Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5f2bb88

Browse files
stamparmstamparm
committed
Some code refactoring
1 parent 65b02d4 commit 5f2bb88

32 files changed

Lines changed: 233 additions & 261 deletions

‎lib/controller/checks.py‎

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ def checkSqlInjection(place, parameter, value):
137137
SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
138138
msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms)
139139
msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]"
140-
kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y').upper() == 'Y' else []
140+
kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else []
141141

142142
# If the DBMS has been fingerprinted (via DBMS-specific error
143143
# message, via simple heuristic check or via DBMS-specific
@@ -152,7 +152,7 @@ def checkSqlInjection(place, parameter, value):
152152
msg += " and " if conf.level < 5 and conf.risk < 3 else ""
153153
msg += "risk (%d)" % conf.risk if conf.risk < 3 else ""
154154
msg += " values? [Y/n]" if conf.level < 5 and conf.risk < 3 else " value? [Y/n]"
155-
kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y').upper() == 'Y' else []
155+
kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else []
156156

157157
title = test.title
158158
kb.testType = stype = test.stype
@@ -631,7 +631,8 @@ def genCmpPayload():
631631
msg += "extended UNION tests if there is not "
632632
msg += "at least one other (potential) "
633633
msg += "technique found. Do you want to skip? [Y/n] "
634-
kb.futileUnion = readInput(msg, default="Y").strip().upper() == 'N'
634+
635+
kb.futileUnion = not readInput(msg, default='Y', boolean=True)
635636
if kb.futileUnion is False:
636637
continue
637638

@@ -738,11 +739,9 @@ def genCmpPayload():
738739
logger.warn(warnMsg)
739740

740741
msg = "how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]"
741-
choice = readInput(msg, default="S", checkBatch=False)
742+
choice = readInput(msg, default='S', checkBatch=False).strip().upper()
742743

743-
if choice[0] in ("s", "S"):
744-
pass
745-
elif choice[0] in ("c", "C"):
744+
if choice == 'C':
746745
choice = None
747746
while not ((choice or "").isdigit() and 0 <= int(choice) <= 6):
748747
if choice:
@@ -752,11 +751,11 @@ def genCmpPayload():
752751
conf.verbose = int(choice)
753752
setVerbosity()
754753
tests.insert(0, test)
755-
elif choice[0] in ("n", "N"):
754+
elif choice == 'N':
756755
return None
757-
elif choice[0] in ("e", "E"):
756+
elif choice == 'E':
758757
kb.endDetection = True
759-
elif choice[0] in ("q", "Q"):
758+
elif choice == 'Q':
760759
raise SqlmapUserQuitException
761760

762761
finally:
@@ -1177,19 +1176,19 @@ def checkStability():
11771176
logger.warn(warnMsg)
11781177

11791178
message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] "
1180-
test = readInput(message, default="C")
1179+
choice = readInput(message, default='C').strip().upper()
11811180

1182-
if test and test[0] in ("q", "Q"):
1181+
if choice == 'Q':
11831182
raise SqlmapUserQuitException
11841183

1185-
elif test and test[0] in ("s", "S"):
1184+
elif choice == 'S':
11861185
showStaticWords(firstPage, secondPage)
11871186

11881187
message = "please enter value for parameter 'string': "
1189-
test = readInput(message)
1188+
string = readInput(message)
11901189

1191-
if test:
1192-
conf.string = test
1190+
if string:
1191+
conf.string = string
11931192

11941193
if kb.nullConnection:
11951194
debugMsg = "turning off NULL connection "
@@ -1201,12 +1200,12 @@ def checkStability():
12011200
errMsg = "Empty value supplied"
12021201
raise SqlmapNoneDataException(errMsg)
12031202

1204-
elif test and test[0] in ("r", "R"):
1203+
elif choice == 'R':
12051204
message = "please enter value for parameter 'regex': "
1206-
test = readInput(message)
1205+
regex = readInput(message)
12071206

1208-
if test:
1209-
conf.regex = test
1207+
if regex:
1208+
conf.regex = regex
12101209

12111210
if kb.nullConnection:
12121211
debugMsg = "turning off NULL connection "
@@ -1372,13 +1371,13 @@ def _(*args, **kwargs):
13721371
if retVal:
13731372
message = "are you sure that you want to "
13741373
message += "continue with further target testing? [y/N] "
1375-
output = readInput(message, default="N")
1374+
choice = readInput(message, default='N', boolean=True)
13761375

13771376
if not conf.tamper:
13781377
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
13791378
singleTimeWarnMessage(warnMsg)
13801379

1381-
if output and output[0] not in ("Y", "y"):
1380+
if not choice:
13821381
raise SqlmapUserQuitException
13831382
else:
13841383
warnMsg = "WAF/IPS/IDS product hasn't been identified"
@@ -1494,7 +1493,7 @@ def checkConnection(suppressOutput=False):
14941493
return False
14951494

14961495
msg = "it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] "
1497-
if readInput(msg, default="Y") not in ("n", "N"):
1496+
if readInput(msg, default='Y', boolean=True):
14981497
raise SqlmapSilentQuitException
14991498
else:
15001499
kb.ignoreNotFound = True

‎lib/controller/controller.py‎

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -183,8 +183,8 @@ def _randomFillBlankFields(value):
183183

