add_argument("--safe-url", dest="safeUrl", help="URL address to visit frequently during testing") - request.add_option("--safe-post", dest="safePost", + request.add_argument("--safe-post", dest="safePost", help="POST data to send to a safe URL") - request.add_option("--safe-req", dest="safeReqFile", + request.add_argument("--safe-req", dest="safeReqFile", help="Load safe HTTP request from a file") - request.add_option("--safe-freq", dest="safeFreq", type=int, + request.add_argument("--safe-freq", dest="safeFreq", type=int, help="Test requests between two visits to a given safe URL") - request.add_option("--skip-urlencode", dest="skipUrlEncode", action="store_true", + request.add_argument("--skip-urlencode", dest="skipUrlEncode", action="store_true", help="Skip URL encoding of payload data") - request.add_option("--csrf-token", dest="csrfToken", + request.add_argument("--csrf-token", dest="csrfToken", help="Parameter used to hold anti-CSRF token") - request.add_option("--csrf-url", dest="csrfUrl", + request.add_argument("--csrf-url", dest="csrfUrl", help="URL address to visit for extraction of anti-CSRF token") - request.add_option("--force-ssl", dest="forceSSL", action="store_true", + request.add_argument("--force-ssl", dest="forceSSL", action="store_true", help="Force usage of SSL/HTTPS") - request.add_option("--chunked", dest="chunked", action="store_true", + request.add_argument("--chunked", dest="chunked", action="store_true", help="Use HTTP chunked transfer encoded (POST) requests") - request.add_option("--hpp", dest="hpp", action="store_true", + request.add_argument("--hpp", dest="hpp", action="store_true", help="Use HTTP parameter pollution method") - request.add_option("--eval", dest="evalCode", + request.add_argument("--eval", dest="evalCode", help="Evaluate provided Python code before the request (e.g. \"import hashlib;id2=hashlib.md5(id).hexdigest()\")") # Optimization options - optimization = OptionGroup(parser, "Optimization", "These options can be used to optimize the performance of sqlmap") + optimization = parser.add_argument_group("Optimization", "These options can be used to optimize the performance of sqlmap") - optimization.add_option("-o", dest="optimize", action="store_true", + optimization.add_argument("-o", dest="optimize", action="store_true", help="Turn on all optimization switches") - optimization.add_option("--predict-output", dest="predictOutput", action="store_true", + optimization.add_argument("--predict-output", dest="predictOutput", action="store_true", help="Predict common queries output") - optimization.add_option("--keep-alive", dest="keepAlive", action="store_true", + optimization.add_argument("--keep-alive", dest="keepAlive", action="store_true", help="Use persistent HTTP(s) connections") - optimization.add_option("--null-connection", dest="nullConnection", action="store_true", + optimization.add_argument("--null-connection", dest="nullConnection", action="store_true", help="Retrieve page length without actual HTTP response body") - optimization.add_option("--threads", dest="threads", type=int, + optimization.add_argument("--threads", dest="threads", type=int, help="Max number of concurrent HTTP(s) " "requests (default %d)" % defaults.threads) # Injection options - injection = OptionGroup(parser, "Injection", "These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts") + injection = parser.add_argument_group("Injection", "These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts") - injection.add_option("-p", dest="testParameter", + injection.add_argument("-p", dest="testParameter", help="Testable parameter(s)") - injection.add_option("--skip", dest="skip", + injection.add_argument("--skip", dest="skip", help="Skip testing for given parameter(s)") - injection.add_option("--skip-static", dest="skipStatic", action="store_true", + injection.add_argument("--skip-static", dest="skipStatic", action="store_true", help="Skip testing parameters that not appear to be dynamic") - injection.add_option("--param-exclude", dest="paramExclude", + injection.add_argument("--param-exclude", dest="paramExclude", help="Regexp to exclude parameters from testing (e.g. \"ses\")") - injection.add_option("--param-filter", dest="paramFilter", + injection.add_argument("--param-filter", dest="paramFilter", help="Select testable parameter(s) by place (e.g. \"POST\")") - injection.add_option("--dbms", dest="dbms", + injection.add_argument("--dbms", dest="dbms", help="Force back-end DBMS to provided value") - injection.add_option("--dbms-cred", dest="dbmsCred", + injection.add_argument("--dbms-cred", dest="dbmsCred", help="DBMS authentication credentials (user:password)") - injection.add_option("--os", dest="os", + injection.add_argument("--os", dest="os", help="Force back-end DBMS operating system to provided