sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-06-07 06:33:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

Implementation for an Issue #49

Browse Source
This commit is contained in:
Miroslav Stampar 2012-10-02 14:23:58 +02:00
parent 763dc98311
commit bcbf0571a5
4 changed files with 52 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/core/agent.py
View File

@ -117,7 +117,7 @@ class Agent:
retVal = ET.tostring(root) retVal = ET.tostring(root)
elif place in (PLACE.URI, PLACE.CUSTOM_POST): elif place in (PLACE.URI, PLACE.CUSTOM_POST):
retVal = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)) retVal = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)).replace(CUSTOM_INJECTION_MARK_CHAR, "")
elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST):
retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue)) retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
else: else:

70
lib/core/settings.py
View File

@ -25,15 +25,15 @@ ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new"
GIT_REPOSITORY = "git://github.com/sqlmapproject/sqlmap.git" GIT_REPOSITORY = "git://github.com/sqlmapproject/sqlmap.git"
ML = "sqlmap-users@lists.sourceforge.net" ML = "sqlmap-users@lists.sourceforge.net"
# minimum distance of ratio from kb.matchRatio to result in True # Minimum distance of ratio from kb.matchRatio to result in True
DIFF_TOLERANCE = 0.05 DIFF_TOLERANCE = 0.05
CONSTANT_RATIO = 0.9 CONSTANT_RATIO = 0.9
# lower and upper values for match ratio in case of stable page # Lower and upper values for match ratio in case of stable page
LOWER_RATIO_BOUND = 0.02 LOWER_RATIO_BOUND = 0.02
UPPER_RATIO_BOUND = 0.98 UPPER_RATIO_BOUND = 0.98
# markers for special cases when parameter values contain html encoded characters # Markers for special cases when parameter values contain html encoded characters
PARAMETER_AMP_MARKER = "__AMP__" PARAMETER_AMP_MARKER = "__AMP__"
PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__" PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__"
@ -45,80 +45,80 @@ PAYLOAD_DELIMITER = "\x00"
CHAR_INFERENCE_MARK = "%c" CHAR_INFERENCE_MARK = "%c"
PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7e-\xff]" PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7e-\xff]"
# regular expression used for recognition of generic permission messages # Regular expression used for recognition of generic permission messages
PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied" PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied"
# regular expression used for recognition of generic maximum connection messages # Regular expression used for recognition of generic maximum connection messages
MAX_CONNECTIONS_REGEX = r"max.+connections" MAX_CONNECTIONS_REGEX = r"max.+connections"
# regular expression used for extracting results from google search # Regular expression used for extracting results from google search
GOOGLE_REGEX = r"url\?\w+=(http[^>]+)&(sa=U|rct=j)" GOOGLE_REGEX = r"url\?\w+=(http[^>]+)&(sa=U|rct=j)"
# regular expression used for extracting content from "textual" tags # Regular expression used for extracting content from "textual" tags
TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)" TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)"
# dumping characters used in GROUP_CONCAT MySQL technique # Dumping characters used in GROUP_CONCAT MySQL technique
CONCAT_ROW_DELIMITER = ',' CONCAT_ROW_DELIMITER = ','
CONCAT_VALUE_DELIMITER = '|' CONCAT_VALUE_DELIMITER = '|'
# coefficient used for a time-based query delay checking (must be >= 7) # Coefficient used for a time-based query delay checking (must be >= 7)
TIME_STDEV_COEFF = 7 TIME_STDEV_COEFF = 7
# standard deviation after which a warning message should be displayed about connection lags # Standard deviation after which a warning message should be displayed about connection lags
WARN_TIME_STDEV = 0.5 WARN_TIME_STDEV = 0.5
# minimum length of usable union injected response (quick defense against substr fields) # Minimum length of usable union injected response (quick defense against substr fields)
UNION_MIN_RESPONSE_CHARS = 10 UNION_MIN_RESPONSE_CHARS = 10
# coefficient used for a union-based number of columns checking (must be >= 7) # Coefficient used for a union-based number of columns checking (must be >= 7)
UNION_STDEV_COEFF = 7 UNION_STDEV_COEFF = 7
# length of queue for candidates for time delay adjustment # Length of queue for candidates for time delay adjustment
TIME_DELAY_CANDIDATES = 3 TIME_DELAY_CANDIDATES = 3
# default value for HTTP Accept header # Default value for HTTP Accept header
HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
