sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-07-16 11:12:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

Added a precaution when, in some rare circumstances, fingerprinted DBMS differ during detection phase.

Browse Source 
Adapted UNION tests' titles when --union-char is provided.
Lots of comment adjustments.
Code cleanup
This commit is contained in:
Bernardo Damele 2011-01-18 23:03:50 +00:00
parent cffa17f5a6
commit eda0b41859
1 changed files with 65 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
lib/controller/checks.py
View File

@ -100,14 +100,19 @@ def checkSqlInjection(place, parameter, value):
stype = test.stype stype = test.stype
clause = test.clause clause = test.clause
if stype == 3 and test.request.columns == "[COLSTART]-[COLSTOP]": if stype == 3:
configUnion(test.request.char)
if test.request.columns == "[COLSTART]-[COLSTOP]":
if conf.uCols is None: if conf.uCols is None:
continue continue
else: else:
configUnion()
title = title.replace("[COLSTART]", str(conf.uColsStart)) title = title.replace("[COLSTART]", str(conf.uColsStart))
title = title.replace("[COLSTOP]", str(conf.uColsStop)) title = title.replace("[COLSTOP]", str(conf.uColsStop))
if "[CHAR]" in title:
title = title.replace("[CHAR]", conf.uChar)
# Skip test if the user's wants to test only for a specific # Skip test if the user's wants to test only for a specific
# technique # technique
if conf.technique and isinstance(conf.technique, int) and stype != conf.technique: if conf.technique and isinstance(conf.technique, int) and stype != conf.technique:
@ -136,7 +141,8 @@ def checkSqlInjection(place, parameter, value):
continue continue
# Skip DBMS-specific test if it does not match either the # Skip DBMS-specific test if it does not match either the
# previously identified or the user's provided DBMS # previously identified or the user's provided DBMS (either
# from program switch or from parsed error message(s))
if "details" in test and "dbms" in test.details: if "details" in test and "dbms" in test.details:
dbms = test.details.dbms dbms = test.details.dbms
else: else:
@ -387,10 +393,12 @@ def checkSqlInjection(place, parameter, value):
# used afterwards by Agent.forgeInbandQuery() # used afterwards by Agent.forgeInbandQuery()
# method to forge the UNION query payload # method to forge the UNION query payload
# Set fingerprinted DBMS according to the # Force back-end DBMS according to the current
# current test settings for proper unescaping # test value for proper payload unescaping
kb.misc.forcedDbms = dbms kb.misc.forcedDbms = dbms
# Skip test if the user provided custom column
# range and this is not a custom UNION test
if conf.uCols is not None and test.request.columns != "[COLSTART]-[COLSTOP]": if conf.uCols is not None and test.request.columns != "[COLSTART]-[COLSTOP]":
debugMsg = "skipping test '%s' because custom " % title debugMsg = "skipping test '%s' because custom " % title
debugMsg += "UNION columns range was provided" debugMsg += "UNION columns range was provided"
@ -405,6 +413,7 @@ def checkSqlInjection(place, parameter, value):
warnMsg += "back-end DBMS" warnMsg += "back-end DBMS"
logger.warn(warnMsg) logger.warn(warnMsg)
# Test for UNION query SQL injection
reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix) reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix)
if isinstance(reqPayload, basestring): if isinstance(reqPayload, basestring):
@ -417,6 +426,7 @@ def checkSqlInjection(place, parameter, value):
# by unionTest() directly # by unionTest() directly
where = vector[6] where = vector[6]
# Reset back-end DBMS value
kb.misc.forcedDbms = None kb.misc.forcedDbms = None
# If the injection test was successful feed the injection # If the injection test was successful feed the injection
@ -454,15 +464,38 @@ def checkSqlInjection(place, parameter, value):
injection.conf.regexp = conf.regexp injection.conf.regexp = conf.regexp
if hasattr(test, "details"): if hasattr(test, "details"):
for detailKey, detailValue in test.details.items(): for dKey, dValue in test.details.items():
if detailKey == "dbms" and injection.dbms is None: # Little precaution, in theory this condition
injection.dbms = detailValue # should always be false
kb.dbms = aliasToDbmsEnum(detailValue) if dKey == "dbms" and injection.dbms is not None and dValue != injection.dbms:
elif detailKey == "dbms_version" and injection.dbms_version is None: msg = "previous test(s) identified that the "
injection.dbms_version = detailValue msg += "back-end DBMS possibly is %s. " % injection.dbms
kb.dbmsVersion = [ detailValue ] msg += "However the last successful test "
elif detailKey == "os" and injection.os is None: msg += "fingerprinted %s. " % dValue
injection.os = detailValue msg += "Please, specify which DBMS is "
msg += "correct [%s (default)/%s] " % (injection.dbms, dValue)
while True:
inp = readInput(msg, default=injection.dbms)
if inp == injection.dbms:
break
elif inp == dValue:
kb.dbms = aliasToDbmsEnum(inp)
injection.dbms = aliasToDbmsEnum(inp)
injection.dbms_version = None
break
else:
warnMsg = "invalid value"
logger.warn(warnMsg)
elif dKey == "dbms" and injection.dbms is None:
kb.dbms = aliasToDbmsEnum(dValue)
injection.dbms = aliasToDbmsEnum(dValue)
elif dKey == "dbms_version" and injection.dbms_version is None:
kb.dbmsVersion = [ dValue ]
injection.dbms_version = dValue
elif dKey == "os" and injection.os is None:
injection.os = dValue
if conf.beep or conf.realTest: if conf.beep or conf.realTest:
beep() beep()