value") - injection.add_option("--invalid-bignum", dest="invalidBignum", action="store_true", + injection.add_argument("--invalid-bignum", dest="invalidBignum", action="store_true", help="Use big numbers for invalidating values") - injection.add_option("--invalid-logical", dest="invalidLogical", action="store_true", + injection.add_argument("--invalid-logical", dest="invalidLogical", action="store_true", help="Use logical operations for invalidating values") - injection.add_option("--invalid-string", dest="invalidString", action="store_true", + injection.add_argument("--invalid-string", dest="invalidString", action="store_true", help="Use random strings for invalidating values") - injection.add_option("--no-cast", dest="noCast", action="store_true", + injection.add_argument("--no-cast", dest="noCast", action="store_true", help="Turn off payload casting mechanism") - injection.add_option("--no-escape", dest="noEscape", action="store_true", + injection.add_argument("--no-escape", dest="noEscape", action="store_true", help="Turn off string escaping mechanism") - injection.add_option("--prefix", dest="prefix", + injection.add_argument("--prefix", dest="prefix", help="Injection payload prefix string") - injection.add_option("--suffix", dest="suffix", + injection.add_argument("--suffix", dest="suffix", help="Injection payload suffix string") - injection.add_option("--tamper", dest="tamper", + injection.add_argument("--tamper", dest="tamper", help="Use given script(s) for tampering injection data") # Detection options - detection = OptionGroup(parser, "Detection", "These options can be used to customize the detection phase") + detection = parser.add_argument_group("Detection", "These options can be used to customize the detection phase") - detection.add_option("--level", dest="level", type=int, + detection.add_argument("--level", dest="level", type=int, help="Level of tests to perform (1-5, default %d)" % defaults.level) - detection.add_option("--risk", dest="risk", type=int, + detection.add_argument("--risk", dest="risk", type=int, help="Risk of tests to perform (1-3, default %d)" % defaults.risk) - detection.add_option("--string", dest="string", + detection.add_argument("--string", dest="string", help="String to match when query is evaluated to True") - detection.add_option("--not-string", dest="notString", + detection.add_argument("--not-string", dest="notString", help="String to match when query is evaluated to False") - detection.add_option("--regexp", dest="regexp", + detection.add_argument("--regexp", dest="regexp", help="Regexp to match when query is evaluated to True") - detection.add_option("--code", dest="code", type=int, + detection.add_argument("--code", dest="code", type=int, help="HTTP code to match when query is evaluated to True") - detection.add_option("--text-only", dest="textOnly", action="store_true", + detection.add_argument("--text-only", dest="textOnly", action="store_true", help="Compare pages based only on the textual content") - detection.add_option("--titles", dest="titles", action="store_true", + detection.add_argument("--titles", dest="titles", action="store_true", help="Compare pages based only on their titles") # Techniques options - techniques = OptionGroup(parser, "Techniques", "These options can be used to tweak testing of specific SQL injection techniques") + techniques = parser.add_argument_group("Techniques", "These options can be used to tweak testing of specific SQL injection techniques") - techniques.add_option("--technique", dest="technique", + techniques.add_argument("--technique", dest="technique", help="SQL injection techniques to use (default \"%s\")" % defaults.technique) - techniques.add_option("--time-sec", dest="timeSec", type=int, + techniques.add_argument("--time-sec", dest="timeSec", type=int, help="Seconds to delay the DBMS response (default %d)" % defaults.timeSec) - techniques.add_option("--union-cols", dest="uCols", + techniques.add_argument("--union-cols", dest="uCols", help="Range of columns to test for UNION query SQL injection") - techniques.add_option("--union-char", dest="uChar", + techniques.add_argument("--union-char", dest="uChar", help="Character to use for bruteforcing number of columns") - techniques.add_option("--union-from", dest="uFrom", + techniques.add_argument("--union-from", dest="uFrom", help="Table to use in FROM part of UNION query SQL injection") - techniques.add_option("--dns-domain", dest="dnsDomain", + techniques.add_argument("--dns-domain", dest="dnsDomain", help="Domain name used for DNS exfiltration attack") - techniques.add_option("--second-url", dest="secondUrl", + techniques.add_argument("--second-url", dest="secondUrl", help="Resulting page URL searched for second-order response") - techniques.add_option("--second-req", dest="secondReq", + techniques.add_argument("--second-req", dest="secondReq", help="Load