sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-05-08 09:43:46 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Miroslav Stampar 2011-03-17 08:54:20 +00:00
parent fbd0cfda29
commit 847ce863e3
1 changed files with 8 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
lib/techniques/inband/union/use.py
View File

@ -13,6 +13,7 @@ import time
from lib.core.agent import agent from lib.core.agent import agent
from lib.core.common import Backend from lib.core.common import Backend
from lib.core.common import calculateDeltaSeconds from lib.core.common import calculateDeltaSeconds
from lib.core.common import extractRegexResult
from lib.core.common import filterStringValue from lib.core.common import filterStringValue
from lib.core.common import getUnicode from lib.core.common import getUnicode
from lib.core.common import initTechnique from lib.core.common import initTechnique
@ -37,6 +38,8 @@ reqCount = 0
def __oneShotUnionUse(expression, unpack=True): def __oneShotUnionUse(expression, unpack=True):
global reqCount global reqCount
check = "(?P<result>%s.*%s)" % (kb.misc.start, kb.misc.stop)
# Prepare expression with delimiters # Prepare expression with delimiters
expression = agent.concatQuery(expression, unpack) expression = agent.concatQuery(expression, unpack)
expression = unescaper.unescape(expression) expression = unescaper.unescape(expression)
@ -53,23 +56,16 @@ def __oneShotUnionUse(expression, unpack=True):
# Perform the request # Perform the request
page, headers = Request.queryPage(payload, content=True, raise404=False) page, headers = Request.queryPage(payload, content=True, raise404=False)
content = "%s%s" % (page or "", listToStrValue(headers.headers if headers else None) or "")
# Remove possible reflective values from content (especially headers part)
content = removeReflectiveValues(content, payload)
reqCount += 1 reqCount += 1
if kb.misc.start not in content or kb.misc.stop not in content: # Parse the returned page to get the exact union-based
return None
# Parse the returned page to get the exact inband
# sql injection output # sql injection output
startPosition = content.index(kb.misc.start) output = extractRegexResult(check, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE) \
endPosition = content.rindex(kb.misc.stop) + len(kb.misc.stop) or extractRegexResult(check, removeReflectiveValues(listToStrValue(headers.headers \
value = getUnicode(content[startPosition:endPosition]) if headers else None), payload), re.DOTALL | re.IGNORECASE)
return value return output
def configUnion(char=None, columns=None): def configUnion(char=None, columns=None):
def __configUnionChar(char): def __configUnionChar(char):