Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 38c9627

Browse files
bdamelebdamele
committed
Minor enhancemet to support also --regexp, --excl-str and --excl-reg
options rather than only --string when comparing HTTP responses page content
1 parent 78e8a83 commit 38c9627

9 files changed

Lines changed: 145 additions & 36 deletions

File tree

‎doc/ChangeLog‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,34 @@
11
sqlmap (0.6.3-1) stable; urgency=low
22

3-
* Major enhancement to support stacked queries when the web application
4-
supports it which will be used in the long run by takeover
5-
functionality;
63
* Major enhancement to get list of targets to test from Burp proxy
74
(http://portswigger.net/suite/) requests log file path or WebScarab
85
proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project)
9-
'conversations/' folder path;
6+
'conversations/' folder path by providing option -l <filepath>;
7+
* Major enhancement to support stacked queries (multiple staatements)
8+
when the web application supports them which is useful for time based
9+
blind sql injection test and will be used someday also by takeover
10+
functionality;
1011
* Minor enhancement to test if the injectable parameter is affected by
11-
a time based blind SQL injection technique;
12+
a time based blind SQL injection technique by providing option
13+
--time-test;
1214
* Minor enhancement to fingerprint the web server operating system and
1315
the web application technology by parsing some HTTP response headers;
1416
* Minor enhancement to fingerprint the back-end DBMS operating system by
1517
parsing the DBMS banner value when -b option is provided;
1618
* Minor enhancement to be able to specify the number of seconds before
17-
timeout the connection, default is set to 10 seconds;
19+
timeout the connection by providing option --timeout #, default is set
20+
to 10 seconds and must be 3 or higher;
1821
* Minor enhancement to be able to specify the number of seconds to wait
19-
between each HTTP request providing option --delay #;
22+
between each HTTP request by providing option --delay #;
2023
* Minor enhancement to be able to enumerate table columns and dump table
2124
entries, also when the database name is not provided, by using the
2225
current database on MySQL and Microsoft SQL Server, the 'public'
2326
scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle;
27+
* Minor enhancemet to support also --regexp, --excl-str and --excl-reg
28+
options rather than only --string when comparing HTTP responses page
29+
content;
30+
* Minor improvement to be able to provide CU as user value (-U) when
31+
enumerating users privileges or users passwords;
2432
* Minor improvement to set by default in all HTTP requests the standard
2533
client HTTP headers (Accept, Accept-Encoding, etc);
2634
* Minor improvements to sqlmap Debian package files: sqlmap uploaded

‎doc/THANKS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ Chip Andrews <[email protected]>
55
at SQLSecurity.com and permission to implement the update feature
66
taking data from his site
77

8+
Jack Butler <[email protected]>
9+
for providing me with the sqlmap site favicon
10+
811
Karl Chen <[email protected]>
912
for providing with the multithreading patch for the inference
1013
algorithm

‎lib/core/optiondict.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,11 @@
4949

5050
"Injection": {
5151
"testParameter": "string",
52-
"string": "string",
5352
"dbms": "string",
53+
"string": "string",
54+
"regexp": "string",
55+
"eString": "string",
56+
"eRegexp": "string",
5457
},
5558

5659
"Techniques": {

‎lib/core/update.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ def __updateMSSQLXML():
5353
logger.info(infoMsg)
5454

5555
try:
56-
mssqlVersionsHtmlString = Request.getPage(url=MSSQL_VERSIONS_URL, direct=True)
56+
mssqlVersionsHtmlString, _ = Request.getPage(url=MSSQL_VERSIONS_URL, direct=True)
5757
except sqlmapConnectionException, _:
5858
__mssqlPath = urlparse.urlsplit(MSSQL_VERSIONS_URL)
5959
__mssqlHostname = __mssqlPath[1]
@@ -231,7 +231,7 @@ def __updateSqlmap():
231231
logger.debug(debugMsg)
232232

233233
try:
234-
sqlmapNewestVersion = Request.getPage(url=SQLMAP_VERSION_URL, direct=True)
234+
sqlmapNewestVersion, _ = Request.getPage(url=SQLMAP_VERSION_URL, direct=True)
235235
except sqlmapConnectionException, _:
236236
__sqlmapPath = urlparse.urlsplit(SQLMAP_VERSION_URL)
237237
__sqlmapHostname = __sqlmapPath[1]
@@ -271,7 +271,7 @@ def __updateSqlmap():
271271
sqlmapBinaryStringUrl = SQLMAP_SOURCE_URL % sqlmapNewestVersion
272272