second-order HTTP request from file") # Fingerprint options - fingerprint = OptionGroup(parser, "Fingerprint") + fingerprint = parser.add_argument_group("Fingerprint") - fingerprint.add_option("-f", "--fingerprint", dest="extensiveFp", action="store_true", + fingerprint.add_argument("-f", "--fingerprint", dest="extensiveFp", action="store_true", help="Perform an extensive DBMS version fingerprint") # Enumeration options - enumeration = OptionGroup(parser, "Enumeration", "These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements") + enumeration = parser.add_argument_group("Enumeration", "These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements") - enumeration.add_option("-a", "--all", dest="getAll", action="store_true", + enumeration.add_argument("-a", "--all", dest="getAll", action="store_true", help="Retrieve everything") - enumeration.add_option("-b", "--banner", dest="getBanner", action="store_true", + enumeration.add_argument("-b", "--banner", dest="getBanner", action="store_true", help="Retrieve DBMS banner") - enumeration.add_option("--current-user", dest="getCurrentUser", action="store_true", + enumeration.add_argument("--current-user", dest="getCurrentUser", action="store_true", help="Retrieve DBMS current user") - enumeration.add_option("--current-db", dest="getCurrentDb", action="store_true", + enumeration.add_argument("--current-db", dest="getCurrentDb", action="store_true", help="Retrieve DBMS current database") - enumeration.add_option("--hostname", dest="getHostname", action="store_true", + enumeration.add_argument("--hostname", dest="getHostname", action="store_true", help="Retrieve DBMS server hostname") - enumeration.add_option("--is-dba", dest="isDba", action="store_true", + enumeration.add_argument("--is-dba", dest="isDba", action="store_true", help="Detect if the DBMS current user is DBA") - enumeration.add_option("--users", dest="getUsers", action="store_true", + enumeration.add_argument("--users", dest="getUsers", action="store_true", help="Enumerate DBMS users") - enumeration.add_option("--passwords", dest="getPasswordHashes", action="store_true", + enumeration.add_argument("--passwords", dest="getPasswordHashes", action="store_true", help="Enumerate DBMS users password hashes") - enumeration.add_option("--privileges", dest="getPrivileges", action="store_true", + enumeration.add_argument("--privileges", dest="getPrivileges", action="store_true", help="Enumerate DBMS users privileges") - enumeration.add_option("--roles", dest="getRoles", action="store_true", + enumeration.add_argument("--roles", dest="getRoles", action="store_true", help="Enumerate DBMS users roles") - enumeration.add_option("--dbs", dest="getDbs", action="store_true", + enumeration.add_argument("--dbs", dest="getDbs", action="store_true", help="Enumerate DBMS databases") - enumeration.add_option("--tables", dest="getTables", action="store_true", + enumeration.add_argument("--tables", dest="getTables", action="store_true", help="Enumerate DBMS database tables") - enumeration.add_option("--columns", dest="getColumns", action="store_true", + enumeration.add_argument("--columns", dest="getColumns", action="store_true", help="Enumerate DBMS database table columns") - enumeration.add_option("--schema", dest="getSchema", action="store_true", + enumeration.add_argument("--schema", dest="getSchema", action="store_true", help="Enumerate DBMS schema") - enumeration.add_option("--count", dest="getCount", action="store_true", + enumeration.add_argument("--count", dest="getCount", action="store_true", help="Retrieve number of entries for table(s)") - enumeration.add_option("--dump", dest="dumpTable", action="store_true", + enumeration.add_argument("--dump", dest="dumpTable", action="store_true", help="Dump DBMS database table entries") - enumeration.add_option("--dump-all", dest="dumpAll", action="store_true", + enumeration.add_argument("--dump-all", dest="dumpAll", action="store_true", help="Dump all DBMS databases tables entries") - enumeration.add_option("--search", dest="search", action="store_true", + enumeration.add_argument("--search", dest="search", action="store_true", help="Search column(s), table(s) and/or database name(s)") - enumeration.add_option("--comments", dest="getComments", action="store_true", + enumeration.add_argument("--comments", dest="getComments", action="store_true", help="Check for DBMS comments during enumeration") - enumeration.add_option("--statements", dest="getStatements", action="store_true", + enumeration.add_argument("--statements", dest="getStatements", action="store_true", help="Retrieve SQL statements being run on DBMS") - enumeration.add_option("-D", dest="db", + enumeration.add_argument("-D", dest="db", help="DBMS database to