Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 17486e4

Browse files
bdamelebdamele
committed
Proper english (--postfix is now --suffix) and --string/--regexp does not necessarily need to match into the original response body, it might well be in the injected True condition only!
1 parent ca5125b commit 17486e4

20 files changed

Lines changed: 77 additions & 78 deletions

File tree

‎doc/THANKS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ Gabriel Lima <[email protected]>
213213
for reporting a couple of bugs
214214

215215
Mark Lowe <[email protected]>
216-
for reporting a bug
216+
for reporting a couple of bugs
217217

218218
Truong Duc Luong <[email protected]>
219219
for reporting a minor bug

‎lib/controller/checks.py‎

Lines changed: 29 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -52,23 +52,23 @@ def checkSqlInjection(place, parameter, value, parenthesis):
5252
randInt = randomInt()
5353
randStr = randomStr()
5454
prefix = ""
55-
postfix = ""
55+
suffix = ""
5656
retVal = None
5757

58-
if conf.prefix or conf.postfix:
58+
if conf.prefix or conf.suffix:
5959
if conf.prefix:
6060
prefix = conf.prefix
6161

62-
if conf.postfix:
63-
postfix = conf.postfix
62+
if conf.suffix:
63+
suffix = conf.suffix
6464

6565
for case in kb.injections.root.case:
6666
conf.matchRatio = None
6767

6868
positive = case.test.positive
6969
negative = case.test.negative
7070

71-
if not prefix and not postfix and case.name == "custom":
71+
if not prefix and not suffix and case.name == "custom":
7272
continue
7373

7474
infoMsg = "testing %s (%s) injection " % (case.desc, logic)
@@ -116,16 +116,16 @@ def heuristicCheckSqlInjection(place, parameter, value):
116116
return
117117

118118
prefix = ""
119-
postfix = ""
119+
suffix = ""
120120

121-
if conf.prefix or conf.postfix:
121+
if conf.prefix or conf.suffix:
122122
if conf.prefix:
123123
prefix = conf.prefix
124124

125-
if conf.postfix:
126-
postfix = conf.postfix
125+
if conf.suffix:
126+
suffix = conf.suffix
127127

128-
payload = "%s%s%s%s" % (value, prefix, randomStr(length=10, alphabet=['"', '\'', ')', '(']), postfix)
128+
payload = "%s%s%s%s" % (value, prefix, randomStr(length=10, alphabet=['"', '\'', ')', '(']), suffix)
129129
payload = agent.payload(place, parameter, value, payload)
130130
Request.queryPage(payload, place, raise404=False)
131131
result = wasLastRequestDBMSError()
@@ -209,30 +209,30 @@ def checkDynamicContent(firstPage, secondPage):
209209

210210
for i in xrange(len(blocks) - 1):
211211
prefix = firstPage[blocks[i][0]:blocks[i][0] + blocks[i][2]] if blocks[i] else None
212-
postfix = firstPage[blocks[i + 1][0]:blocks[i + 1][0] + blocks[i + 1][2]] if blocks[i + 1] else None
212+
suffix = firstPage[blocks[i + 1][0]:blocks[i + 1][0] + blocks[i + 1][2]] if blocks[i + 1] else None
213213

214214
if prefix is None and blocks[i + 1][0] == 0:
215215
continue
216216

217-
if postfix is None and (blocks[i][0] + blocks[i][2] >= len(firstPage)):
217+
if suffix is None and (blocks[i][0] + blocks[i][2] >= len(firstPage)):
218218
continue
219219

220-
kb.dynamicMarkings.append((re.escape(prefix[-conf.dynMarkLength:]) if prefix else None, re.escape(postfix[:conf.dynMarkLength]) if postfix else None))
220+
kb.dynamicMarkings.append((re.escape(prefix[-conf.dynMarkLength:]) if prefix else None, re.escape(suffix[:conf.dynMarkLength]) if suffix else None))
221221

222222
if len(kb.dynamicMarkings) > 0:
223223
infoMsg = "dynamic content marked for removal (%d region%s)" % (len(kb.dynamicMarkings), 's' if len(kb.dynamicMarkings) > 1 else '')
224224
logger.info(infoMsg)
225225

226226
if conf.seqMatcher.a:
227227
for item in kb.dynamicMarkings:
228-
prefix, postfix = item
228+
prefix, suffix = item
229229

