Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 17e2280

Browse files
bdamelebdamele
committed
Minor enhancements and bug fixes to "good samaritan" feature - see #4 
1 parent b98f6ac commit 17e2280

3 files changed

Lines changed: 444 additions & 72 deletions

File tree

‎lib/core/common.py‎

Lines changed: 30 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1228,19 +1228,16 @@ def initCommonOutputs():
12281228

12291229
cfile.close()
12301230

1231-
def goGoodSamaritan(part, prevValue, originalCharset):
1231+
def goGoodSamaritan(prevValue, originalCharset):
12321232
"""
12331233
Function for retrieving parameters needed for common prediction (good
12341234
samaritan) feature.
12351235
1236-
part is for instance Users, Databases, Tables and corresponds to the
1237-
header (e.g. [Users]) in txt/common-outputs.txt.
1238-
12391236
prevValue: retrieved query output so far (e.g. 'i').
12401237
1241-
Returns singleValue if there is a complete single match (in part of
1242-
txt/common-outputs.txt under 'part') regarding parameter prevValue. If
1243-
there is no single value match, but multiple, commonCharset is
1238+
Returns commonValue if there is a complete single match (in kb.partRun
1239+
of txt/common-outputs.txt under kb.partRun) regarding parameter
1240+
prevValue. If there is no single value match, but multiple, commonCharset is
12441241
returned containing more probable characters (retrieved from matched
12451242
values in txt/common-outputs.txt) together with the rest of charset as
12461243
otherCharset.
@@ -1250,38 +1247,37 @@ def goGoodSamaritan(part, prevValue, originalCharset):
12501247
initCommonOutputs()
12511248

12521249
predictionSet = set()
1253-
wildIndexes = []
1254-
singleValue = None
1255-
commonPatternValue = None
1256-
countSingleValues = 0
1250+
commonValue = None
1251+
commonPattern = None
1252+
countCommonValue = 0
12571253

12581254
# If the header (e.g. Databases) we are looking for has common
12591255
# outputs defined
1260-
if part in kb.commonOutputs:
1261-
commonPartOutputs = kb.commonOutputs[part]
1262-
commonPatternValue = common_finder_only(prevValue, commonPartOutputs)
1256+
if kb.partRun in kb.commonOutputs:
1257+
commonPartOutputs = kb.commonOutputs[kb.partRun]
1258+
commonPattern = common_finder_only(prevValue, commonPartOutputs)
12631259

12641260
# If the longest common prefix is the same as previous value then
12651261
# do not consider it
1266-
if commonPatternValue and commonPatternValue == prevValue:
1267-
commonPatternValue = None
1262+
if commonPattern and commonPattern == prevValue:
1263+
commonPattern = None
12681264

12691265
# For each common output
12701266
for item in commonPartOutputs:
12711267
# Check if the common output (item) starts with prevValue
12721268
# where prevValue is the enumerated character(s) so far
12731269
if item.startswith(prevValue):
1274-
singleValue = item
1275-
countSingleValues += 1
1270+
commonValue = item
1271+
countCommonValue += 1
12761272

12771273
if len(item) > len(prevValue):
12781274
char = item[len(prevValue)]
12791275
predictionSet.add(char)
12801276

12811277
# Reset single value if there is more than one possible common
12821278
# output
1283-
if countSingleValues > 1:
1284-
singleValue = None
1279+
if countCommonValue > 1:
1280+
commonValue = None
12851281

12861282
commonCharset = []
12871283
otherCharset = []
@@ -1296,7 +1292,7 @@ def goGoodSamaritan(part, prevValue, originalCharset):
12961292

12971293
commonCharset.sort()
12981294

1299-
return singleValue, commonPatternValue, commonCharset, originalCharset
1295+
return commonValue, commonPattern, commonCharset, originalCharset
13001296
else:
13011297
return None, None, None, originalCharset
13021298

@@ -1322,18 +1318,25 @@ def getPartRun():
13221318
retVal = None
13231319
commonPartsDict = optDict["Enumeration"]
13241320
stack = [item[4][0] if isinstance(item[4], list) else '' for item in inspect.stack()]
1325-
reobj = getCompiledRegex('conf\.dbmsHandler\.([^(]+)\(\)')
1321+
reobj1 = getCompiledRegex('conf\.dbmsHandler\.([^(]+)\(\)')
1322+
reobj2 = getCompiledRegex('self\.(get[^(]+)\(\)')
13261323

13271324
# Goes backwards through the stack to find the conf.dbmsHandler method
13281325
# calling this function
1329-
for i in xrange(len(stack) - 1, 0, -1):
1330-
match = reobj.search(stack[i])
1326+
for i in xrange(0, len(stack)-1):
1327+
for reobj in (reobj2, reobj1):
1328+
match = reobj.search(stack[i])
1329+
1330+
if match:
1331+
# This is the calling conf.dbmsHandler or self method
1332+
# (e.g. 'getDbms')
1333+
retVal = match.groups()[0]
1334+
break
13311335

