Merge branch 'master' of github.com:sqlmapproject/sqlmap

lib/utils/xmlrpc.py

@@ -1,109 +0,0 @@
-#!/usr/bin/env python
-
-"""
-Copyright (c) 2006-2012 sqlmap developers (http://sqlmap.org/)
-See the file 'doc/COPYING' for copying permission
-"""
-
-import sys
-import threading
-import types
-import xmlrpclib
-
-try:
-    from SimpleXMLRPCServer import SimpleXMLRPCServer
-
-    from lib.controller.controller import start
-    from lib.core.datatype import AttribDict
-    from lib.core.data import cmdLineOptions
-    from lib.core.data import kb
-    from lib.core.data import logger
-    from lib.core.option import init
-    from lib.core.settings import UNICODE_ENCODING
-    from lib.core.settings import XMLRPC_SERVER_PORT
-except ImportError:
-    XMLRPC_SERVER_PORT = 8776
-
-class XMLRPCServer:
-    def __init__(self, port):
-        self.port = port
-        self.reset()
-
-        self.server = SimpleXMLRPCServer(addr=("", self.port), logRequests=False, allow_none=True, encoding=UNICODE_ENCODING)
-        for _ in dir(self):
-            if _.startswith("serve"):
-                continue
-            if not _.startswith('_') and isinstance(getattr(self, _), types.MethodType):
-                self.server.register_function(getattr(self, _))
-        logger.info("Registering RPC methods: %s" % str(self.server.system_listMethods()).strip("[]"))
-        self.server.register_introspection_functions()
-        logger.info("Running XML-RPC server at '0.0.0.0:%d'..." % self.port)
-
-    def reset(self):
-        self.options = AttribDict(cmdLineOptions)
-
-    def set_option(self, name, value):
-        self.options[name] = value
-        return value
-
-    def get_option(self, name):
-        return self.options[name]
-
-    def get_option_names(self):
-        return sorted(self.options.keys())
-
-    def is_busy(self):
-        return kb.get("busyFlag")
-
-    def read_output(self):
-        sys.stdout.seek(0)
-        retval = sys.stdout.read()
-        sys.stdout.truncate(0)
-
-        if not retval and not self.is_busy():
-            retval = None
-
-        return retval
-
-    def run(self):
-        if not self.is_busy():
-            init(self.options, True)
-            thread = threading.Thread(target=start)
-            thread.daemon = True
-            thread.start()
-        else:
-            raise Exception, "sqlmap busy"
-
-    def serve(self):
-        self.server.serve_forever()
-
-if __name__ == "__main__":
-    try:
-        import readline
-    except ImportError:
-        pass
-
-    try:
-        addr = "http://localhost:%d" % (int(sys.argv[1]) if len(sys.argv) > 1 else XMLRPC_SERVER_PORT)
-        print "[i] Starting debug XML-RPC client to '%s'..." % addr
-
-        server = xmlrpclib.ServerProxy(addr)
-        print "[i] Available RPC methods: %s" % str(server.system.listMethods()).strip("[]")
-        print "[i] Server instance name: 'server'"
-        print "[i] Sample usage: 'server.system.listMethods()'"
-    except Exception, ex:
-        if ex:
-            print "[x] '%s'" % str(ex)
-    else:
-        while True:
-            try:
-                cmd = raw_input("> ")
-                try:
-                    result = eval(cmd)
-                    print result if result is not None else ""
-                except SyntaxError:
-                    exec(cmd)
-            except KeyboardInterrupt:
-                exit(0)
-            except Exception, ex:
-                print "[x] '%s'" % str(ex)

xml/livetests.xml

@@ -37,7 +37,7 @@
         <parse>
             <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
             <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user:    'root@localhost'"/>
             <item value="current database:    'testdb'"/>
             <item value="hostname:    'debian"/>
@@ -80,7 +80,7 @@
         <parse>
             <item value="Title: MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause"/>
             <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user:    'root@localhost'"/>
             <item value="current database:    'testdb'"/>
             <item value="hostname:    'debian"/>
@@ -123,7 +123,7 @@
         <parse>
             <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
             <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user:    'root@localhost'"/>
             <item value="current database:    'testdb'"/>
             <item value="hostname:    'debian"/>
@@ -166,7 +166,7 @@
         <parse>
             <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
             <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user:    'root@localhost'"/>
             <item value="current database:    'testdb'"/>
             <item value="hostname:    'debian"/>
@@ -192,7 +192,7 @@
         </switches>
         <parse>
             <item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user is DBA:    True"/>
         </parse>
     </case>
@@ -223,7 +223,7 @@
         <parse>
             <item value="Title: MySQL inline queries"/>
             <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user:    'root@localhost'"/>
             <item value="current database:    'testdb'"/>
             <item value="hostname:    'debian"/>
@@ -702,6 +702,7 @@
     </case>
     <case name="MySQL UNION query multi-threaded file write">
         <switches>
+            <verbose value="2"/>
             <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
             <threads value="4"/>
             <tech value="U"/>
@@ -756,6 +757,21 @@
             <item value="Title: MySQL &lt; 5.0.12 AND time-based blind (heavy query)"/>
         </parse>
     </case>
+    <case name="MySQL OR boolean-base multi-threaded enumeration">
+        <switches>
+            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
+            <threads value="4"/>
+            <tech value="B"/>
+            <testFilter value="OR boolean"/>
+            <getBanner value="True"/>
+            <isDba value="True"/>
+        </switches>
+        <parse>
+            <item value="Title: OR boolean-based blind - WHERE or HAVING clause"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
+            <item value="current user is DBA:    True"/>
+        </parse>
+    </case>
     <case name="MySQL against page protected by custom weak filter">
         <switches>
             <url value="http://debiandev/sqlmap/mysql/get_int_filtered.php?id=1"/>
@@ -788,7 +804,7 @@
             <tbl value="international"/>
         </switches>
         <parse>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="r'Database: testdb.+Table: international.+3 entries.+šućuraj.+река Москва'"/>
         </parse>
     </case>
@@ -846,7 +862,7 @@
         <parse>
             <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
             <item value="r'Payload: id=[\d]+\.[\d]+ UNION'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user is DBA:    True"/>
         </parse>
     </case>
@@ -861,7 +877,7 @@
         <parse>
             <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
             <item value="r'Payload: id=1 AND [\d]+=[\d]+ UNION'"/>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="current user is DBA:    True"/>
         </parse>
     </case>
@@ -877,7 +893,7 @@
             <getBanner value="True"/>
         </switches>
         <parse>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
         </parse>
     </case>
     <case name="MySQL error-based HTTP digest authentication">
@@ -889,22 +905,21 @@
             <getBanner value="True"/>
         </switches>
         <parse>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
         </parse>
     </case>
     <case name="MySQL boolean-based predict output enumeration">
         <switches>
+            <verbose value="2"/>
             <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
             <predictOutput value="True"/>
             <tech value="B"/>
             <getBanner value="True"/>
-            <verbose value="2"/>
         </switches>
         <parse>
-            <item value="banner:    '5.1.63-0+squeeze1'"/>
+            <item value="banner:    '5.1.66-0+squeeze1'"/>
             <item value="r'performed 112 queries'" console_output="True"/>
         </parse>
     </case>
     <!-- End of other switches -->
-
 </root>