230230
if prefix is None:
231-
conf.seqMatcher.a = re.sub('(?s)^.+%s' % postfix, postfix, conf.seqMatcher.a)
232-
elif postfix is None:
231+
conf.seqMatcher.a = re.sub('(?s)^.+%s' % suffix, suffix, conf.seqMatcher.a)
232+
elif suffix is None:
233233
conf.seqMatcher.a = re.sub('(?s)%s.+$' % prefix, prefix, conf.seqMatcher.a)
234234
else:
235-
conf.seqMatcher.a = re.sub('(?s)%s.+%s' % (prefix, postfix), '%s%s' % (prefix, postfix), conf.seqMatcher.a)
235+
conf.seqMatcher.a = re.sub('(?s)%s.+%s' % (prefix, suffix), '%s%s' % (prefix, suffix), conf.seqMatcher.a)
236236

237237
def checkStability():
238238
"""
@@ -347,14 +347,14 @@ def checkString():
347347

348348
if conf.string in page:
349349
setString()
350-
return True
351350
else:
352-
errMsg = "you provided '%s' as the string to " % conf.string
353-
errMsg += "match, but such a string is not within the target "
354-
errMsg += "URL page content, please provide another string."
355-
logger.error(errMsg)
351+
warnMsg = "you provided '%s' as the string to " % conf.string
352+
warnMsg += "match, but such a string is not within the target "
353+
warnMsg += "URL page content original request, sqlmap will "
354+
warnMsg += "keep going anyway"
355+
logger.warn(warnMsg)
356356

357-
return False
357+
return True
358358

359359
def checkRegexp():
360360
if not conf.regexp:
@@ -377,15 +377,14 @@ def checkRegexp():
377377

378378
if re.search(conf.regexp, page, re.I | re.M):
379379
setRegexp()
380-
return True
381380
else:
382-
errMsg = "you provided '%s' as the regular expression to " % conf.regexp
383-
errMsg += "match, but such a regular expression does not have any "
384-
errMsg += "match within the target URL page content, please provide "
385-
errMsg += "another regular expression."
386-
logger.error(errMsg)
381+
warnMsg = "you provided '%s' as the regular expression to " % conf.regexp
382+
warnMsg += "match, but such a regular expression does not have any "
383+
warnMsg += "match within the target URL page content, sqlmap "
384+
warnMsg += "will keep going anyway"
385+
logger.warn(warnMsg)
387386

388-
return False
387+
return True
389388

390389
def checkNullConnection():
391390
"""

‎lib/core/agent.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ def fullPayload(self, query):
120120
return self.payloadDirect(query)
121121

122122
query = self.prefixQuery(query)
123-
query = self.postfixQuery(query)
123+
query = self.suffixQuery(query)
124124
payload = self.payload(newValue=query)
125125

126126
return payload
@@ -156,7 +156,7 @@ def prefixQuery(self, string):
156156

157157
return query
158158

159-
def postfixQuery(self, string, comment=None):
159+
def suffixQuery(self, string, comment=None):
160160
"""
161161
This method appends the DBMS comment to the
162162
SQL injection request
@@ -182,10 +182,10 @@ def postfixQuery(self, string, comment=None):
182182
if comment:
183183
string += comment
184184

185-
if conf.postfix:
186-
string += " %s" % conf.postfix
185+
if conf.suffix:
186+
string += " %s" % conf.suffix
187187
else:
188-
string += case.usage.postfix.format % eval(case.usage.postfix.params)
188+
string += case.usage.suffix.format % eval(case.usage.suffix.params)
189189

190190
return string
191191

@@ -499,7 +499,7 @@ def forgeInbandQuery(self, query, exprPosition=None, nullChar="NULL"):
499499
if intoRegExp:
500500
inbandQuery += intoRegExp
501501

502-
inbandQuery = self.postfixQuery(inbandQuery, kb.unionComment)
502+
inbandQuery = self.suffixQuery(inbandQuery, kb.unionComment)
503503

504504
return inbandQuery
505505

@@ -636,7 +636,7 @@ def removePayloadDelimiters(self, inpStr, urlencode_=True):
636636
regObj = getCompiledRegex("(?P<result>%s.*?%s)" % (PAYLOAD_DELIMITER, PAYLOAD_DELIMITER))
637637

638638
for match in regObj.finditer(inpStr):
639-
retVal = retVal.replace(match.group("result"), urlencode(match.group("result").strip(PAYLOAD_DELIMITER), convall=True))
639+
retVal = retVal.replace(match.group("result"), match.group("result").strip(PAYLOAD_DELIMITER))
640640
else:
641641
retVal = retVal.replace(PAYLOAD_DELIMITER, '')
642642