# default value for HTTP Accept-Encoding header # Default value for HTTP Accept-Encoding header
HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate" HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate"
# HTTP timeout in silent mode # HTTP timeout in silent mode
HTTP_SILENT_TIMEOUT = 3 HTTP_SILENT_TIMEOUT = 3
# maximum number of techniques used in inject.py/getValue() per one value # Maximum number of techniques used in inject.py/getValue() per one value
MAX_TECHNIQUES_PER_VALUE = 2 MAX_TECHNIQUES_PER_VALUE = 2
# suffix used for naming meta databases in DBMS(es) without explicit database name # Suffix used for naming meta databases in DBMS(es) without explicit database name
METADB_SUFFIX = "_masterdb" METADB_SUFFIX = "_masterdb"
# minimum time response set needed for time-comparison based on standard deviation # Minimum time response set needed for time-comparison based on standard deviation
MIN_TIME_RESPONSES = 10 MIN_TIME_RESPONSES = 10
# minimum comparison ratio set needed for searching valid union column number based on standard deviation # Minimum comparison ratio set needed for searching valid union column number based on standard deviation
MIN_UNION_RESPONSES = 5 MIN_UNION_RESPONSES = 5
# after these number of blanks at the end inference should stop (just in case) # After these number of blanks at the end inference should stop (just in case)
INFERENCE_BLANK_BREAK = 10 INFERENCE_BLANK_BREAK = 10
# use this replacement character for cases when inference is not able to retrieve the proper character value # Use this replacement character for cases when inference is not able to retrieve the proper character value
INFERENCE_UNKNOWN_CHAR = '?' INFERENCE_UNKNOWN_CHAR = '?'
# character used for operation "greater" in inference # Character used for operation "greater" in inference
INFERENCE_GREATER_CHAR = ">" INFERENCE_GREATER_CHAR = ">"
# character used for operation "equals" in inference # Character used for operation "equals" in inference
INFERENCE_EQUALS_CHAR = "=" INFERENCE_EQUALS_CHAR = "="
# character used for operation "not-equals" in inference # Character used for operation "not-equals" in inference
INFERENCE_NOT_EQUALS_CHAR = "!=" INFERENCE_NOT_EQUALS_CHAR = "!="
# string used for representation of unknown dbms version # String used for representation of unknown dbms version
UNKNOWN_DBMS_VERSION = "Unknown" UNKNOWN_DBMS_VERSION = "Unknown"
# dynamicity mark length used in dynamicity removal engine # Dynamicity mark length used in dynamicity removal engine
DYNAMICITY_MARK_LENGTH = 32 DYNAMICITY_MARK_LENGTH = 32
# dummy user prefix used in dictionary attack # Dummy user prefix used in dictionary attack
DUMMY_USER_PREFIX = "__dummy__" DUMMY_USER_PREFIX = "__dummy__"
# Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1 # Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1
@ -126,9 +126,8 @@ DEFAULT_PAGE_ENCODING = "iso-8859-1"
# System variables # System variables
IS_WIN = subprocess.mswindows IS_WIN = subprocess.mswindows
# The name of the operating system dependent module imported. The following
# names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', # The name of the operating system dependent module imported. The following names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', 'java', 'riscos'
# 'java', 'riscos'
PLATFORM = os.name PLATFORM = os.name
PYVERSION = sys.version.split()[0] PYVERSION = sys.version.split()[0]
@ -171,7 +170,7 @@ USER_AGENT_ALIASES = ( "ua", "useragent", "user-agent" )
REFERER_ALIASES = ( "ref", "referer", "referrer" ) REFERER_ALIASES = ( "ref", "referer", "referrer" )
HOST_ALIASES = ( "host", ) HOST_ALIASES = ( "host", )
# items displayed in basic help (-h) output # Items displayed in basic help (-h) output
BASIC_HELP_ITEMS = ( BASIC_HELP_ITEMS = (
"url", "url",
"googleDork", "googleDork",
@ -205,13 +204,13 @@ BASIC_HELP_ITEMS = (
"wizard" "wizard"
) )
# string representation for NULL value # String representation for NULL value
NULL = "NULL" NULL = "NULL"
# string representation for blank ('') value # String representation for blank ('') value
BLANK = "<blank>" BLANK = "<blank>"
# string representation for current database # String representation for current database
CURRENT_DB = "CD" CURRENT_DB = "CD"
# Regular expressions used for parsing error messages (--parse-errors) # Regular expressions used for parsing error messages (--parse-errors)
@ -470,3 +469,6 @@ VIEWSTATE_REGEX = r'(?P<name>__VIEWSTATE[^"]*)[^>]+value="(?P<name>[^"]+)'
# Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems) # Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems)
LIMITED_ROWS_TEST_NUMBER = 15 LIMITED_ROWS_TEST_NUMBER = 15
# Regular expressing used for detecting JSON-like POST data
JSON_RECOGNITION_REGEX = r'(?s)\A\s*.*"[^"]+"\s*:\s*"[^"]+".+\}\s*\Z'

