Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2dae934

Browse files
bdamelebdamele
committed
Minor bug fixes, code refactoring and enhanced --tamper functionality
1 parent 5c3d210 commit 2dae934

9 files changed

Lines changed: 68 additions & 62 deletions

File tree

‎lib/core/exception.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ class sqlmapValueException(Exception):
7070
def unhandledException():
7171
errMsg = "unhandled exception in %s, please copy " % VERSION_STRING
7272
errMsg += "the command line and the following text and send by e-mail "
73-
errMsg += "to [email protected]. The developer will "
73+
errMsg += "to [email protected]. The developers will "
7474
errMsg += "fix it as soon as possible:\nsqlmap version: %s\n" % VERSION
7575
errMsg += "Python version: %s\n" % PYVERSION
7676
errMsg += "Operating system: %s" % PLATFORM
@@ -95,4 +95,4 @@ def unhandledException():
9595
sqlmapUnsupportedDBMSException,
9696
sqlmapUnsupportedFeatureException,
9797
sqlmapValueException,
98-
)
98+
)

‎lib/core/option.py‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import cookielib
1212
import ctypes
1313
import difflib
14+
import inspect
1415
import logging
1516
import os
1617
import re
@@ -531,34 +532,33 @@ def __setDBMS():
531532

532533
def __setTamperingFunctions():
533534
"""
534-
Loads tampering functions from given module path(s).
535+
Loads tampering functions from given script(s)
535536
"""
536-
if conf.tamper:
537-
kb.tamperFunctions = []
538537

539-
import inspect
538+
if conf.tamper:
539+
for tfile in conf.tamper.split(';'):
540+
found = False
540541

541-
for file in conf.tamper.split(';'):
542-
if not file:
542+
if not tfile:
543543
continue
544544

545-
elif not os.path.exists(file):
546-
errMsg = "missing tampering module file '%s'" % file
545+
elif not os.path.exists(tfile):
546+
errMsg = "tamper script '%s' does not exist" % tfile
547547
raise sqlmapFilePathException, errMsg
548548

549-
elif os.path.splitext(file)[1] != '.py':
550-
errMsg = "tampering module file should have an extension '.py'"
549+
elif not tfile.endswith('.py'):
550+
errMsg = "tamper script '%s' should have an extension '.py'" % tfile
551551
raise sqlmapSyntaxException, errMsg
552552

553-
dirname, filename = os.path.split(file)
553+
dirname, filename = os.path.split(tfile)
554554
dirname = os.path.abspath(dirname)
555555

556-
infoMsg = "loading tampering module: '%s'" % filename[:-3]
556+
infoMsg = "loading tamper script '%s'" % filename[:-3]
557557
logger.info(infoMsg)
558558

559559
if not os.path.exists(os.path.join(dirname, '__init__.py')):
560560
errMsg = "make sure that there is an empty file '__init__.py' "
561-
errMsg += "inside of tampering module directory '%s'" % dirname
561+
errMsg += "inside of tamper scripts directory '%s'" % dirname
562562
raise sqlmapGenericException, errMsg
563563

564564
if dirname not in sys.path:
@@ -567,17 +567,17 @@ def __setTamperingFunctions():
567567
try:
568568
module = __import__(filename[:-3])
569569
except ImportError, msg:
570-
raise sqlmapSyntaxException, "can't import module file '%s' (%s)" % (file, msg)
570+
raise sqlmapSyntaxException, "can not import tamper script '%s' (%s)" % (filename[:-3], msg)
571571

572-
found = False
573572
for name, function in inspect.getmembers(module, inspect.isfunction):
574-
if name=="tamper" and function.func_code.co_argcount == 2:
573+
if name == "tamper" and function.func_code.co_argcount == 2:
575574
kb.tamperFunctions.append(function)
576575
found = True
576+
577577
break
578578

579579
if not found:
580-
raise sqlmapGenericException, "missing function 'tamper(place, value)' in tampering module '%s'" % filename
580+
raise sqlmapGenericException, "missing function 'tamper(place, value)' in tamper script '%s'" % tfile
581581

