sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 11:03:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Minor refactoring

Browse Source
This commit is contained in:
Miroslav Stampar 2018-02-08 16:49:16 +01:00
parent 5b99180ffe
commit 56a4e507e8
20 changed files with 53 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.github/CONTRIBUTING.md vendored
View File

@ -24,7 +24,6 @@ Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md)
In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions: In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions:
* Each patch should make one logical change. * Each patch should make one logical change.
* Wrap code to 76 columns when possible.
* Avoid tabbing, use four blank spaces instead. * Avoid tabbing, use four blank spaces instead.
* Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:dev@sqlmap.org). * Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:dev@sqlmap.org).
* Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected. * Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected.

2
lib/core/settings.py
View File

@ -19,7 +19,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME
from lib.core.enums import OS from lib.core.enums import OS
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.2.2.5" VERSION = "1.2.2.6"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

4
tamper/appendnullbyte.py
View File

@ -5,12 +5,14 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOWEST __priority__ = PRIORITY.LOWEST
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ACCESS))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

2
tamper/base64encode.py
View File

@ -10,7 +10,7 @@ import base64
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
from lib.core.settings import UNICODE_ENCODING from lib.core.settings import UNICODE_ENCODING
__priority__ = PRIORITY.LOWEST __priority__ = PRIORITY.LOW
def dependencies(): def dependencies():
pass pass

2
tamper/bluecoat.py
View File

@ -18,7 +18,7 @@ def dependencies():
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """
Replaces space character after SQL statement with a valid random blank character. Replaces space character after SQL statement with a valid random blank character.
Afterwards replace character = with LIKE operator Afterwards replace character '=' with operator LIKE
Requirement: Requirement:
* Blue Coat SGOS with WAF activated as documented in * Blue Coat SGOS with WAF activated as documented in

2
tamper/charunicodeescape.py
View File

@ -9,7 +9,7 @@ import string
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOWEST __priority__ = PRIORITY.NORMAL
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

4
tamper/commalesslimit.py
View File

@ -7,12 +7,14 @@ See the file 'LICENSE' for copying permission
import re import re
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGH __priority__ = PRIORITY.HIGH
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

3
tamper/commalessmid.py
View File

@ -9,12 +9,13 @@ import os
import re import re
from lib.core.common import singleTimeWarnMessage from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGH __priority__ = PRIORITY.HIGH
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

2
tamper/commentbeforeparentheses.py
View File

@ -9,7 +9,7 @@ import re
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW __priority__ = PRIORITY.NORMAL
def dependencies(): def dependencies():
pass pass

4
tamper/concat2concatws.py
View File

@ -5,12 +5,14 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST __priority__ = PRIORITY.HIGHEST
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

2
tamper/escapequotes.py
View File

@ -7,7 +7,7 @@ See the file 'LICENSE' for copying permission
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOWEST __priority__ = PRIORITY.NORMAL
def dependencies(): def dependencies():
pass pass

2
tamper/informationschemacomment.py
View File

@ -9,7 +9,7 @@ import re
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW __priority__ = PRIORITY.NORMAL
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

3
tamper/lowercase.py
View File

@ -28,7 +28,6 @@ def tamper(payload, **kwargs):
Notes: Notes:
* Useful to bypass very weak and bespoke web application firewalls * Useful to bypass very weak and bespoke web application firewalls
that has poorly written permissive regular expressions that has poorly written permissive regular expressions
* This tamper script should work against all (?) databases
>>> tamper('INSERT') >>> tamper('INSERT')
'insert' 'insert'
@ -37,7 +36,7 @@ def tamper(payload, **kwargs):
retVal = payload retVal = payload
if payload: if payload:
for match in re.finditer(r"[A-Za-z_]+", retVal): for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
word = match.group() word = match.group()
if word.upper() in kb.keywords: if word.upper() in kb.keywords:

4
tamper/modsecurityversioned.py
View File

@ -6,12 +6,14 @@ See the file 'LICENSE' for copying permission
""" """
from lib.core.common import randomInt from lib.core.common import randomInt
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHER __priority__ = PRIORITY.HIGHER
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

4
tamper/modsecurityzeroversioned.py
View File

@ -5,12 +5,14 @@ Copyright (c) 2006-2018 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission See the file 'LICENSE' for copying permission
""" """
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHER __priority__ = PRIORITY.HIGHER
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """

2
tamper/multiplespaces.py
View File

@ -36,7 +36,7 @@ def tamper(payload, **kwargs):
if payload: if payload:
words = set() words = set()
for match in re.finditer(r"[A-Za-z_]+", payload): for match in re.finditer(r"\b[A-Za-z_]+\b", payload):
word = match.group() word = match.group()
if word.upper() in kb.keywords: if word.upper() in kb.keywords:

