Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 05a8c8d

Browse files
bdamelebdamele
committed
Added support to test for stacked queries support and improved check for time based blind sql injection.
Minor bug fix in --save option
1 parent bf2a857 commit 05a8c8d

9 files changed

Lines changed: 156 additions & 23 deletions

File tree

‎lib/controller/action.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
from lib.core.settings import SUPPORTED_DBMS
3434
from lib.techniques.blind.timebased import timeTest
3535
from lib.techniques.inband.union.test import unionTest
36+
from lib.techniques.outband.stacked import stackedTest
3637

3738

3839
def action():
@@ -70,6 +71,9 @@ def action():
7071
print "%s\n" % conf.dbmsHandler.getFingerprint()
7172

7273
# Techniques options
74+
if conf.stackedTest:
75+
dumper.string("stacked queries support", stackedTest())
76+
7377
if conf.timeTest:
7478
dumper.string("time based blind sql injection payload", timeTest())
7579

‎lib/core/option.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -613,6 +613,7 @@ def __setKnowledgeBaseAttributes():
613613
kb.injType = None
614614
kb.parenthesis = None
615615
kb.resumedQueries = {}
616+
kb.stackedTest = None
616617
kb.targetUrls = set()
617618
kb.timeTest = None
618619
kb.unionComment = ""
@@ -656,6 +657,8 @@ def __saveCmdline():
656657
elif datatype in ( "integer", "float" ):
657658
if option in ( "threads", "verbose" ):
658659
value = "1"
660+
elif option == "timeout":
661+
value = "10"
659662
else:
660663
value = "0"
661664
elif datatype == "string":

‎lib/core/optiondict.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
"proxy": "string",
4646
"threads": "integer",
4747
"delay": "float",
48-
"timeout": "int",
48+
"timeout": "float",
4949
},
5050

5151
"Injection": {
@@ -60,6 +60,7 @@
6060
},
6161

6262
"Techniques": {
63+
"stackedTest": "boolean",
6364
"timeTest": "boolean",
6465
"unionTest": "boolean",
6566
"unionUse": "boolean",

‎lib/parse/cmdline.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,10 +153,14 @@ def cmdLineParser():
153153
"the affected parameter(s) rather than using "
154154
"the default blind SQL injection technique.")
155155

156+
techniques.add_option("--stacked-test", dest="stackedTest",
157+
action="store_true",
158+
help="Test for stacked queries (multiple "
159+
"statements) support")
160+
156161
techniques.add_option("--time-test", dest="timeTest",
157162
action="store_true",
158163
help="Test for Time based blind SQL injection")
159-
160164
techniques.add_option("--union-test", dest="unionTest",
161165
action="store_true",
162166
help="Test for UNION query (inband) SQL injection")

‎lib/request/inject.py‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -322,21 +322,15 @@ def getValue(expression, blind=True, inband=True, fromUser=False, expected=None)
322322
return value
323323

324324

325-
def goStacked(expression, timeTest=False):
325+
def goStacked(expression):
326326
"""
327327
TODO: write description
328328
"""
329329

330-
comment = queries[kb.dbms].comment
331-
query = agent.prefixQuery("; %s" % expression)
332-
query = agent.postfixQuery("%s; %s" % (query, comment))
333-
payload = agent.payload(newValue=query)
334-
335-
start = time.time()
336-
Request.queryPage(payload)
337-
duration = int(time.time() - start)
330+
comment = queries[kb.dbms].comment
331+
query = agent.prefixQuery("; %s" % expression)
332+
query = agent.postfixQuery("%s;%s" % (query, comment))
333+
payload = agent.payload(newValue=query)
334+
page = Request.queryPage(payload, content=True)
338335

339-
if timeTest:
340-
return (duration >= SECONDS, payload)
341-
else:
342-
return duration >= SECONDS
336+
return payload, page

‎lib/techniques/blind/timebased.py‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,24 +24,62 @@
2424

2525

2626

27+
import time
28+
29+
from lib.core.agent import agent
2730
from lib.core.data import kb
2831
from lib.core.data import logger
2932
from lib.core.data import queries
3033
from lib.core.settings import SECONDS
3134
from lib.request import inject
35+
from lib.request.connect import Connect as Request
3236

3337

3438
def timeTest():
3539
infoMsg = "testing time based blind sql injection on parameter "
36-
infoMsg += "'%s'" % kb.injParameter
40+
infoMsg += "'%s' with AND condition syntax" % kb.injParameter
3741
logger.info(infoMsg)
3842