582582
def __setThreads():
583583
if not isinstance(conf.threads, int) or conf.threads <= 0:
@@ -943,6 +943,9 @@ def __cleanupOptions():
943943
else:
944944
conf.testParameter = []
945945

946+
if conf.tamper:
947+
conf.tamper = conf.tamper.replace(" ", "")
948+
946949
if conf.db:
947950
conf.db = conf.db.replace(" ", "")
948951

@@ -1071,7 +1074,7 @@ def __setKnowledgeBaseAttributes():
10711074
kb.queryCounter = 0
10721075
kb.resumedQueries = {}
10731076
kb.stackedTest = None
1074-
kb.tamperFunctions = None
1077+
kb.tamperFunctions = []
10751078
kb.targetUrls = set()
10761079
kb.testedParams = set()
10771080
kb.timeTest = None

‎tamper/between.py‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,41 +7,42 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import re
11-
1210
from lib.core.convert import urldecode
1311
from lib.core.convert import urlencode
1412

15-
"""
16-
'>' -> NOT BETWEEN 0 AND (e.g., A>B->A NOT BETWEEN 0 AND B)
17-
"""
1813
def tamper(place, value):
14+
"""
15+
Replaces '>' with 'NOT BETWEEN 0 AND #'
16+
Example: 'A > B' becomes 'A NOT BETWEEN 0 AND B'
17+
"""
18+
1919
retVal = value
2020

2121
if value:
2222
if place != "URI":
2323
value = urldecode(value)
2424

2525
retVal = ""
26-
qoute, doublequote, firstspace = False, False, False
26+
quote, doublequote, firstspace = False, False, False
2727

2828
for i in xrange(len(value)):
2929
if not firstspace:
3030
if value[i].isspace():
3131
firstspace = True
32-
retVal += "/**/"
32+
retVal += " "
3333
continue
3434

3535
elif value[i] == '\'':
36-
qoute = not qoute
36+
quote = not quote
3737

3838
elif value[i] == '"':
3939
doublequote = not doublequote
4040

41-
elif value[i]==">" and not doublequote and not qoute:
41+
elif value[i] == ">" and not doublequote and not quote:
4242
retVal += " " if i > 0 and not value[i-1].isspace() else ""
4343
retVal += "NOT BETWEEN 0 AND"
4444
retVal += " " if i < len(value) - 1 and not value[i+1].isspace() else ""
45+
4546
continue
4647

4748
retVal += value[i]

‎tamper/charencode.py‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,16 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import re
1110
import string
1211

1312
from lib.core.exception import sqlmapUnsupportedFeatureException
1413

15-
"""
16-
value -> urlencode of nonencoded chars in value (e.g., SELECT%20FIELD%20FROM%20TABLE -> %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45)
17-
"""
1814
def tamper(place, value):
15+
"""
16+
Replaces value with urlencode of non-encoded chars in value
17+
Example: 'SELECT%20FIELD%20FROM%20TABLE' becomes '%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45'
18+
"""
19+
1920
retVal = value
2021

2122
if value:
@@ -31,6 +32,6 @@ def tamper(place, value):
3132
retVal += '%%%X' % ord(value[i])
3233
i += 1
3334
else:
34-
raise sqlmapUnsupportedFeatureException, "can't use tampering module '%s' with 'URI' type injections" % __name__
35+
raise sqlmapUnsupportedFeatureException, "can't use tamper script '%s' with 'URI' type injections" % __name__
3536

3637
return retVal

‎tamper/doubleencode.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,19 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import re
11-
1210
from lib.core.convert import urlencode
1311
from lib.core.exception import sqlmapUnsupportedFeatureException
1412