enumerate") - enumeration.add_option("-T", dest="tbl", + enumeration.add_argument("-T", dest="tbl", help="DBMS database table(s) to enumerate") - enumeration.add_option("-C", dest="col", + enumeration.add_argument("-C", dest="col", help="DBMS database table column(s) to enumerate") - enumeration.add_option("-X", dest="exclude", + enumeration.add_argument("-X", dest="exclude", help="DBMS database identifier(s) to not enumerate") - enumeration.add_option("-U", dest="user", + enumeration.add_argument("-U", dest="user", help="DBMS user to enumerate") - enumeration.add_option("--exclude-sysdbs", dest="excludeSysDbs", action="store_true", + enumeration.add_argument("--exclude-sysdbs", dest="excludeSysDbs", action="store_true", help="Exclude DBMS system databases when enumerating tables") - enumeration.add_option("--pivot-column", dest="pivotColumn", + enumeration.add_argument("--pivot-column", dest="pivotColumn", help="Pivot column name") - enumeration.add_option("--where", dest="dumpWhere", + enumeration.add_argument("--where", dest="dumpWhere", help="Use WHERE condition while table dumping") - enumeration.add_option("--start", dest="limitStart", type=int, + enumeration.add_argument("--start", dest="limitStart", type=int, help="First dump table entry to retrieve") - enumeration.add_option("--stop", dest="limitStop", type=int, + enumeration.add_argument("--stop", dest="limitStop", type=int, help="Last dump table entry to retrieve") - enumeration.add_option("--first", dest="firstChar", type=int, + enumeration.add_argument("--first", dest="firstChar", type=int, help="First query output word character to retrieve") - enumeration.add_option("--last", dest="lastChar", type=int, + enumeration.add_argument("--last", dest="lastChar", type=int, help="Last query output word character to retrieve") - enumeration.add_option("--sql-query", dest="sqlQuery", + enumeration.add_argument("--sql-query", dest="sqlQuery", help="SQL statement to be executed") - enumeration.add_option("--sql-shell", dest="sqlShell", action="store_true", + enumeration.add_argument("--sql-shell", dest="sqlShell", action="store_true", help="Prompt for an interactive SQL shell") - enumeration.add_option("--sql-file", dest="sqlFile", + enumeration.add_argument("--sql-file", dest="sqlFile", help="Execute SQL statements from given file(s)") # Brute force options - brute = OptionGroup(parser, "Brute force", "These options can be used to run brute force checks") + brute = parser.add_argument_group("Brute force", "These options can be used to run brute force checks") - brute.add_option("--common-tables", dest="commonTables", action="store_true", + brute.add_argument("--common-tables", dest="commonTables", action="store_true", help="Check existence of common tables") - brute.add_option("--common-columns", dest="commonColumns", action="store_true", + brute.add_argument("--common-columns", dest="commonColumns", action="store_true", help="Check existence of common columns") # User-defined function options - udf = OptionGroup(parser, "User-defined function injection", "These options can be used to create custom user-defined functions") + udf = parser.add_argument_group("User-defined function injection", "These options can be used to create custom user-defined functions") - udf.add_option("--udf-inject", dest="udfInject", action="store_true", + udf.add_argument("--udf-inject", dest="udfInject", action="store_true", help="Inject custom user-defined functions") - udf.add_option("--shared-lib", dest="shLib", + udf.add_argument("--shared-lib", dest="shLib", help="Local path of the shared library") # File system options - filesystem = OptionGroup(parser, "File system access", "These options can be used to access the back-end database management system underlying file system") + filesystem = parser.add_argument_group("File system access", "These options can be used to access the back-end database management system underlying file system") - filesystem.add_option("--file-read", dest="fileRead", + filesystem.add_argument("--file-read", dest="fileRead", help="Read a file from the back-end DBMS file system") - filesystem.add_option("--file-write", dest="fileWrite", + filesystem.add_argument("--file-write", dest="fileWrite", help="Write a local file on the back-end DBMS file system") - filesystem.add_option("--file-dest", dest="fileDest", + filesystem.add_argument("--file-dest", dest="fileDest", help="Back-end DBMS absolute filepath to write to") # Takeover options - takeover = OptionGroup(parser, "Operating system access", "These options can be used to access the back-end database management system underlying operating system") + takeover = parser.add_argument_group("Operating system access", "These options can be used to access the back-end database management system underlying operating