sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-01-24 00:04:23 +03:00
Code Issues Packages Projects Releases Wiki Activity

Minor revisit of payload boundaries (Issue #1800)

Browse Source
This commit is contained in:
Miroslav Stampar 2016-04-08 11:28:17 +02:00
parent bcfae99701
commit ce3749622a
5 changed files with 43 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/core/agent.py
View File

@ -274,7 +274,7 @@ class Agent(object):
where = kb.injection.data[kb.technique].where if where is None else where where = kb.injection.data[kb.technique].where if where is None else where
comment = kb.injection.data[kb.technique].comment if comment is None else comment comment = kb.injection.data[kb.technique].comment if comment is None else comment
if Backend.getIdentifiedDbms() == DBMS.ACCESS and comment == GENERIC_SQL_COMMENT: if Backend.getIdentifiedDbms() == DBMS.ACCESS and "--" in comment:
comment = queries[DBMS.ACCESS].comment.query comment = queries[DBMS.ACCESS].comment.query
if comment is not None: if comment is not None:
@ -297,7 +297,7 @@ class Agent(object):
_ = ( _ = (
("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\ ("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\
("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\ ("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\
("[HASH_REPLACE]", kb.chars.hash_), ("[HASH_REPLACE]", kb.chars.hash_), ("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
) )
payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload) payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload)

4
lib/core/settings.py
View File

@ -20,7 +20,7 @@ from lib.core.enums import OS
from lib.core.revision import getRevisionNumber from lib.core.revision import getRevisionNumber
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.0.4.6" VERSION = "1.0.4.7"
REVISION = getRevisionNumber() REVISION = getRevisionNumber()
STABLE = VERSION.count('.') <= 2 STABLE = VERSION.count('.') <= 2
VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev") VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")
@ -578,7 +578,7 @@ MAX_BISECTION_LENGTH = 50 * 1024 * 1024
LARGE_CHUNK_TRIM_MARKER = "__TRIMMED_CONTENT__" LARGE_CHUNK_TRIM_MARKER = "__TRIMMED_CONTENT__"
# Generic SQL comment formation # Generic SQL comment formation
GENERIC_SQL_COMMENT = "-- -" GENERIC_SQL_COMMENT = "-- [RANDSTR]"
# Threshold value for turning back on time auto-adjustment mechanism # Threshold value for turning back on time auto-adjustment mechanism
VALID_TIME_CHARS_RUN_THRESHOLD = 100 VALID_TIME_CHARS_RUN_THRESHOLD = 100

36
xml/boundaries.xml
View File

@ -89,7 +89,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>')</prefix> <prefix>')</prefix>
<suffix></suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -98,7 +98,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>'</prefix> <prefix>'</prefix>
<suffix></suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -107,7 +107,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>4</ptype> <ptype>4</ptype>
<prefix>"</prefix> <prefix>"</prefix>
<suffix></suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<!-- End of generic boundaries --> <!-- End of generic boundaries -->
@ -406,7 +406,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix></prefix> <prefix></prefix>
<suffix>-- [RANDSTR]</suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -426,7 +426,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -435,7 +435,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -444,7 +444,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -453,7 +453,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -462,7 +462,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>4</ptype> <ptype>4</ptype>
<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -471,7 +471,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix> WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix> WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<!-- End of pre-WHERE generic boundaries --> <!-- End of pre-WHERE generic boundaries -->
@ -482,7 +482,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>')) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>')) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -491,7 +491,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>")) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>")) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -500,7 +500,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix>)) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>)) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -509,7 +509,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>') AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>') AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -518,7 +518,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>4</ptype> <ptype>4</ptype>
<prefix>") AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>") AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -527,7 +527,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix>) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -536,7 +536,7 @@ Formats:
<where>1</where> <where>1</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix>` WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>` WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -545,7 +545,7 @@ Formats:
<where>1</where> <where>1</where>
<ptype>1</ptype> <ptype>1</ptype>
<prefix>`) WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>`) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- </suffix> <suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary> </boundary>
<!-- End of pre-WHERE derived table boundaries --> <!-- End of pre-WHERE derived table boundaries -->

6
xml/payloads/01_boolean_blind.xml
View File

@ -212,7 +212,7 @@ Tag: <test>
<vector>AND [INFERENCE]</vector> <vector>AND [INFERENCE]</vector>
<request> <request>
<payload>AND [RANDNUM]=[RANDNUM]</payload> <payload>AND [RANDNUM]=[RANDNUM]</payload>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
</request> </request>
<response> <response>
<comparison>AND [RANDNUM]=[RANDNUM1]</comparison> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
@ -229,7 +229,7 @@ Tag: <test>
<vector>OR [INFERENCE]</vector> <vector>OR [INFERENCE]</vector>
<request> <request>
<payload>OR [RANDNUM]=[RANDNUM]</payload> <payload>OR [RANDNUM]=[RANDNUM]</payload>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
</request> </request>
<response> <response>
<comparison>OR [RANDNUM]=[RANDNUM1]</comparison> <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
@ -246,7 +246,7 @@ Tag: <test>
<vector>OR NOT [INFERENCE]</vector> <vector>OR NOT [INFERENCE]</vector>
<request> <request>
<payload>OR NOT [RANDNUM]=[RANDNUM]</payload> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
</request> </request>
<response> <response>
<comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>

36
xml/payloads/06_union_query.xml
View File

@ -12,7 +12,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>[COLSTART]-[COLSTOP]</columns> <columns>[COLSTART]-[COLSTOP]</columns>
</request> </request>
@ -31,7 +31,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>[COLSTART]-[COLSTOP]</columns> <columns>[COLSTART]-[COLSTOP]</columns>
</request> </request>
@ -50,7 +50,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>[COLSTART]-[COLSTOP]</columns> <columns>[COLSTART]-[COLSTOP]</columns>
</request> </request>
@ -69,7 +69,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>1-10</columns> <columns>1-10</columns>
</request> </request>
@ -88,7 +88,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>1-10</columns> <columns>1-10</columns>
</request> </request>
@ -107,7 +107,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>1-10</columns> <columns>1-10</columns>
</request> </request>
@ -126,7 +126,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>11-20</columns> <columns>11-20</columns>
</request> </request>
@ -145,7 +145,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>11-20</columns> <columns>11-20</columns>
</request> </request>
@ -164,7 +164,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>11-20</columns> <columns>11-20</columns>
</request> </request>
@ -183,7 +183,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>21-30</columns> <columns>21-30</columns>
</request> </request>
@ -202,7 +202,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>21-30</columns> <columns>21-30</columns>
</request> </request>
@ -221,7 +221,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>21-30</columns> <columns>21-30</columns>
</request> </request>
@ -240,7 +240,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>31-40</columns> <columns>31-40</columns>
</request> </request>
@ -259,7 +259,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>31-40</columns> <columns>31-40</columns>
</request> </request>
@ -278,7 +278,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>31-40</columns> <columns>31-40</columns>
</request> </request>
@ -297,7 +297,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char> <char>[CHAR]</char>
<columns>41-50</columns> <columns>41-50</columns>
</request> </request>
@ -315,7 +315,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char> <char>NULL</char>
<columns>41-50</columns> <columns>41-50</columns>
</request> </request>
@ -334,7 +334,7 @@
<vector>[UNION]</vector> <vector>[UNION]</vector>
<request> <request>
<payload/> <payload/>
<comment>-- -</comment> <comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char> <char>[RANDNUM]</char>
<columns>41-50</columns> <columns>41-50</columns>
</request> </request>