1332-
if match:
1333-
# This is the calling conf.dbmsHandler method (e.g. 'getDbms')
1334-
retVal = match.groups()[0]
1336+
if retVal is not None:
13351337
break
13361338

1339+
# Return the INI tag to consider for common outputs (e.g. 'Databases')
13371340
return commonPartsDict[retVal][1] if retVal in commonPartsDict else retVal
13381341

13391342
def getCommonStart(strings=[]):

‎lib/techniques/blind/inference.py‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -417,53 +417,58 @@ def downloadThread():
417417
# the moment
418418
if conf.useCommonPrediction and len(finalValue) > 0 and kb.partRun is not None:
419419
val = None
420-
singleValue, commonPatternValue, commonCharset, otherCharset = goGoodSamaritan(kb.partRun, finalValue, asciiTbl)
420+
commonValue, commonPattern, commonCharset, otherCharset = goGoodSamaritan(finalValue, asciiTbl)
421+
422+
# Debug print
423+
#print "\ncommonValue, commonPattern, commonCharset:", commonValue, commonPattern, commonCharset
421424

422425
# If there is one single output in common-outputs, check
423426
# it via equal against the query output
424-
if singleValue is not None:
425-
# One-shot query containing equals singleValue
426-
query = agent.prefixQuery(" %s" % safeStringFormat('AND (%s) = %s', (expressionUnescaped, unescaper.unescape('\'%s\'' % singleValue))))
427+
if commonValue is not None:
428+
# One-shot query containing equals commonValue
429+
testValue = unescaper.unescape("'%s'" % commonValue) if "'" not in commonValue else unescaper.unescape("%s" % commonValue, quote=False)
430+
query = agent.prefixQuery(" %s" % safeStringFormat("AND (%s) = %s", (expressionUnescaped, testValue)))
427431
query = agent.postfixQuery(query)
428432
queriesCount[0] += 1
429433
result = Request.queryPage(urlencode(agent.payload(newValue=query)))
430434

431435
# Did we have luck?
432436
if result:
433-
dataToSessionFile(replaceNewlineTabs(singleValue[index-1:]))
437+
dataToSessionFile(replaceNewlineTabs(commonValue[index-1:]))
434438

435439
if showEta:
436-
etaProgressUpdate(time.time() - charStart, len(singleValue))
440+
etaProgressUpdate(time.time() - charStart, len(commonValue))
437441
elif conf.verbose >= 1:
438-
dataToStdout(singleValue[index-1:])
442+
dataToStdout(commonValue[index-1:])
439443

440-
finalValue = singleValue
444+
finalValue = commonValue
441445

442446
break
443447

444448
# If there is a common pattern starting with finalValue,
445449
# check it via equal against the substring-query output
446-
if commonPatternValue is not None:
447-
# Substring-query containing equals commonPatternValue
448-
subquery = queries[kb.dbms].substring % (expressionUnescaped, 1, len(commonPatternValue))
449-
query = agent.prefixQuery(" %s" % safeStringFormat('AND (%s) = %s', (subquery, unescaper.unescape('\'%s\'' % commonPatternValue))))
450+
if commonPattern is not None:
451+
# Substring-query containing equals commonPattern
452+
subquery = queries[kb.dbms].substring % (expressionUnescaped, 1, len(commonPattern))
453+
testValue = unescaper.unescape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.unescape("%s" % commonPattern, quote=False)
454+
query = agent.prefixQuery(" %s" % safeStringFormat("AND (%s) = %s", (subquery, testValue)))
450455
query = agent.postfixQuery(query)
451456
queriesCount[0] += 1
452457
result = Request.queryPage(urlencode(agent.payload(newValue=query)))
453458

454459
# Did we have luck?
455460
if result:
456-
val = commonPatternValue[index-1:]
461+
val = commonPattern[index-1:]
457462
index += len(val)-1
458463

459-
# Otherwise if there is no singleValue (single match from
460-
# txt/common-outputs.txt) and no commonPatternValue
464+
# Otherwise if there is no commonValue (single match from
465+
# txt/common-outputs.txt) and no commonPattern
461466
# (common pattern) use the returned common charset only
462467
# to retrieve the query output
463468
if not val and commonCharset:
464469
val = getChar(index, commonCharset, False)
465470

466-
# If we had no luck with singleValue and common charset,
471+
# If we had no luck with commonValue and common charset,
467472
# use the returned other charset
468473
if not val:
469474
val = getChar(index, otherCharset, otherCharset == asciiTbl)

0 commit comments

Comments
 (0)