system") - takeover.add_option("--os-cmd", dest="osCmd", + takeover.add_argument("--os-cmd", dest="osCmd", help="Execute an operating system command") - takeover.add_option("--os-shell", dest="osShell", action="store_true", + takeover.add_argument("--os-shell", dest="osShell", action="store_true", help="Prompt for an interactive operating system shell") - takeover.add_option("--os-pwn", dest="osPwn", action="store_true", + takeover.add_argument("--os-pwn", dest="osPwn", action="store_true", help="Prompt for an OOB shell, Meterpreter or VNC") - takeover.add_option("--os-smbrelay", dest="osSmb", action="store_true", + takeover.add_argument("--os-smbrelay", dest="osSmb", action="store_true", help="One click prompt for an OOB shell, Meterpreter or VNC") - takeover.add_option("--os-bof", dest="osBof", action="store_true", + takeover.add_argument("--os-bof", dest="osBof", action="store_true", help="Stored procedure buffer overflow " "exploitation") - takeover.add_option("--priv-esc", dest="privEsc", action="store_true", + takeover.add_argument("--priv-esc", dest="privEsc", action="store_true", help="Database process user privilege escalation") - takeover.add_option("--msf-path", dest="msfPath", + takeover.add_argument("--msf-path", dest="msfPath", help="Local path where Metasploit Framework is installed") - takeover.add_option("--tmp-path", dest="tmpPath", + takeover.add_argument("--tmp-path", dest="tmpPath", help="Remote absolute path of temporary files directory") # Windows registry options - windows = OptionGroup(parser, "Windows registry access", "These options can be used to access the back-end database management system Windows registry") + windows = parser.add_argument_group("Windows registry access", "These options can be used to access the back-end database management system Windows registry") - windows.add_option("--reg-read", dest="regRead", action="store_true", + windows.add_argument("--reg-read", dest="regRead", action="store_true", help="Read a Windows registry key value") - windows.add_option("--reg-add", dest="regAdd", action="store_true", + windows.add_argument("--reg-add", dest="regAdd", action="store_true", help="Write a Windows registry key value data") - windows.add_option("--reg-del", dest="regDel", action="store_true", + windows.add_argument("--reg-del", dest="regDel", action="store_true", help="Delete a Windows registry key value") - windows.add_option("--reg-key", dest="regKey", + windows.add_argument("--reg-key", dest="regKey", help="Windows registry key") - windows.add_option("--reg-value", dest="regVal", + windows.add_argument("--reg-value", dest="regVal", help="Windows registry key value") - windows.add_option("--reg-data", dest="regData", + windows.add_argument("--reg-data", dest="regData", help="Windows registry key value data") - windows.add_option("--reg-type", dest="regType", + windows.add_argument("--reg-type", dest="regType", help="Windows registry key value type") # General options - general = OptionGroup(parser, "General", "These options can be used to set some general working parameters") + general = parser.add_argument_group("General", "These options can be used to set some general working parameters") - general.add_option("-s", dest="sessionFile", + general.add_argument("-s", dest="sessionFile", help="Load session from a stored (.sqlite) file") - general.add_option("-t", dest="trafficFile", + general.add_argument("-t", dest="trafficFile", help="Log all HTTP traffic into a textual file") - general.add_option("--batch", dest="batch", action="store_true", + general.add_argument("--batch", dest="batch", action="store_true", help="Never ask for user input, use the default behavior") - general.add_option("--binary-fields", dest="binaryFields", + general.add_argument("--binary-fields", dest="binaryFields", help="Result fields having binary values (e.g. \"digest\")") - general.add_option("--check-internet", dest="checkInternet", action="store_true", + general.add_argument("--check-internet", dest="checkInternet", action="store_true", help="Check Internet connection before assessing the target") - general.add_option("--crawl", dest="crawlDepth", type=int, + general.add_argument("--crawl", dest="crawlDepth", type=int, help="Crawl the website starting from the target URL") - general.add_option("--crawl-exclude", dest="crawlExclude", + general.add_argument("--crawl-exclude", dest="crawlExclude", help="Regexp to exclude pages from crawling (e.g. \"logout\")") - general.add_option("--csv-del", dest="csvDel", + general.add_argument("--csv-del", dest="csvDel", help="Delimiting character used in CSV output (default \"%s\")" % defaults.csvDel) - general.add_option("--charset", dest="charset", + general.add_argument("--charset", dest="charset", help="Blind SQL injection charset (e.g. \"0123456789abcdef\")") - general.add_option("--dump-format", dest="dumpFormat", + general.add_argument("--dump-format", dest="dumpFormat", help="Format of dumped data (CSV (default), HTML or SQLITE)") - general.add_option("--encoding", dest="encoding", + general.add_argument("--encoding", dest="encoding", help="Character encoding used for data retrieval (e.g. GBK)") - general.add_option("--eta", dest="eta", action="store_true", + general.add_argument("--eta", dest="eta", action="store_true", help="Display for each output the estimated time of arrival") - general.add_option("--flush-session", dest="flushSession", action="store_true", + general.add_argument("--flush-session", dest="flushSession", action="store_true", help="Flush session files for current target") - general.add_option("--forms", dest="forms", action="store_true", + general.add_argument("--forms", dest="forms", action="store_true", help="Parse and test forms on target URL") - general.add_option("--fresh-queries", dest="freshQueries", action="store_true", + general.add_argument("--fresh-queries", dest="freshQueries", action="store_true", help="Ignore query results stored in session file") - general.add_option("--har", dest="harFile", + general.add_argument("--har", dest="harFile", help="Log all HTTP traffic into a HAR file") - general.add_option("--hex", dest="hexConvert", action="store_true", + general.add_argument("--hex", dest="hexConvert", action="store_true", help="Use hex conversion during data retrieval") - general.add_option("--output-dir", dest="outputDir", action="store", + general.add_argument("--output-dir", dest="outputDir", action="store", help="Custom output directory path") - general.add_option("--parse-errors", dest="parseErrors", action="store_true", + general.add_argument("--parse-errors", dest="parseErrors", action="store_true", help="Parse and display DBMS error messages from responses") - general.add_option("--preprocess", dest="preprocess", + general.add_argument("--preprocess", dest="preprocess", help="Use given script(s) for preprocessing of response data") - general.add_option("--repair", dest="repair", action="store_true", + general.add_argument("--repair", dest="repair", action="store_true", help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR) - general.add_option("--save", dest="saveConfig", + general.add_argument("--save", dest="saveConfig", help="Save options to a configuration INI file") - general.add_option("--scope", dest="scope", + general.add_argument("--scope", dest="scope", help="Regexp to filter targets from provided proxy log") - general.add_option("--test-filter", dest="testFilter", + general.add_argument("--test-filter", dest="testFilter", help="Select tests by payloads and/or titles (e.g. ROW)") - general.add_option("--test-skip", dest="testSkip", + general.add_argument("--test-skip", dest="testSkip", help="Skip tests by payloads and/or titles (e.g. BENCHMARK)") - general.add_option("--update", dest="updateAll", action="store_true", + general.add_argument("--update", dest="updateAll", action="store_true", help="Update sqlmap") # Miscellaneous options - miscellaneous = OptionGroup(parser, "Miscellaneous") + miscellaneous = parser.add_argument_group("Miscellaneous") - miscellaneous.add_option("-z", dest="mnemonics", + miscellaneous.add_argument("-z", dest="mnemonics", help="Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")") - miscellaneous.add_option("--alert", dest="alert", + miscellaneous.add_argument("--alert", dest="alert", help="Run host OS command(s) when SQL injection is found") - miscellaneous.add_option("--answers", dest="answers", + miscellaneous.add_argument("--answers", dest="answers", help="Set predefined answers (e.g. \"quit=N,follow=N\")") - miscellaneous.add_option("--beep", dest="beep", action="store_true", + miscellaneous.add_argument("--beep", dest="beep", action="store_true", help="Beep on question and/or when SQL injection is found") - miscellaneous.add_option("--cleanup", dest="cleanup", action="store_true", + miscellaneous.add_argument("--cleanup", dest="cleanup", action="store_true", help="Clean up the DBMS from sqlmap specific UDF and tables") - miscellaneous.add_option("--dependencies", dest="dependencies", action="store_true", + miscellaneous.add_argument("--dependencies", dest="dependencies", action="store_true", help="Check for missing (optional) sqlmap dependencies") - miscellaneous.add_option("--disable-coloring", dest="disableColoring", action="store_true", + miscellaneous.add_argument("--disable-coloring", dest="disableColoring", action="store_true", help="Disable console output coloring") - miscellaneous.add_option("--gpage", dest="googlePage", type=int, + miscellaneous.add_argument("--gpage", dest="googlePage", type=int, help="Use Google dork results from specified page