273273
try:
274-
sqlmapBinaryString = Request.getPage(url=sqlmapBinaryStringUrl, direct=True)
274+
sqlmapBinaryString, _ = Request.getPage(url=sqlmapBinaryStringUrl, direct=True)
275275
except sqlmapConnectionException, _:
276276
__sqlmapPath = urlparse.urlsplit(sqlmapBinaryStringUrl)
277277
__sqlmapHostname = __sqlmapPath[1]

‎lib/parse/cmdline.py‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,12 +109,24 @@ def cmdLineParser():
109109
injection.add_option("-p", dest="testParameter",
110110
help="Testable parameter(s)")
111111

112+
injection.add_option("--dbms", dest="dbms",
113+
help="Force back-end DBMS to this value")
114+
112115
injection.add_option("--string", dest="string",
113116
help="String to match in page when the "
114117
"query is valid")
115118

116-
injection.add_option("--dbms", dest="dbms",
117-
help="Force back-end DBMS to this value")
119+
injection.add_option("--regexp", dest="regexp",
120+
help="Regexp to match in page when the "
121+
"query is valid")
122+
123+
injection.add_option("--excl-str", dest="eString",
124+
help="String to be excluded before calculating "
125+
"page hash")
126+
127+
injection.add_option("--excl-reg", dest="eRegexp",
128+
help="Regexp matches to be excluded before "
129+
"calculating page hash")
118130

119131
# Techniques options
120132
techniques = OptionGroup(parser, "Techniques", "These options can "

‎lib/request/comparison.py‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2006-2008 Bernardo Damele A. G. <[email protected]>
9+
and Daniele Bellucci <[email protected]>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
26+
27+
import md5
28+
import re
29+
30+
from lib.core.data import conf
31+
from lib.core.data import kb
32+
from lib.core.data import logger
33+
34+
35+
def comparison(page, headers=None, content=False):
36+
regExpResults = None
37+
38+
if conf.eString and conf.eString in page:
39+
index = page.index(conf.eString)
40+
length = len(conf.eString)
41+
pageWithoutString = page[:index]
42+
pageWithoutString += page[index+length:]
43+
page = pageWithoutString
44+
45+
if conf.eRegexp:
46+
regExpResults = re.findall(conf.eRegexp, page, re.I | re.M)
47+
48+
if conf.eRegexp and regExpResults:
49+
for regExpResult in regExpResults:
50+
index = page.index(regExpResult)
51+
length = len(regExpResult)
52+
pageWithoutRegExp = page[:index]
53+
pageWithoutRegExp += page[index+length:]
54+
page = pageWithoutRegExp
55+
56+
if conf.string:
57+
if conf.string in page:
58+
return True
59+
else:
60+
return False
61+
62+
elif conf.regexp:
63+
if re.search(conf.regexp, page, re.I | re.M):
64+
return True
65+
else:
66+
return False
67+
68+
else:
69+
return md5.new(page).hexdigest()

‎lib/request/connect.py‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
from lib.core.settings import RETRIES
4343
from lib.request.basic import forgeHeaders
4444
from lib.request.basic import parseResponse
45-
45+
from lib.request.comparison import comparison
4646

4747

4848
class Connect:
@@ -190,15 +190,15 @@ def getPage(**kwargs):
190190
warnMsg += "status code, try to force the HTTP User-Agent "
191191
warnMsg += "header with option --user-agent or -a"
192192

193+
if "BadStatusLine" not in tbMsg:
194+
warnMsg += " or proxy"
195+
193196
if conf.multipleTargets:
194197
warnMsg += ", skipping to next url"
195198
logger.warn(warnMsg)
196199

197200
return None
198201

199-
if "BadStatusLine" not in tbMsg:
200-
warnMsg += " or proxy"
201-
202202
if conf.retries < RETRIES:
203203
conf.retries += 1
204204

@@ -207,6 +207,7 @@ def getPage(**kwargs):
207207

208208
time.sleep(1)
209209
return Connect.__getPageProxy(get=get, post=post, cookie=cookie, ua=ua, direct=direct, multipart=multipart)
210+
210211
else:
211212
raise sqlmapConnectionException, warnMsg
212213