6
tamper/plus2concat.py
View File

@ -7,13 +7,15 @@ See the file 'LICENSE' for copying permission
import re import re
from lib.core.common import singleTimeWarnMessage
from lib.core.common import zeroDepthSearch from lib.core.common import zeroDepthSearch
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST __priority__ = PRIORITY.HIGHEST
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """
@ -58,7 +60,7 @@ def tamper(payload, **kwargs):
retVal = "%sCONCAT(%s)%s" % (retVal[:start], ''.join(chars)[start:end], retVal[end:]) retVal = "%sCONCAT(%s)%s" % (retVal[:start], ''.join(chars)[start:end], retVal[end:])
else: else:
match = re.search(r"\((CHAR\(\d+.+CHAR\(\d+\))\)", retVal) match = re.search(r"\((CHAR\(\d+.+\bCHAR\(\d+\))\)", retVal)
if match: if match:
part = match.group(0) part = match.group(0)
indexes = set(zeroDepthSearch(match.group(1), '+')) indexes = set(zeroDepthSearch(match.group(1), '+'))

6
tamper/plus2fnconcat.py
View File

@ -7,13 +7,15 @@ See the file 'LICENSE' for copying permission
import re import re
from lib.core.common import singleTimeWarnMessage
from lib.core.common import zeroDepthSearch from lib.core.common import zeroDepthSearch
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST __priority__ = PRIORITY.HIGHEST
def dependencies(): def dependencies():
pass singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL))
def tamper(payload, **kwargs): def tamper(payload, **kwargs):
""" """
@ -64,7 +66,7 @@ def tamper(payload, **kwargs):
retVal = "%s%s%s)}%s" % (retVal[:start], "{fn CONCAT(" * count, ''.join(chars)[start:end].replace('\x01', ")},"), retVal[end:]) retVal = "%s%s%s)}%s" % (retVal[:start], "{fn CONCAT(" * count, ''.join(chars)[start:end].replace('\x01', ")},"), retVal[end:])
else: else:
match = re.search(r"\((CHAR\(\d+.+CHAR\(\d+\))\)", retVal) match = re.search(r"\((CHAR\(\d+.+\bCHAR\(\d+\))\)", retVal)
if match: if match:
part = match.group(0) part = match.group(0)
indexes = set(zeroDepthSearch(match.group(1), '+')) indexes = set(zeroDepthSearch(match.group(1), '+'))

2
tamper/randomcase.py
View File

@ -40,7 +40,7 @@ def tamper(payload, **kwargs):
retVal = payload retVal = payload
if payload: if payload:
for match in re.finditer(r"[A-Za-z_]+", retVal): for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
word = match.group() word = match.group()
if word.upper() in kb.keywords: if word.upper() in kb.keywords:

36
txt/checksum.md5
View File

@ -46,7 +46,7 @@ ffa5f01f39b17c8d73423acca6cfe86a lib/core/readlineng.py
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py 0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
fcb74fcc9577523524659ec49e2e964b lib/core/session.py fcb74fcc9577523524659ec49e2e964b lib/core/session.py
15c5a15fc1c24170aff99c32d2bae75d lib/core/settings.py 99f9e29606ab1c3f48c822c77d1dc18b lib/core/settings.py
d0adc28a38e43a787df4471f7f027413 lib/core/shell.py d0adc28a38e43a787df4471f7f027413 lib/core/shell.py
63491be462c515a1a3880c27c2acc4a2 lib/core/subprocessng.py 63491be462c515a1a3880c27c2acc4a2 lib/core/subprocessng.py
505aaa61e1bba3c3d4567c3e667699e3 lib/core/target.py 505aaa61e1bba3c3d4567c3e667699e3 lib/core/target.py
@ -227,39 +227,39 @@ c3cc8b7727161e64ab59f312c33b541a shell/stagers/stager.aspx_
3e2e790c370442c3d98eaa88a3523b15 sqlmap.py 3e2e790c370442c3d98eaa88a3523b15 sqlmap.py
4c3b8a7daa4bff52e01d4168be0eedbe tamper/apostrophemask.py 4c3b8a7daa4bff52e01d4168be0eedbe tamper/apostrophemask.py
4115a55b8aba464723d645b7d3156b6e tamper/apostrophenullencode.py 4115a55b8aba464723d645b7d3156b6e tamper/apostrophenullencode.py
4b1024cecb00f13a4e1be78391e9cedb tamper/appendnullbyte.py 5be6e24825d34437512b9021f35ee026 tamper/appendnullbyte.py
84e6ad0010ed1d9a326d51b493116256 tamper/base64encode.py 0298d81e9dfac7ff18a5236c0f1d84b6 tamper/base64encode.py
55e9fbe57967e57a05a8ca77c312dc70 tamper/between.py 55e9fbe57967e57a05a8ca77c312dc70 tamper/between.py
f942ad818d3e26ec34f0d15ca8b84207 tamper/bluecoat.py e1d2329adc6ca89828a2eaec2951806c tamper/bluecoat.py
e3cdf13caedb4682bee3ff8fac103606 tamper/chardoubleencode.py e3cdf13caedb4682bee3ff8fac103606 tamper/chardoubleencode.py
3b2f68476fbcf8223199e8dd4ec14b64 tamper/charencode.py 3b2f68476fbcf8223199e8dd4ec14b64 tamper/charencode.py
b502023ac6c48e49e652ba524b8e18cc tamper/charunicodeencode.py b502023ac6c48e49e652ba524b8e18cc tamper/charunicodeencode.py
8bc697b143bba852b459806fcfaa5422 tamper/charunicodeescape.py 2c2b38974dc773568de7e7d771d7042c tamper/charunicodeescape.py
9e9719d822afab818d6a8a42351baa40 tamper/commalesslimit.py 763aa317d43909a51dd4c2f36834718d tamper/commalesslimit.py
7f0110c706aca9cd090c0371e6d1a4cb tamper/commalessmid.py 211bb8fa36a6ecb42b719c951c362851 tamper/commalessmid.py
8070799415795bd6f23d11d02b99fbe9 tamper/commentbeforeparentheses.py 19acfde79c9a2d8458e15182f5b73d71 tamper/commentbeforeparentheses.py
6498568524665729cb04a41c5f67f975 tamper/concat2concatws.py 61f895acaaf3dea78e237bdf5fe30a81 tamper/concat2concatws.py
dcdc433fe946f1b9005bcd427a951dd6 tamper/equaltolike.py dcdc433fe946f1b9005bcd427a951dd6 tamper/equaltolike.py
0a61e7b57ad593202b8449601e757f16 tamper/escapequotes.py 06df880df5d8749963f5562f60fd1637 tamper/escapequotes.py
4393cc5220d2e39c5c9c5a9af4e2635d tamper/greatest.py 4393cc5220d2e39c5c9c5a9af4e2635d tamper/greatest.py
25ec62158d3e289bda8a04c8b65686ba tamper/halfversionedmorekeywords.py 25ec62158d3e289bda8a04c8b65686ba tamper/halfversionedmorekeywords.py
9d8c350cbb90d4b21ec9c9db184a213a tamper/htmlencode.py 9d8c350cbb90d4b21ec9c9db184a213a tamper/htmlencode.py
838212f289632526777b7224bf8aacf9 tamper/ifnull2casewhenisnull.py 838212f289632526777b7224bf8aacf9 tamper/ifnull2casewhenisnull.py
e2c2b6a67546b36983a72f129a817ec0 tamper/ifnull2ifisnull.py e2c2b6a67546b36983a72f129a817ec0 tamper/ifnull2ifisnull.py
2416ff8e020fc2db29a580f55dcb6fb1 tamper/informationschemacomment.py 91c92ee203e7e619cb547643883924ca tamper/informationschemacomment.py
1e5532ede194ac9c083891c2f02bca93 tamper/__init__.py 1e5532ede194ac9c083891c2f02bca93 tamper/__init__.py
2dc49bcd6c55f4e2322b07fa92685356 tamper/least.py 2dc49bcd6c55f4e2322b07fa92685356 tamper/least.py
22a740e6fbcb8cc3ada430e3fb1be05f tamper/lowercase.py 1834b5409c449d2ea1b70a5038fed9eb tamper/lowercase.py
e44163d21e055805b5e55667e72f5978 tamper/modsecurityversioned.py b7e892fc185927c7eb4a604f87b8b6c1 tamper/modsecurityversioned.py
f83a11d594fad3ed3291074c7b37b281 tamper/modsecurityzeroversioned.py a15ae5a795661fe992bb476346d54794 tamper/modsecurityzeroversioned.py
abd6490408551a8c8226a32fbc2b5345 tamper/multiplespaces.py b4cadf2ddcdc0598c9a3bf24521a2fa1 tamper/multiplespaces.py
be757e4c9a6fb36af7b9a8c444fddb05 tamper/nonrecursivereplacement.py be757e4c9a6fb36af7b9a8c444fddb05 tamper/nonrecursivereplacement.py
e298e486c06bb39d81f10d61a5c4ceec tamper/overlongutf8more.py e298e486c06bb39d81f10d61a5c4ceec tamper/overlongutf8more.py
b9f698556f8333d9fa6eadaab44a77ab tamper/overlongutf8.py b9f698556f8333d9fa6eadaab44a77ab tamper/overlongutf8.py
bc0363e4fc04240c9f7b81e4ecce0714 tamper/percentage.py bc0363e4fc04240c9f7b81e4ecce0714 tamper/percentage.py
4fa8b6c0e7573e395330bb6a405abbaf tamper/plus2concat.py b30240804cce482b6ab77714508de89c tamper/plus2concat.py
5b947c6cd78eab22ee53f5f534c532d3 tamper/plus2fnconcat.py a8f4a85be6e98b53060b066cd18eed15 tamper/plus2fnconcat.py
44fd1c13a7dd6ae792f11afb28976480 tamper/randomcase.py e94a1c7e4dc7450ac224436269d823bb tamper/randomcase.py
6368a971a80b1acbbbc6b76616bd96b9 tamper/randomcomments.py 6368a971a80b1acbbbc6b76616bd96b9 tamper/randomcomments.py
48228322d40d97016b05e408c5234634 tamper/securesphere.py 48228322d40d97016b05e408c5234634 tamper/securesphere.py
cac8a56f8cc6c14524ee392daa5ae2fd tamper/space2comment.py cac8a56f8cc6c14524ee392daa5ae2fd tamper/space2comment.py