number") - miscellaneous.add_option("--list-tampers", dest="listTampers", action="store_true", + miscellaneous.add_argument("--list-tampers", dest="listTampers", action="store_true", help="Display list of available tamper scripts") - miscellaneous.add_option("--mobile", dest="mobile", action="store_true", + miscellaneous.add_argument("--mobile", dest="mobile", action="store_true", help="Imitate smartphone through HTTP User-Agent header") - miscellaneous.add_option("--offline", dest="offline", action="store_true", + miscellaneous.add_argument("--offline", dest="offline", action="store_true", help="Work in offline mode (only use session data)") - miscellaneous.add_option("--purge", dest="purge", action="store_true", + miscellaneous.add_argument("--purge", dest="purge", action="store_true", help="Safely remove all content from sqlmap data directory") - miscellaneous.add_option("--skip-waf", dest="skipWaf", action="store_true", + miscellaneous.add_argument("--skip-waf", dest="skipWaf", action="store_true", help="Skip heuristic detection of WAF/IPS protection") - miscellaneous.add_option("--smart", dest="smart", action="store_true", + miscellaneous.add_argument("--smart", dest="smart", action="store_true", help="Conduct thorough tests only if positive heuristic(s)") - miscellaneous.add_option("--sqlmap-shell", dest="sqlmapShell", action="store_true", + miscellaneous.add_argument("--sqlmap-shell", dest="sqlmapShell", action="store_true", help="Prompt for an interactive sqlmap shell") - miscellaneous.add_option("--tmp-dir", dest="tmpDir", + miscellaneous.add_argument("--tmp-dir", dest="tmpDir", help="Local directory for storing temporary files") - miscellaneous.add_option("--web-root", dest="webRoot", + miscellaneous.add_argument("--web-root", dest="webRoot", help="Web server document root directory (e.g. \"/var/www\")") - miscellaneous.add_option("--wizard", dest="wizard", action="store_true", + miscellaneous.add_argument("--wizard", dest="wizard", action="store_true", help="Simple wizard interface for beginner users") # Hidden and/or experimental options - parser.add_option("--base64", dest="base64Parameter", - help=SUPPRESS_HELP) + parser.add_argument("--base64", dest="base64Parameter", + help=SUPPRESS) # help="Parameter(s) containing Base64 encoded values") - parser.add_option("--crack", dest="hashFile", - help=SUPPRESS_HELP) + parser.add_argument("--crack", dest="hashFile", + help=SUPPRESS) # help="Load and crack hashes from a file (standalone)") - parser.add_option("--dummy", dest="dummy", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--dummy", dest="dummy", action="store_true", + help=SUPPRESS) - parser.add_option("--murphy-rate", dest="murphyRate", type=int, - help=SUPPRESS_HELP) + parser.add_argument("--murphy-rate", dest="murphyRate", type=int, + help=SUPPRESS) - parser.add_option("--debug", dest="debug", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--debug", dest="debug", action="store_true", + help=SUPPRESS) - parser.add_option("--disable-precon", dest="disablePrecon", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--disable-precon", dest="disablePrecon", action="store_true", + help=SUPPRESS) - parser.add_option("--disable-stats", dest="disableStats", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--disable-stats", dest="disableStats", action="store_true", + help=SUPPRESS) - parser.add_option("--profile", dest="profile", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--profile", dest="profile", action="store_true", + help=SUPPRESS) - parser.add_option("--force-dbms", dest="forceDbms", - help=SUPPRESS_HELP) + parser.add_argument("--force-dbms", dest="forceDbms", + help=SUPPRESS) - parser.add_option("--force-dns", dest="forceDns", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--force-dns", dest="forceDns", action="store_true", + help=SUPPRESS) - parser.add_option("--force-pivoting", dest="forcePivoting", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--force-pivoting", dest="forcePivoting", action="store_true", + help=SUPPRESS) - parser.add_option("--smoke-test", dest="smokeTest", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--smoke-test", dest="smokeTest", action="store_true", + help=SUPPRESS) - parser.add_option("--live-test", dest="liveTest", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--live-test", dest="liveTest", action="store_true", + help=SUPPRESS) - parser.add_option("--vuln-test", dest="vulnTest", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--vuln-test", dest="vulnTest", action="store_true", + help=SUPPRESS) - parser.add_option("--stop-fail", dest="stopFail", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--stop-fail", dest="stopFail", action="store_true", + help=SUPPRESS) - parser.add_option("--run-case", dest="runCase", help=SUPPRESS_HELP) + parser.add_argument("--run-case", dest="runCase", help=SUPPRESS) # API