sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-01-24 16:24:25 +03:00
Code Issues Packages Projects Releases Wiki Activity

minor improvement over last version - case insensitive and takes in count cases like " UNION ALL selects " from MySQL error message

Browse Source
This commit is contained in:
Miroslav Stampar 2011-01-23 10:51:57 +00:00
parent 3a5f0760f6
commit 97f66a87c5
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/techniques/inband/union/test.py
View File

@ -13,6 +13,7 @@ from lib.core.agent import agent
from lib.core.common import clearConsoleLine from lib.core.common import clearConsoleLine
from lib.core.common import dataToStdout from lib.core.common import dataToStdout
from lib.core.common import backend from lib.core.common import backend
from lib.core.common import extractRegexResult
from lib.core.common import getUnicode from lib.core.common import getUnicode
from lib.core.common import parseUnionPage from lib.core.common import parseUnionPage
from lib.core.common import randomStr from lib.core.common import randomStr
@ -47,7 +48,7 @@ def __unionPosition(comment, place, parameter, value, prefix, suffix, count, whe
# Perform the request # Perform the request
resultPage, _ = Request.queryPage(payload, place=place, content=True, raise404=False) resultPage, _ = Request.queryPage(payload, place=place, content=True, raise404=False)
if resultPage and randQuery in resultPage and " UNION ALL SELECT " not in resultPage: if resultPage and randQuery in resultPage and not extractRegexResult('(?P<result>UNION ALL SELECT)', resultPage, re.I):
validPayload = payload validPayload = payload
vector = (position, count, comment, prefix, suffix, conf.uChar, where) vector = (position, count, comment, prefix, suffix, conf.uChar, where)
@ -64,7 +65,7 @@ def __unionPosition(comment, place, parameter, value, prefix, suffix, count, whe
# Perform the request # Perform the request
resultPage, _ = Request.queryPage(payload, place=place, content=True, raise404=False) resultPage, _ = Request.queryPage(payload, place=place, content=True, raise404=False)
if resultPage and " UNION ALL SELECT " not in resultPage and ((randQuery in resultPage and randQuery2 not in resultPage) or (randQuery not in resultPage and randQuery2 in resultPage)): if resultPage and not extractRegexResult('(?P<result>UNION ALL SELECT)', resultPage, re.I) and ((randQuery in resultPage and randQuery2 not in resultPage) or (randQuery not in resultPage and randQuery2 in resultPage)):
vector = (position, count, comment, prefix, suffix, conf.uChar, 2) vector = (position, count, comment, prefix, suffix, conf.uChar, 2)
break break