sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-17 03:50:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Major enhancement to --union-test check

Browse Source
This commit is contained in:
Bernardo Damele 2010-11-13 22:47:37 +00:00
parent 84849316b3
commit df5dc10111
1 changed files with 30 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
lib/techniques/inband/union/test.py
View File

@ -83,13 +83,13 @@ def __unionPosition(negative=False, falseCond=False):
return validPayload return validPayload
def __unionConfirm(): def __unionConfirm(negative=False, falseCond=False):
validPayload = None validPayload = None
# Confirm the inband SQL injection and get the exact column # Confirm the inband SQL injection and get the exact column
# position # position which can be used to extract data
if not isinstance(kb.unionPosition, int): if not isinstance(kb.unionPosition, int):
validPayload = __unionPosition() validPayload = __unionPosition(negative=negative, falseCond=falseCond)
# Assure that the above function found the exploitable full inband # Assure that the above function found the exploitable full inband
# SQL injection position # SQL injection position
@ -114,7 +114,7 @@ def __unionConfirm():
return validPayload return validPayload
def __unionTestByNULLBruteforce(comment): def __unionTestByNULLBruteforce(comment, negative=False, falseCond=False):
""" """
This method tests if the target url is affected by an inband This method tests if the target url is affected by an inband
SQL injection vulnerability. The test is done up to 50 columns SQL injection vulnerability. The test is done up to 50 columns
@ -135,7 +135,7 @@ def __unionTestByNULLBruteforce(comment):
query += " FROM DUAL" query += " FROM DUAL"
commentedQuery = agent.postfixQuery(query, comment) commentedQuery = agent.postfixQuery(query, comment)
payload = agent.payload(newValue=commentedQuery) payload = agent.payload(newValue=commentedQuery, negative=negative, falseCond=falseCond)
seqMatcher = Request.queryPage(payload, getSeqMatcher=True) seqMatcher = Request.queryPage(payload, getSeqMatcher=True)
if seqMatcher >= 0.6: if seqMatcher >= 0.6:
@ -145,14 +145,14 @@ def __unionTestByNULLBruteforce(comment):
return columns return columns
def __unionTestByOrderBy(comment): def __unionTestByOrderBy(comment, negative=False, falseCond=False):
columns = None columns = None
prevPayload = "" prevPayload = ""
for count in range(1, 51): for count in range(1, 51):
query = agent.prefixQuery("ORDER BY %d" % count) query = agent.prefixQuery("ORDER BY %d" % count)
orderByQuery = agent.postfixQuery(query, comment) orderByQuery = agent.postfixQuery(query, comment)
payload = agent.payload(newValue=orderByQuery) payload = agent.payload(newValue=orderByQuery, negative=negative, falseCond=falseCond)
seqMatcher = Request.queryPage(payload, getSeqMatcher=True) seqMatcher = Request.queryPage(payload, getSeqMatcher=True)
if seqMatcher >= 0.6: if seqMatcher >= 0.6:
@ -165,6 +165,16 @@ def __unionTestByOrderBy(comment):
return columns return columns
def __unionTestAll(comment="", negative=False, falseCond=False):
columns = None
if conf.uTech == "orderby":
columns = __unionTestByOrderBy(comment, negative=negative, falseCond=falseCond)
else:
columns = __unionTestByNULLBruteforce(comment, negative=negative, falseCond=falseCond)
return columns
def unionTest(): def unionTest():
""" """
This method tests if the target url is affected by an inband This method tests if the target url is affected by an inband
@ -188,20 +198,27 @@ def unionTest():
validPayload = None validPayload = None
columns = None columns = None
negative = False
falseCond = False
for comment in (queries[kb.dbms].comment.query, ""): for comment in (queries[kb.dbms].comment.query, ""):
if conf.uTech == "orderby": columns = __unionTestAll(comment)
columns = __unionTestByOrderBy(comment)
else: if not columns:
columns = __unionTestByNULLBruteforce(comment) negative = True
columns = __unionTestAll(comment, negative=negative)
if not columns:
falseCond = True
columns = __unionTestAll(comment, falseCond=falseCond)
if columns: if columns:
setUnion(comment=comment, count=columns) setUnion(comment=comment, count=columns, negative=negative, falseCond=falseCond)
break break
if kb.unionCount: if kb.unionCount:
validPayload = __unionConfirm() validPayload = __unionConfirm(negative=negative, falseCond=falseCond)
else: else:
warnMsg = "the target url is not affected by an " warnMsg = "the target url is not affected by an "
warnMsg += "inband sql injection vulnerability" warnMsg += "inband sql injection vulnerability"