15-
"""
16-
Tampering value -> urlencode(value) (e.g., SELECT%20FIELD%20FROM%20TABLE -> SELECT%25%20FIELD%25%20FROM%25%20TABLE)
17-
"""
1813
def tamper(place, value):
14+
"""
15+
Replaces value with urlencode(value)
16+
Example: 'SELECT%20FIELD%20FROM%20TABLE' becomes 'SELECT%25%20FIELD%25%20FROM%25%20TABLE'
17+
"""
18+
1919
if value:
2020
if place != "URI":
21-
value = urlencode(value)
21+
value = urlencode(value, convall=True)
2222
else:
23-
raise sqlmapUnsupportedFeatureException, "can't use tampering module '%s' with 'URI' type injections" % __name__
23+
raise sqlmapUnsupportedFeatureException, "can't use tamper script '%s' with 'URI' type injections" % __name__
2424

2525
return value

‎tamper/ifnull2ifisnull.py‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,14 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import re
11-
1210
from lib.core.convert import urldecode
1311
from lib.core.convert import urlencode
1412

15-
"""
16-
IFNULL(A,B) -> IF(ISNULL(A),B,A) (e.g., IFNULL(1,2) -> IF(ISNULL(1),2,1))
17-
"""
1813
def tamper(place, value):
14+
"""
15+
Replaces 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'
16+
Example: 'IFNULL(1, 2)' becomes 'IF(ISNULL(1), 2, 1)'
17+
"""
1918

2019
if value and value.find("IFNULL") > -1:
2120
if place != "URI":

‎tamper/randomcase.py‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,18 @@
88
"""
99

1010
import re
11-
import string
1211

1312
from lib.core.common import randomRange
1413
from lib.core.convert import urldecode
1514
from lib.core.convert import urlencode
1615
from lib.core.data import kb
1716

18-
"""
19-
value -> chars from value with random case (e.g., INSERT->InsERt)
20-
"""
2117
def tamper(place, value):
18+
"""
19+
Replaces each character with random case value
20+
Example: 'INSERT' might become 'InsERt'
21+
"""
22+
2223
retVal = value
2324

2425
if value:

tamper/randomblanks.py renamed to tamper/randomcomments.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,18 @@
88
"""
99

1010
import re
11-
import string
1211

1312
from lib.core.common import randomRange
1413
from lib.core.convert import urldecode
1514
from lib.core.convert import urlencode
1615
from lib.core.data import kb
1716

18-
"""
19-
value -> value with inserted random blanks (e.g., INSERT->IN/**/S/**/ERT)
20-
"""
2117
def tamper(place, value):
18+
"""
19+
Add random comments to value
20+
Example: 'INSERT' becomes 'IN/**/S/**/ERT'
21+
"""
22+
2223
retVal = value
2324

2425
if value:

‎tamper/space2comment.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,23 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import re
11-
1210
from lib.core.convert import urldecode
1311
from lib.core.convert import urlencode
1412

15-
"""
16-
' ' -> /**/ (e.g., SELECT id FROM users->SELECT/**/id/**/FROM users)
17-
"""
1813
def tamper(place, value):
14+
"""
15+
Replaces ' ' with '/**/'
16+
Example: 'SELECT id FROM users' becomes 'SELECT/**/id/**/FROM users'
17+
"""
18+
1919
retVal = value
2020

2121
if value:
2222
if place != "URI":
2323
value = urldecode(value)
2424

2525
retVal = ""
26-
qoute, doublequote, firstspace = False, False, False
26+
quote, doublequote, firstspace = False, False, False
2727

2828
for i in xrange(len(value)):
2929
if not firstspace:
@@ -33,12 +33,12 @@ def tamper(place, value):
3333
continue
3434

3535
elif value[i] == '\'':
36-
qoute = not qoute
36+
quote = not quote
3737

3838
elif value[i] == '"':
3939
doublequote = not doublequote
4040

41-
elif value[i]==" " and not doublequote and not qoute:
41+
elif value[i]==" " and not doublequote and not quote:
4242
retVal += "/**/"
4343
continue
4444

0 commit comments

Comments
 (0)