15
lib/core/target.py
View File

@ -39,6 +39,7 @@ from lib.core.option import __setKnowledgeBaseAttributes
from lib.core.option import __setAuthCred from lib.core.option import __setAuthCred
from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
from lib.core.settings import HOST_ALIASES from lib.core.settings import HOST_ALIASES
from lib.core.settings import JSON_RECOGNITION_REGEX
from lib.core.settings import REFERER_ALIASES from lib.core.settings import REFERER_ALIASES
from lib.core.settings import RESULTS_FILE_FORMAT from lib.core.settings import RESULTS_FILE_FORMAT
from lib.core.settings import SOAP_REGEX from lib.core.settings import SOAP_REGEX
@ -110,11 +111,23 @@ def __setRequestParams():
elif test[0] in ("q", "Q"): elif test[0] in ("q", "Q"):
raise sqlmapUserQuitException raise sqlmapUserQuitException
if re.search(JSON_RECOGNITION_REGEX, conf.data or ""):
message = "JSON like data found in POST data. "
message += "Do you want to process it? [Y/n/q] "
test = readInput(message, default="Y")
if test and test[0] in ("q", "Q"):
raise sqlmapUserQuitException
elif test[0] not in ("n", "N"):
conf.data = re.sub(r'("[^"]+"\s*:\s*"[^"]+)"', r'\g<1>*"', conf.data or "")
kb.processUserMarks = True
for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data)): for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data)):
if CUSTOM_INJECTION_MARK_CHAR in (value or ""): if CUSTOM_INJECTION_MARK_CHAR in (value or ""):
if kb.processUserMarks is None: if kb.processUserMarks is None:
_ = {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data'}
message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR
message += "'%s'. Do you want to process it? [Y/n/q] " % {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data'}[place] message += "'%s'. Do you want to process it? [Y/n/q] " % _[place]
test = readInput(message, default="Y") test = readInput(message, default="Y")
if test and test[0] in ("q", "Q"): if test and test[0] in ("q", "Q"):
raise sqlmapUserQuitException raise sqlmapUserQuitException

1
lib/request/connect.py
View File

@ -685,6 +685,7 @@ class Connect:
msg += "which is usually causing problems " msg += "which is usually causing problems "
msg += "in this kind of situations? [Y/n]" msg += "in this kind of situations? [Y/n]"
skipUrlEncode = conf.skipUrlEncode = readInput(msg, default="Y").upper() != "N" skipUrlEncode = conf.skipUrlEncode = readInput(msg, default="Y").upper() != "N"
if place not in (PLACE.POST, PLACE.SOAP, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE): if place not in (PLACE.POST, PLACE.SOAP, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE):
post = getattr(post, UNENCODED_ORIGINAL_VALUE) post = getattr(post, UNENCODED_ORIGINAL_VALUE)
elif not skipUrlEncode and place not in (PLACE.SOAP,): elif not skipUrlEncode and place not in (PLACE.SOAP,):