@@ -220,7 +221,7 @@ def getPage(**kwargs):
220221

221222
logger.log(8, responseMsg)
222223

223-
return page
224+
return page, responseHeaders
224225

225226

226227
@staticmethod
@@ -263,15 +264,9 @@ def queryPage(value=None, place=None, content=False):
263264
else:
264265
ua = conf.parameters["User-Agent"]
265266

266-
page = Connect.getPage(get=get, post=post, cookie=cookie, ua=ua)
267+
page, headers = Connect.getPage(get=get, post=post, cookie=cookie, ua=ua)
267268

268-
# TODO: create a comparison library and move these checks there
269269
if content:
270270
return page
271-
elif conf.string:
272-
if conf.string in page:
273-
return True
274-
else:
275-
return False
276271
else:
277-
return md5.new(page).hexdigest()
272+
return comparison(page, headers, content)

‎plugins/dbms/mysql.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@ def osShell(self):
450450

451451
baseUrl = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, requestDir)
452452
uploaderUrl = "%s/%s" % (baseUrl, uploaderName)
453-
page = Request.getPage(url=uploaderUrl, direct=True)
453+
page, _ = Request.getPage(url=uploaderUrl, direct=True)
454454

455455
if "sqlmap backdoor uploader" not in page:
456456
warnMsg = "unable to upload the uploader "
@@ -470,7 +470,7 @@ def osShell(self):
470470
"uploadDir": directory,
471471
}
472472
uploaderUrl = "%s/%s" % (baseUrl, uploaderName)
473-
page = Request.getPage(url=uploaderUrl, multipart=multipartParams)
473+
page, _ = Request.getPage(url=uploaderUrl, multipart=multipartParams)
474474

475475
if "Backdoor uploaded" not in page:
476476
warnMsg = "unable to upload the backdoor through "
@@ -522,7 +522,7 @@ def osShell(self):
522522
break
523523

524524
cmdUrl = "%s?cmd=%s" % (backdoorUrl, command)
525-
page = Request.getPage(url=cmdUrl, direct=True)
525+
page, _ = Request.getPage(url=cmdUrl, direct=True)
526526
output = re.search("<pre>(.+?)</pre>", page, re.I | re.S)
527527

528528
if output:

‎sqlmap.conf‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -99,19 +99,38 @@ timeout = 10
9999
# parameters and HTTP User-Agent are tested by sqlmap.
100100
testParameter =
101101

102-
# String to match in page when the query is valid, only needed if the
103-
# page content dynamically changes at each refresh, consequently changing
104-
# the MD5 of the page which is the method used by default to determine
105-
# if a query was valid or not. Read the documentation for further
106-
# details.
107-
string =
108-
109102
# Force back-end DBMS to this value. If this option is set, the back-end
110103
# DBMS identification process will be minimized as needed.
111104
# If not set, sqlmap will detect back-end DBMS automatically by default.
112105
# Valid: mssql, mysql, mysql 4, mysql 5, oracle, pgsql
113106
dbms =
114107

108+
# String to match within the page content when the query is valid, only
109+
# needed if the page content dynamically changes at each refresh,
110+
# consequently changing the MD5 hash of the page which is the method used
111+
# by default to determine if a query was valid or not. Refer to the user's
112+
# manual for further details.
113+
string =
114+
115+
# Regular expression to match within the page content when the query is
116+
# valid, only needed if the needed if the page content dynamically changes
117+
# at each refresh, consequently changing the MD5 hash of the page which is
118+
# the method used by default to determine if a query was valid or not.
119+
# Refer to the user's manual for further details.
120+
# Valid: regular expression with Python syntax
121+
# (http://www.python.org/doc/2.5.2/lib/re-syntax.html)
122+
regexp =
123+
124+
# String to be excluded by the page content before calculating the page
125+
# MD5 hash
126+
eString =
127+
128+
# Regular expression matches to be excluded by the page content before
129+
# calculating the page MD5 hash
130+
# Valid: regular expression with Python syntax
131+
# (http://www.python.org/doc/2.5.2/lib/re-syntax.html)
132+
eRegexp =
133+
115134

116135
[Techniques]
117136

0 commit comments

Comments
 (0)