moving injection data to HashDB

lib/controller/controller.py

@@ -49,7 +49,6 @@ from lib.core.exception import sqlmapNotVulnerableException
 from lib.core.exception import sqlmapSilentQuitException
 from lib.core.exception import sqlmapValueException
 from lib.core.exception import sqlmapUserQuitException
-from lib.core.session import setInjection
 from lib.core.settings import DEFAULT_COOKIE_DELIMITER
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import EMPTY_FORM_FIELDS_REGEX
@@ -173,14 +172,10 @@ def __randomFillBlankFields(value):
 
     return retVal
 
-def __saveToSessionFile():
-    for inj in kb.injections:
-        if inj.place is None or inj.parameter is None:
-            continue
-
-        setInjection(inj)
-
 def __saveToHashDB():
+    kb.injections = [_ for _ in kb.injections if _ and _.place is not None and _.parameter is not None]
+    hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, kb.injections, True)
+
     _ = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) or set()
     _.update(kb.absFilePaths)
     hashDBWrite(HASHDB_KEYS.KB_ABS_FILE_PATHS, _, True)
@@ -546,7 +541,6 @@ def start():
                 # Flush the flag
                 kb.testMode = False
 
-                __saveToSessionFile()
                 __saveToResultsFile()
                 __saveToHashDB()
                 __showInjections()

lib/core/enums.py

@@ -141,6 +141,7 @@ class HASHDB_KEYS:
     KB_BRUTE_COLUMNS = "KB_BRUTE_COLUMNS"
     CONF_TMP_PATH = "CONF_TMP_PATH"
     KB_XP_CMDSHELL_AVAILABLE = "KB_XP_CMDSHELL_AVAILABLE"
+    KB_INJECTIONS = "KB_INJECTIONS"
 
 class REDIRECTION:
     FOLLOW = "1"

lib/core/session.py

@@ -36,32 +36,6 @@ def unSafeFormatString(value):
         retVal = retVal.replace("__LEFT_SQUARE_BRACKET__", "[").replace("__RIGHT_SQUARE_BRACKET__", "]")
     return retVal
 
-def setInjection(inj):
-    """
-    Save information retrieved about injection place and parameter in the
-    session file.
-    """
-
-    try:
-        condition = ( not kb.resumedQueries
-                    or ( kb.resumedQueries.has_key(conf.url) and
-                    not kb.resumedQueries[conf.url].has_key("Injection data"))
-                    or ( kb.resumedQueries[conf.url].has_key("Injection data")
-                    and intersect(base64unpickle(kb.resumedQueries[conf.url]["Injection data"][:-1]).data.keys(),\
-                        inj.data.keys()) != inj.data.keys()
-                    ) )
-    except AttributeError:
-        warnMsg = "there were some changes in data model "
-        warnMsg += "preventing normal resume of previously stored "
-        warnMsg += "injection data. please use the --flush-session "
-        warnMsg += "to have it fixed"
-        singleTimeWarnMessage(warnMsg)
-
-        condition = False
-
-    if condition:
-        dataToSessionFile("[%s][%s][%s][Injection data][%s]\n" % (conf.url, inj.place, safeFormatString(conf.parameters[inj.place]), base64pickle(inj)))
-
 def setDynamicMarkings(markings):
     """
     Save information retrieved about dynamic markings to the
@@ -150,36 +124,26 @@ def setOs():
     if condition:
         dataToSessionFile("[%s][%s][%s][OS][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), Backend.getOs()))
 
+def setRemoteTempPath():
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("Remote temp path") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][Remote temp path][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), safeFormatString(conf.tmpPath)))
+
+def setXpCmdshellAvailability(available):
+    condition = (
+                  not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
+                  not kb.resumedQueries[conf.url].has_key("xp_cmdshell availability") )
+                )
+
+    if condition:
+        dataToSessionFile("[%s][%s][%s][xp_cmdshell availability][%s]\n" % (conf.url, kb.injection.place, safeFormatString(conf.parameters[kb.injection.place]), str(available).lower()))
+
 def resumeConfKb(expression, url, value):
-    if expression == "Injection data" and url == conf.url:
+    if expression == "Dynamic markings" and url == conf.url:
-        try:
-            injection = base64unpickle(value[:-1])
-        except AttributeError:
-            warnMsg = "there were some changes in data model "
-            warnMsg += "preventing normal resume of previously stored "
-            warnMsg += "injection data. please use the --flush-session "
-            warnMsg += "to have it fixed"
-            singleTimeWarnMessage(warnMsg)
-            return
-
-        infoMsg = "resuming injection data from session file"
-        logger.info(infoMsg)
-
-        if injection.place in conf.paramDict and \
-           injection.parameter in conf.paramDict[injection.place]:
-
-            if not conf.tech or intersect(conf.tech, injection.data.keys()):
-                if intersect(conf.tech, injection.data.keys()):
-                    injection.data = dict(filter(lambda (key, item): key in conf.tech, injection.data.items()))
-
-                if injection not in kb.injections:
-                    kb.injections.append(injection)
-        else:
-            warnMsg = "there is an injection in %s parameter '%s' " % (injection.place, injection.parameter)
-            warnMsg += "but you did not provided it this time"
-            logger.warn(warnMsg)
-
-    elif expression == "Dynamic markings" and url == conf.url:
         kb.dynamicMarkings = base64unpickle(value[:-1])
         infoMsg = "resuming dynamic markings from session file"
         logger.info(infoMsg)

lib/core/target.py

@@ -217,6 +217,17 @@ def __resumeHashDBValues():
 
     conf.tmpPath = conf.tmpPath or hashDBRetrieve(HASHDB_KEYS.CONF_TMP_PATH)
 
+    for injection in hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) or []:
+        if injection.place in conf.paramDict and \
+            injection.parameter in conf.paramDict[injection.place]:
+
+            if not conf.tech or intersect(conf.tech, injection.data.keys()):
+                if intersect(conf.tech, injection.data.keys()):
+                    injection.data = dict(filter(lambda (key, item): key in conf.tech, injection.data.items()))
+
+                if injection not in kb.injections:
+                    kb.injections.append(injection)
+
 def __setOutputResume():
     """
     Check and set the output text file and the resume functionality.