options - parser.add_option("--api", dest="api", action="store_true", - help=SUPPRESS_HELP) + parser.add_argument("--api", dest="api", action="store_true", + help=SUPPRESS) - parser.add_option("--taskid", dest="taskid", help=SUPPRESS_HELP) + parser.add_argument("--taskid", dest="taskid", help=SUPPRESS) - parser.add_option("--database", dest="database", help=SUPPRESS_HELP) - - parser.add_option_group(target) - parser.add_option_group(request) - parser.add_option_group(optimization) - parser.add_option_group(injection) - parser.add_option_group(detection) - parser.add_option_group(techniques) - parser.add_option_group(fingerprint) - parser.add_option_group(enumeration) - parser.add_option_group(brute) - parser.add_option_group(udf) - parser.add_option_group(filesystem) - parser.add_option_group(takeover) - parser.add_option_group(windows) - parser.add_option_group(general) - parser.add_option_group(miscellaneous) + parser.add_argument("--database", dest="database", help=SUPPRESS) # Dirty hack to display longer options without breaking into two lines - def _(self, *args): - retVal = parser.formatter._format_option_strings(*args) - if len(retVal) > MAX_HELP_OPTION_LENGTH: - retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - parser.formatter.indent_increment)) % retVal - return retVal + if hasattr(parser, "formatter"): + def _(self, *args): + retVal = parser.formatter._format_option_strings(*args) + if len(retVal) > MAX_HELP_OPTION_LENGTH: + retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - parser.formatter.indent_increment)) % retVal + return retVal - parser.formatter._format_option_strings = parser.formatter.format_option_strings - parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser) + parser.formatter._format_option_strings = parser.formatter.format_option_strings + parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser) + else: + def _format_action_invocation(self, action): + retVal = self.__format_action_invocation(action) + if len(retVal) > MAX_HELP_OPTION_LENGTH: + retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - self._indent_increment)) % retVal + return retVal + + parser.formatter_class.__format_action_invocation = parser.formatter_class._format_action_invocation + parser.formatter_class._format_action_invocation = _format_action_invocation # Dirty hack for making a short option '-hh' - option = parser.get_option("--hh") - option._short_opts = ["-hh"] - option._long_opts = [] + if hasattr(parser, "get_option"): + option = parser.get_option("--hh") + option._short_opts = ["-hh"] + option._long_opts = [] + else: + for action in get_actions(parser): + if action.option_strings == ["--hh"]: + action.option_strings = ["-hh"] + break - # Dirty hack for inherent help message of switch '-h' - option = parser.get_option("-h") - option.help = option.help.capitalize().replace("this help", "basic help") + ## Dirty hack for inherent help message of switch '-h' + if hasattr(parser, "get_option"): + option = parser.get_option("-h") + option.help = option.help.capitalize().replace("this help", "basic help") + else: + for action in get_actions(parser): + if action.option_strings == ["-h", "--help"]: + action.help = action.help.capitalize().replace("this help", "basic help") + break _ = [] prompt = False @@ -800,12 +833,12 @@ def cmdLineParser(argv=None): _ = ["x", "q", "exit", "quit", "clear"] - for option in parser.option_list: + for option in get_actions(parser): _.extend(option._long_opts) _.extend(option._short_opts) - for group in parser.option_groups: - for option in group.option_list: + for group in get_groups(parser): + for option in get_actions(group): _.extend(option._long_opts) _.extend(option._short_opts) @@ -882,15 +915,15 @@ def cmdLineParser(argv=None): raise SystemExit elif argv[i] in ("-h", "--help"): advancedHelp = False - for group in parser.option_groups[:]: + for group in get_groups(parser)[:]: found = False - for option in group.option_list: + for option in get_actions(group): if option.dest not in BASIC_HELP_ITEMS: - option.help = SUPPRESS_HELP + option.help = SUPPRESS else: found = True if not found: - parser.option_groups.remove(group) + get_groups(parser).remove(group) for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)): try: @@ -901,7 +934,7 @@ def cmdLineParser(argv=None): pass try: - (args, _) = parser.parse_args(argv) + (args, _) = parser.parse_known_args(argv) if hasattr(parser, "parse_known_args") else parser.parse_args(argv) except UnicodeEncodeError as ex: dataToStdout("\n[!] %s\n" % getUnicode(ex.object.encode("unicode-escape"))) raise SystemExit @@ -931,7 +964,7 @@ def cmdLineParser(argv=None): return args - except (OptionError, TypeError) as ex: + except (ArgumentError, TypeError) as ex: parser.error(ex) except SystemExit: