Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4147f44

Browse files
stamparmstamparm
committed
Potential patch for Issues like #3013 and #3017 
1 parent 2cc6214 commit 4147f44

12 files changed

Lines changed: 53 additions & 12 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
from lib.core.datatype import AttribDict
5555
from lib.core.datatype import InjectionDict
5656
from lib.core.decorators import cachedmethod
57+
from lib.core.decorators import stackedmethod
5758
from lib.core.dicts import FROM_DUMMY_TABLE
5859
from lib.core.enums import DBMS
5960
from lib.core.enums import HASHDB_KEYS
@@ -832,6 +833,7 @@ def genCmpPayload():
832833

833834
return injection
834835

836+
@stackedmethod
835837
def heuristicCheckDbms(injection):
836838
"""
837839
This functions is called when boolean-based blind is identified with a
@@ -868,6 +870,7 @@ def heuristicCheckDbms(injection):
868870

869871
return retVal
870872

873+
@stackedmethod
871874
def checkFalsePositives(injection):
872875
"""
873876
Checks for false positives (only in single special cases)
@@ -929,6 +932,7 @@ def _():
929932

930933
return retVal
931934

935+
@stackedmethod
932936
def checkSuhosinPatch(injection):
933937
"""
934938
Checks for existence of Suhosin-patch (and alike) protection mechanism(s)
@@ -952,6 +956,7 @@ def checkSuhosinPatch(injection):
952956

953957
kb.injection = popValue()
954958

959+
@stackedmethod
955960
def checkFilteredChars(injection):
956961
debugMsg = "checking for filtered characters"
957962
logger.debug(debugMsg)
@@ -1314,6 +1319,7 @@ def checkRegexp():
13141319

13151320
return True
13161321

1322+
@stackedmethod
13171323
def checkWaf():
13181324
"""
13191325
Reference: http://seclists.org/nmap-dev/2011/q2/att-1005/http-waf-detect.nse
@@ -1379,6 +1385,7 @@ def checkWaf():
13791385

13801386
return retVal
13811387

1388+
@stackedmethod
13821389
def identifyWaf():
13831390
if not conf.identifyWaf:
13841391
return None
@@ -1463,6 +1470,7 @@ def _(*args, **kwargs):
14631470

14641471
return retVal
14651472

1473+
@stackedmethod
14661474
def checkNullConnection():
14671475
"""
14681476
Reference: http://www.wisec.it/sectou.php?id=472f952d79293

‎lib/controller/controller.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
from lib.core.data import conf
4444
from lib.core.data import kb
4545
from lib.core.data import logger
46+
from lib.core.decorators import stackedmethod
4647
from lib.core.enums import CONTENT_TYPE
4748
from lib.core.enums import HASHDB_KEYS
4849
from lib.core.enums import HEURISTIC_TEST
@@ -253,6 +254,7 @@ def _saveToResultsFile():
253254

254255
conf.resultsFP.flush()
255256

257+
@stackedmethod
256258
def start():
257259
"""
258260
This function calls a function that performs checks on both URL

‎lib/core/decorators.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77

88
import hashlib
99

10+
from lib.core.threads import getCurrentThreadData
11+
1012
def cachedmethod(f, cache={}):
1113
"""
1214
Method with a cached content
@@ -22,3 +24,18 @@ def _(*args, **kwargs):
2224
return cache[key]
2325

2426
return _
27+
28+
def stackedmethod(f):
29+
def _(*args, **kwargs):
30+
threadData = getCurrentThreadData()
31+
originalLevel = len(threadData.valueStack)
32+
33+
try:
34+
result = f(*args, **kwargs)
35+
finally:
36+
if len(threadData.valueStack) > originalLevel:
37+
threadData.valueStack = threadData.valueStack[:originalLevel]
38+
39+
return result
40+
41+
return _

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.4.0"
22+
VERSION = "1.2.4.1"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/request/connect.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ class WebSocketException(Exception):
6363
from lib.core.data import conf
6464
from lib.core.data import kb
6565
from lib.core.data import logger
66+
from lib.core.decorators import stackedmethod
6667
from lib.core.dicts import POST_HINT_CONTENT_TYPES
6768
from lib.core.enums import ADJUST_TIME_DELAY
6869
from lib.core.enums import AUTH_TYPE
@@ -768,6 +769,7 @@ class _(dict):
768769
return page, responseHeaders, code
769770

770771
@staticmethod
772+
@stackedmethod
771773
def queryPage(value=None, place=None, content=False, getRatioValue=False, silent=False, method=None, timeBasedCompare=False, noteResponseTime=True, auxHeaders=None, response=False, raise404=None, removeReflection=True):
772774
"""
773775
This method calls a function to get the target URL page content

‎lib/request/inject.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
from lib.core.data import kb
3434
from lib.core.data import logger
3535
from lib.core.data import queries
36+
from lib.core.decorators import stackedmethod
3637
from lib.core.dicts import FROM_DUMMY_TABLE
3738
from lib.core.enums import CHARSET_TYPE
3839
from lib.core.enums import DBMS
@@ -333,6 +334,7 @@ def _goUnion(expression, unpack=True, dump=False):
333334

334335
return output
335336

337+
@stackedmethod
336338
def getValue(expression, blind=True, union=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeCharEncode=True):
337339
"""
338340
Called each time sqlmap inject a SQL query on the SQL injection

‎lib/takeover/xp_cmdshell.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
from lib.core.data import conf
2525
from lib.core.data import kb
2626
from lib.core.data import logger
27+
from lib.core.decorators import stackedmethod
2728
from lib.core.enums import CHARSET_TYPE
2829
from lib.core.enums import DBMS
2930
from lib.core.enums import EXPECTED
@@ -96,6 +97,7 @@ def _xpCmdshellCheck(self):
9697

9798
return wasLastResponseDelayed()
9899

100+
@stackedmethod
99101
def _xpCmdshellTest(self):
100102
threadData = getCurrentThreadData()
101103
pushValue(threadData.disableStdOut)

‎lib/techniques/union/test.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
from lib.core.data import conf
2828
from lib.core.data import kb
2929
from lib.core.data import logger
30+
from lib.core.decorators import stackedmethod
3031
from lib.core.dicts import FROM_DUMMY_TABLE
3132
from lib.core.enums import PAYLOAD
3233
from lib.core.settings import LIMITED_ROWS_TEST_NUMBER
@@ -48,6 +49,7 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
4849
"""
4950
retVal = None
5051

52+
@stackedmethod
5153
def _orderByTechnique(lowerCount, upperCount):
5254
def _orderByTest(cols):
5355
query = agent.prefixQuery("ORDER BY %d" % cols, prefix=prefix)

‎lib/utils/search.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
from lib.core.data import conf
2121
from lib.core.data import kb
2222
from lib.core.data import logger
23+
from lib.core.decorators import stackedmethod
2324
from lib.core.enums import CUSTOM_LOGGING
2425
from lib.core.enums import HTTP_HEADER
2526
from lib.core.enums import REDIRECTION
@@ -165,6 +166,7 @@ def _search(dork):
165166

166167
return retVal
167168

169+
@stackedmethod
168170
def search(dork):
169171
pushValue(kb.redirectChoice)
170172
kb.redirectChoice = REDIRECTION.YES

‎plugins/dbms/mysql/filesystem.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from lib.core.data import conf
1515
from lib.core.data import kb
1616
from lib.core.data import logger
17+
from lib.core.decorators import stackedmethod
1718
from lib.core.enums import CHARSET_TYPE
1819
from lib.core.enums import EXPECTED
1920
from lib.core.enums import PAYLOAD
@@ -81,6 +82,7 @@ def stackedReadFile(self, rFile):
8182

8283
return result
8384

85+
@stackedmethod
8486
def unionWriteFile(self, wFile, dFile, fileType, forceCheck=False):
8587
logger.debug("encoding file to its hexadecimal string value")
8688

0 commit comments

Comments
 (0)