From 3061eec7d8e46935874d5ac931e43deb04207480 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 16:39:13 +0000 Subject: [PATCH 1/6] added test case for web shell command execution and temporary test case for Metasploit integration (--os-pwn) --- xml/livetests.xml | 79 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/xml/livetests.xml b/xml/livetests.xml index 2ffa01e19..ae6136720 100644 --- a/xml/livetests.xml +++ b/xml/livetests.xml @@ -1,6 +1,9 @@ + + + @@ -670,4 +673,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 357da43cead7e6590393d1f91ae8e38d3098c496 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 17:28:41 +0000 Subject: [PATCH 2/6] slight improvement of live test engine and added misc test cases to xml --- lib/core/testing.py | 3 +- xml/livetests.xml | 81 +++++++++++++++++++++++++++++++++++++++------ 2 files changed, 73 insertions(+), 11 deletions(-) diff --git a/lib/core/testing.py b/lib/core/testing.py index 4495edf0e..3937c40d5 100644 --- a/lib/core/testing.py +++ b/lib/core/testing.py @@ -191,6 +191,7 @@ def initCase(switches=None): logger.debug("using output directory '%s' for this test case" % paths.SQLMAP_OUTPUT_PATH) + LOGGER_HANDLER.stream = sys.stdout = StringIO.StringIO() cmdLineOptions = cmdLineParser() cmdLineOptions.liveTest = cmdLineOptions.smokeTest = False @@ -209,11 +210,11 @@ def runCase(switches=None, parse=None): initCase(switches) + LOGGER_HANDLER.stream = sys.stdout = StringIO.StringIO() retVal = True exception = None result = False console = "" - LOGGER_HANDLER.stream = sys.stdout = StringIO.StringIO() try: result = start() diff --git a/xml/livetests.xml b/xml/livetests.xml index ae6136720..8737dc30a 100644 --- a/xml/livetests.xml +++ b/xml/livetests.xml @@ -7,7 +7,7 @@ - + @@ -186,21 +186,13 @@ - - + - - - - - - - @@ -749,4 +741,73 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From a2c58847e67d30dd699aa46cf010f8bb0ad68a57 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 18:29:00 +0000 Subject: [PATCH 3/6] fixed title --- xml/payloads.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xml/payloads.xml b/xml/payloads.xml index 27fb0de3f..6e9155ff2 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -717,7 +717,7 @@ Formats: - MySQL boolean-based blind - WHERE or HAVING clause (RLIKE) + MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE) 1 3 1 From 602405c171fe97c1b2c97cfb7f4d3571d64e24b2 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 18:30:04 +0000 Subject: [PATCH 4/6] added more test cases --- xml/livetests.xml | 56 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/xml/livetests.xml b/xml/livetests.xml index 8737dc30a..8903e35ec 100644 --- a/xml/livetests.xml +++ b/xml/livetests.xml @@ -741,7 +741,58 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -772,6 +823,9 @@ + + + From 77843f44fb40315916694840b4774c91f2e3cab7 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 22:49:02 +0000 Subject: [PATCH 5/6] minor bug fix (issue #314) --- lib/core/agent.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index f9b72b397..57ff0edac 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -680,10 +680,15 @@ class Agent(object): stopLimit = None limitCond = True - limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) - limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I) topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) + limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) + + if hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query2"): + limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I) + else: + limitRegExp2 = None + if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query From 86872956d539367f0ce5b83da4052d85fbeecb24 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 19 Dec 2012 22:55:31 +0000 Subject: [PATCH 6/6] minor bug fix (for PostgreSQL) --- lib/core/agent.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index 57ff0edac..56ec22590 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -732,7 +732,10 @@ class Agent(object): # (or equivalent, depending on the back-end DBMS) word if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): stopLimit += startLimit - _ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) + if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0: + _ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) + else: + _ = expression.index("LIMIT ") expression = expression[:_] elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):