‎lib/core/optiondict.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
"dbms": "string",
5959
"os": "string",
6060
"prefix": "string",
61-
"postfix": "string",
61+
"suffix": "string",
6262
"tamper": "string"
6363
},
6464

‎lib/parse/cmdline.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -169,8 +169,8 @@ def cmdLineParser():
169169
injection.add_option("--prefix", dest="prefix",
170170
help="Injection payload prefix string")
171171

172-
injection.add_option("--postfix", dest="postfix",
173-
help="Injection payload postfix string")
172+
injection.add_option("--suffix", dest="suffix",
173+
help="Injection payload suffix string")
174174

175175
injection.add_option("--tamper", dest="tamper",
176176
help="Use given script(s) for tampering injection data")

‎lib/request/comparison.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,14 @@ def comparison(page, headers=None, getSeqMatcher=False, pageLength=None):
6060
# Dynamic content lines to be excluded before comparison
6161
if not kb.nullConnection and not conf.longestCommon:
6262
for item in kb.dynamicMarkings:
63-
prefix, postfix = item
63+
prefix, suffix = item
6464

6565
if prefix is None:
66-
page = re.sub('(?s)^.+%s' % postfix, postfix, page)
67-
elif postfix is None:
66+
page = re.sub('(?s)^.+%s' % suffix, suffix, page)
67+
elif suffix is None:
6868
page = re.sub('(?s)%s.+$' % prefix, prefix, page)
6969
else:
70-
page = re.sub('(?s)%s.+%s' % (prefix, postfix), '%s%s' % (prefix, postfix), page)
70+
page = re.sub('(?s)%s.+%s' % (prefix, suffix), '%s%s' % (prefix, suffix), page)
7171

7272
if not pageLength:
7373
pageLength = len(page)

‎lib/request/inject.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, r
9999
"""
100100

101101
query = agent.prefixQuery(queries[kb.misc.testedDbms].inference.query)
102-
query = agent.postfixQuery(query)
102+
query = agent.suffixQuery(query)
103103
payload = agent.payload(newValue=query)
104104
count = None
105105
startLimit = 0
@@ -398,7 +398,7 @@ def goStacked(expression, silent=False):
398398

399399
comment = queries[kb.dbms].comment.query
400400
query = agent.prefixQuery("; %s" % expression)
401-
query = agent.postfixQuery("%s;%s" % (query, comment))
401+
query = agent.suffixQuery("%s;%s" % (query, comment))
402402

403403
debugMsg = "query: %s" % query
404404
logger.debug(debugMsg)

‎lib/takeover/web.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ def __webFileInject(self, fileContent, fileName, directory):
9999
query = "LIMIT 1 INTO OUTFILE '%s' " % outFile
100100
query += "LINES TERMINATED BY 0x%s --" % hexencode(uplQuery)
101101
query = agent.prefixQuery(query)
102-
query = agent.postfixQuery(query)
102+
query = agent.suffixQuery(query)
103103
payload = agent.payload(newValue=query)
104104
page = Request.queryPage(payload)
105105
return page

‎lib/techniques/blind/inference.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,7 @@ def downloadThread():
442442
# One-shot query containing equals commonValue
443443
testValue = unescaper.unescape("'%s'" % commonValue) if "'" not in commonValue else unescaper.unescape("%s" % commonValue, quote=False)
444444
query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (expressionUnescaped, testValue)))
445-
query = agent.postfixQuery(query)
445+
query = agent.suffixQuery(query)
446446
queriesCount[0] += 1
447447
result = Request.queryPage(agent.payload(newValue=query))
448448

@@ -466,7 +466,7 @@ def downloadThread():
466466
subquery = queries[kb.dbms].substring.query % (expressionUnescaped, 1, len(commonPattern))
467467
testValue = unescaper.unescape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.unescape("%s" % commonPattern, quote=False)
468468
query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (subquery, testValue)))
469-
query = agent.postfixQuery(query)
469+
query = agent.suffixQuery(query)
470470
queriesCount[0] += 1
471471
result = Request.queryPage(agent.payload(newValue=query))
472472

‎lib/techniques/blind/timebased.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ def timeTest():
2828

2929
timeQuery = getDelayQuery(andCond=True)
3030
query = agent.prefixQuery("AND %s" % timeQuery)
31-
query = agent.postfixQuery(query)
31+
query = agent.suffixQuery(query)
3232
payload = agent.payload(newValue=query)
3333
start = time.time()
3434
_ = Request.queryPage(payload)

0 commit comments

Comments
 (0)