39-
query = queries[kb.dbms].timedelay % SECONDS
40-
timeTest = inject.goStacked(query, timeTest=True)
43+
timeQuery = queries[kb.dbms].timedelay % SECONDS
44+
45+
query = agent.prefixQuery(" AND %s" % timeQuery)
46+
query = agent.postfixQuery(query)
47+
payload = agent.payload(newValue=query)
48+
start = time.time()
49+
_ = Request.queryPage(payload)
50+
duration = int(time.time() - start)
51+
52+
if duration >= SECONDS:
53+
infoMsg = "the parameter '%s' is affected by a time " % kb.injParameter
54+
infoMsg += "based blind sql injection with AND condition syntax"
55+
logger.info(infoMsg)
56+
57+
kb.timeTest = payload
4158

42-
if timeTest[0] == True:
43-
kb.timeTest = timeTest[1]
4459
else:
45-
kb.timeTest = False
60+
warnMsg = "the parameter '%s' is not affected by a time " % kb.injParameter
61+
warnMsg += "based blind sql injection with AND condition syntax"
62+
logger.warn(warnMsg)
63+
64+
infoMsg = "testing time based blind sql injection on parameter "
65+
infoMsg += "'%s' with stacked query syntax" % kb.injParameter
66+
logger.info(infoMsg)
67+
68+
start = time.time()
69+
payload, _ = inject.goStacked(timeQuery)
70+
duration = int(time.time() - start)
71+
72+
if duration >= SECONDS:
73+
infoMsg = "the parameter '%s' is affected by a time " % kb.injParameter
74+
infoMsg += "based blind sql injection with stacked query syntax"
75+
logger.info(infoMsg)
76+
77+
kb.timeTest = payload
78+
else:
79+
warnMsg = "the parameter '%s' is not affected by a time " % kb.injParameter
80+
warnMsg += "based blind sql injection with stacked query syntax"
81+
logger.warn(warnMsg)
82+
83+
kb.timeTest = False
4684

4785
return kb.timeTest

‎lib/techniques/outband/__init__.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2006-2008 Bernardo Damele A. G. <[email protected]>
9+
and Daniele Bellucci <[email protected]>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
pass

‎lib/techniques/outband/stacked.py‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2006-2008 Bernardo Damele A. G. <[email protected]>
9+
and Daniele Bellucci <[email protected]>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
26+
27+
import time
28+
29+
from lib.core.data import kb
30+
from lib.core.data import logger
31+
from lib.core.data import queries
32+
from lib.core.settings import SECONDS
33+
from lib.request import inject
34+
35+
36+
def stackedTest():
37+
infoMsg = "testing stacked queries support on parameter "
38+
infoMsg += "'%s'" % kb.injParameter
39+
logger.info(infoMsg)
40+
41+
query = queries[kb.dbms].timedelay % SECONDS
42+
start = time.time()
43+
payload, _ = inject.goStacked(query)
44+
duration = int(time.time() - start)
45+
46+
if duration >= SECONDS:
47+
infoMsg = "the web application supports stacked queries "
48+
infoMsg += "on parameter '%s'" % kb.injParameter
49+
logger.info(infoMsg)
50+
51+
kb.stackedTest = payload
52+
53+
else:
54+
warnMsg = "the web application does not support stacked queries "
55+
warnMsg += "on parameter '%s'" % kb.injParameter
56+
logger.warn(warnMsg)
57+
58+
kb.stackedTest = False
59+
60+
return kb.stackedTest

‎sqlmap.conf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# Target URL.
44
# Example: http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2
55
# PHP and MySQL (local)
6-
#url = http://127.0.0.1/sqlmap/mysql/get_int.php?id=1
7-
url = http://127.0.0.1/sqlmap/mysql/get_int_partialunion.php?id=1
6+
url = http://127.0.0.1/sqlmap/mysql/get_int.php?id=1
7+
#url = http://127.0.0.1/sqlmap/mysql/get_int_partialunion.php?id=1
88
# PHP and Oracle (local)
99
#url = http://127.0.0.1/sqlmap/oracle/get_int.php?id=1
1010
# PHP and PostgreSQL (local)
@@ -146,6 +146,10 @@ eRegexp =
146146

147147
[Techniques]
148148

149+
# Test for stacked queries (multiple statements) support.
150+
# Valid: True or False
151+
stackedTest = False
152+
149153
# Test for Time based blind SQL injection.
150154
# Valid: True or False
151155
timeTest = False

0 commit comments

Comments
 (0)