mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-26 19:43:48 +03:00
122 lines
3.7 KiB
Python
122 lines
3.7 KiB
Python
#!/usr/bin/env python
|
|
|
|
"""
|
|
$Id$
|
|
|
|
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
|
|
See the file 'doc/COPYING' for copying permission
|
|
"""
|
|
|
|
import time
|
|
|
|
from lib.core.common import clearConsoleLine
|
|
from lib.core.common import dataToStdout
|
|
from lib.core.common import getFileItems
|
|
from lib.core.common import popValue
|
|
from lib.core.common import pushValue
|
|
from lib.core.common import randomInt
|
|
from lib.core.common import safeStringFormat
|
|
from lib.core.data import conf
|
|
from lib.core.data import kb
|
|
from lib.core.data import logger
|
|
from lib.core.exception import sqlmapMissingMandatoryOptionException
|
|
from lib.core.settings import METADB_SUFFIX
|
|
from lib.request import inject
|
|
|
|
def tableExists(tableFile):
|
|
tables = getFileItems(tableFile)
|
|
retVal = []
|
|
infoMsg = "checking table existence using items from '%s'" % tableFile
|
|
logger.info(infoMsg)
|
|
|
|
count = 0
|
|
length = len(tables)
|
|
|
|
for table in tables:
|
|
if conf.db and not conf.db.endswith(METADB_SUFFIX):
|
|
table = "%s.%s" % (conf.db, table)
|
|
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %d FROM %s)", (randomInt(1), table)))
|
|
|
|
if result:
|
|
retVal.append(table)
|
|
|
|
if conf.verbose in (1, 2):
|
|
clearConsoleLine(True)
|
|
infoMsg = "\r[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), table)
|
|
dataToStdout(infoMsg, True)
|
|
|
|
count += 1
|
|
|
|
if conf.verbose in (1, 2):
|
|
status = '%d/%d items (%d%s)' % (count, length, round(100.0*count/length), '%')
|
|
dataToStdout("\r[%s] [INFO] tried: %s" % (time.strftime("%X"), status), True)
|
|
|
|
clearConsoleLine(True)
|
|
|
|
if not retVal:
|
|
warnMsg = "no table found"
|
|
logger.warn(warnMsg)
|
|
else:
|
|
for item in retVal:
|
|
if not kb.data.cachedTables.has_key(conf.db):
|
|
kb.data.cachedTables[conf.db] = [item]
|
|
else:
|
|
kb.data.cachedTables[conf.db].append(item)
|
|
|
|
return kb.data.cachedTables
|
|
|
|
def columnExists(columnFile):
|
|
if not conf.tbl:
|
|
errMsg = "missing table parameter"
|
|
raise sqlmapMissingMandatoryOptionException, errMsg
|
|
|
|
columns = getFileItems(columnFile)
|
|
if conf.db and not conf.db.endswith(METADB_SUFFIX):
|
|
table = "%s.%s" % (conf.db, conf.tbl)
|
|
else:
|
|
table = conf.tbl
|
|
|
|
retVal = []
|
|
infoMsg = "checking column existence using items from '%s'" % columnFile
|
|
logger.info(infoMsg)
|
|
|
|
count = 0
|
|
length = len(columns)
|
|
|
|
for column in columns:
|
|
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s)", (column, table)))
|
|
|
|
if result:
|
|
retVal.append(column)
|
|
|
|
if conf.verbose in (1, 2):
|
|
clearConsoleLine(True)
|
|
infoMsg = "\r[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), column)
|
|
dataToStdout(infoMsg, True)
|
|
|
|
count += 1
|
|
|
|
if conf.verbose in (1, 2):
|
|
status = '%d/%d items (%d%s)' % (count, length, round(100.0*count/length), '%')
|
|
dataToStdout("\r[%s] [INFO] tried: %s" % (time.strftime("%X"), status), True)
|
|
|
|
clearConsoleLine(True)
|
|
|
|
if not retVal:
|
|
warnMsg = "no column found"
|
|
logger.warn(warnMsg)
|
|
else:
|
|
columns = {}
|
|
|
|
for column in retVal:
|
|
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s>0)", (column, table, column)))
|
|
|
|
if result:
|
|
columns[column] = 'numeric'
|
|
else:
|
|
columns[column] = 'non-numeric'
|
|
|
|
kb.data.cachedColumns[conf.db] = {conf.tbl: columns}
|
|
|
|
return kb.data.cachedColumns
|