Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 10fe87f

Browse files
stamparmstamparm
committed
Implementing additional self-test stuff (--vuln-test)
1 parent bb7bd51 commit 10fe87f

6 files changed

Lines changed: 79 additions & 7 deletions

File tree

‎extra/vulnserver/vulnserver.py‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
_cursor = None
5454
_server = None
5555

56-
def init():
56+
def init(quiet=False):
5757
global _conn
5858
global _cursor
5959

@@ -62,6 +62,14 @@ def init():
6262

6363
_cursor.executescript(SCHEMA)
6464

65+
if quiet:
66+
global print
67+
68+
def _(*args, **kwargs):
69+
pass
70+
71+
print = _
72+
6573
class ThreadingServer(ThreadingMixIn, HTTPServer):
6674
def finish_request(self, *args, **kwargs):
6775
try:
@@ -130,6 +138,9 @@ def do_POST(self):
130138
self.data = data
131139
self.do_REQUEST()
132140

141+
def log_message(self, format, *args):
142+
return
143+
133144
def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
134145
global _server
135146
try:

‎lib/core/common.py‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2091,6 +2091,19 @@ def getConsoleWidth(default=80):
20912091

20922092
return width or default
20932093

2094+
def shellExec(cmd):
2095+
"""
2096+
Executes arbitrary shell command
2097+
2098+
>>> shellExec('echo 1').strip()
2099+
'1'
2100+
"""
2101+
2102+
try:
2103+
return subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT).communicate()[0] or ""
2104+
except Exception as ex:
2105+
return six.text_type(ex)
2106+
20942107
def clearConsoleLine(forceOutput=False):
20952108
"""
20962109
Clears current console line
@@ -2597,11 +2610,12 @@ def adjustTimeDelay(lastQueryDuration, lowerStdLimit):
25972610
kb.delayCandidates = [candidate] + kb.delayCandidates[:-1]
25982611

25992612
if all((_ == candidate for _ in kb.delayCandidates)) and candidate < conf.timeSec:
2600-
conf.timeSec = candidate
2613+
if lastQueryDuration / (1.0 * conf.timeSec / candidate) > MIN_VALID_DELAYED_RESPONSE: # Note: to prevent problems with fast responses for heavy-queries like RANDOMBLOB
2614+
conf.timeSec = candidate
26012615

2602-
infoMsg = "adjusting time delay to "
2603-
infoMsg += "%d second%s due to good response times" % (conf.timeSec, 's' if conf.timeSec > 1 else '')
2604-
logger.info(infoMsg)
2616+
infoMsg = "adjusting time delay to "
2617+
infoMsg += "%d second%s due to good response times" % (conf.timeSec, 's' if conf.timeSec > 1 else '')
2618+
logger.info(infoMsg)
26052619

26062620
def getLastRequestHTTPError():
26072621
"""

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
from lib.core.enums import OS
1818

1919
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
20-
VERSION = "1.3.4.29"
20+
VERSION = "1.3.4.30"
2121
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2222
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2323
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/core/testing.py‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,23 @@
1010
import os
1111
import re
1212
import shutil
13+
import subprocess
1314
import sys
1415
import tempfile
16+
import threading
1517
import time
1618
import traceback
1719

1820
from extra.beep.beep import beep
21+
from extra.vulnserver import vulnserver
1922
from lib.controller.controller import start
2023
from lib.core.common import checkIntegrity
2124
from lib.core.common import clearConsoleLine
2225
from lib.core.common import dataToStdout
2326
from lib.core.common import getUnicode
2427
from lib.core.common import randomStr
2528
from lib.core.common import readXmlFile
29+
from lib.core.common import shellExec
2630
from lib.core.data import conf
2731
from lib.core.data import logger
2832
from lib.core.data import paths
@@ -44,6 +48,43 @@ class Failures(object):
4448

4549
_failures = Failures()
4650

51+
def vulnTest():
52+
"""
53+
Runs the testing against 'vulnserver'
54+
"""
55+
56+
retVal = True
57+
count, length = 0, 5
58+
59+
def _thread():
60+
vulnserver.init(quiet=True)
61+
vulnserver.run()
62+
63+
thread = threading.Thread(target=_thread)
64+
thread.daemon = True
65+
thread.start()
66+
67+
for options, checks in (
68+
("--flush-session", ("Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "back-end DBMS: SQLite", "3 columns")),
69+
("--banner --schema --dump -T users --binary-fields=surname --where 'id>3'", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
70+
("--all", ("5 entries", "luther", "blisset", "fluffy", "ming", "NULL", "nameisnull")),
71+
("--technique=B --hex --fresh-queries --sql-query='SELECT 987654321'", ("single-thread", ": '987654321'",)),
72+
("--technique=T --fresh-queries --sql-query='SELECT 987654321'", (": '987654321'",)),
73+
):
74+
output = shellExec("python sqlmap.py -u http://%s:%d/?id=1 --batch %s" % (vulnserver.LISTEN_ADDRESS, vulnserver.LISTEN_PORT, options))
75+
if not all(check in output for check in checks):
76+
retVal = False
77+
78+
count += 1
79+
status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length))
80+
dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
81+
82+
clearConsoleLine()
83+
if retVal:
84+
logger.info("vuln test final result: PASSED")
85+
else:
86+
logger.error("vuln test final result: FAILED")
87+
4788
def smokeTest():
4889
"""
4990
Runs the basic smoke testing of a program

‎lib/parse/cmdline.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -722,6 +722,9 @@ def cmdLineParser(argv=None):
722722
parser.add_option("--live-test", dest="liveTest", action="store_true",
723723
help=SUPPRESS_HELP)
724724

725+
parser.add_option("--vuln-test", dest="vulnTest", action="store_true",
726+
help=SUPPRESS_HELP)
727+
725728
parser.add_option("--stop-fail", dest="stopFail", action="store_true",
726729
help=SUPPRESS_HELP)
727730

@@ -913,7 +916,7 @@ def _(self, *args):
913916
if args.dummy:
914917
args.url = args.url or DUMMY_URL
915918

916-
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.liveTest, args.wizard, args.dependencies, args.purge, args.sitemapUrl, args.listTampers, args.hashFile)):
919+
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.vulnTest, args.liveTest, args.wizard, args.dependencies, args.purge, args.sitemapUrl, args.listTampers, args.hashFile)):
917920
errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, -x, --list-tampers, --wizard, --update, --purge or --dependencies). "
918921
errMsg += "Use -h for basic and -hh for advanced help\n"
919922
parser.error(errMsg)

‎sqlmap.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,9 @@ def main():
160160
if conf.smokeTest:
161161
from lib.core.testing import smokeTest
162162
smokeTest()
163+
elif conf.vulnTest:
164+
from lib.core.testing import vulnTest
165+
vulnTest()
163166
elif conf.liveTest:
164167
from lib.core.testing import liveTest
165168
liveTest()

0 commit comments

Comments
 (0)