184184
if extractRegexResult(EMPTY_FORM_FIELDS_REGEX, value):
185185
message = "do you want to fill blank fields with random values? [Y/n] "
186-
test = readInput(message, default="Y")
187-
if not test or test[0] in ("y", "Y"):
186+
187+
if readInput(message, default="Y", boolean=True):
188188
for match in re.finditer(EMPTY_FORM_FIELDS_REGEX, retVal):
189189
item = match.group("result")
190190
if not any(_ in item for _ in IGNORE_PARAMETERS) and not re.search(ASP_NET_CONTROL_REGEX, item):
@@ -305,7 +305,9 @@ def start():
305305
message = "SQL injection vulnerability has already been detected "
306306
message += "against '%s'. Do you want to skip " % conf.hostname
307307
message += "further tests involving it? [Y/n]"
308-
kb.skipVulnHost = readInput(message, default="Y").upper() != 'N'
308+
309+
kb.skipVulnHost = readInput(message, default="Y", boolean=True)
310+
309311
testSqlInj = not kb.skipVulnHost
310312

311313
if not testSqlInj:
@@ -332,9 +334,8 @@ def start():
332334
continue
333335

334336
message += "\ndo you want to test this form? [Y/n/q] "
335-
test = readInput(message, default="Y")
336337

337-
if not test or test[0] in ("y", "Y"):
338+
if readInput(message, default='Y', boolean=True):
338339
if conf.method != HTTPMETHOD.GET:
339340
message = "Edit %s data [default: %s]%s: " % (conf.method, urlencode(conf.data) if conf.data else "None", " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "")
340341
conf.data = readInput(message, default=conf.data)
@@ -359,14 +360,12 @@ def start():
359360

360361
else:
361362
message += "\ndo you want to test this URL? [Y/n/q]"
362-
test = readInput(message, default="Y")
363+
choice = readInput(message, default='Y').strip().upper()
363364

364-
if not test or test[0] in ("y", "Y"):
365-
pass
366-
elif test[0] in ("n", "N"):
365+
if choice == 'N':
367366
dataToStdout(os.linesep)
368367
continue
369-
elif test[0] in ("q", "Q"):
368+
elif choice == 'Q':
370369
break
371370

372371
infoMsg = "testing URL '%s'" % targetUrl
@@ -543,9 +542,8 @@ def start():
543542

544543
msg = "%s parameter '%s' " % (injection.place, injection.parameter)
545544
msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] "
546-
test = readInput(msg, default="N")
547545

548-
if test[0] not in ("y", "Y"):
546+
if not readInput(msg, default='N', boolean=True):
549547
proceed = False
550548
paramKey = (conf.hostname, conf.path, None, None)
551549
kb.testedParams.add(paramKey)
@@ -629,9 +627,7 @@ def start():
629627
if kb.injection.place is not None and kb.injection.parameter is not None:
630628
if conf.multipleTargets:
631629
message = "do you want to exploit this SQL injection? [Y/n] "
632-
exploit = readInput(message, default="Y")
633-
634-
condition = not exploit or exploit[0] in ("y", "Y")
630+
condition = readInput(message, default='Y', boolean=True)
635631
else:
636632
condition = True
637633

@@ -644,13 +640,11 @@ def start():
644640
logger.warn(warnMsg)
645641

646642
message = "do you want to skip to the next target in list? [Y/n/q]"
647-
test = readInput(message, default="Y")
643+
choice = readInput(message, default='Y').strip().upper()
648644

649-
if not test or test[0] in ("y", "Y"):
650-
pass
651-
elif test[0] in ("n", "N"):
645+
if choice == 'N':
652646
return False
653-
elif test[0] in ("q", "Q"):
647+
elif choice == 'Q':
654648
raise SqlmapUserQuitException
655649
else:
656650
raise

‎lib/core/common.py‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -601,8 +601,8 @@ def paramToDict(place, parameters=None):
601601
logger.warn(warnMsg)
602602

603603
message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "
604-
test = readInput(message, default="N")
605-
if test[0] not in ("y", "Y"):
604+
605+
if not readInput(message, default='N', boolean=True):
606606
raise SqlmapSilentQuitException
607607
elif not _:
608608
warnMsg = "provided value for parameter '%s' is empty. " % parameter
@@ -644,8 +644,8 @@ def walk(head, current=None):
644644
if candidates:
645645
message = "it appears that provided value for %s parameter '%s' " % (place, parameter)
646646
message += "is JSON deserializable. Do you want to inject inside? [y/N] "
647-
test = readInput(message, default="N")
648-
if test[0] in ("y", "Y"):
647+
648+
if not readInput(message, default='N', boolean=True):
649649
del testableParameters[parameter]
650650
testableParameters.update(candidates)
651651
break
@@ -657,8 +657,8 @@ def walk(head, current=None):
657657
_ = re.sub(regex, "\g<1>%s\g<%d>" % (CUSTOM_INJECTION_MARK_CHAR, len(match.groups())), testableParameters[parameter])
658658
message = "it appears that provided value for %s parameter '%s' " % (place, parameter)
659659
message += "has boundaries. Do you want to inject inside? ('%s') [y/N] " % _
660-
test = readInput(message, default="N")
661-
if test[0] in ("y", "Y"):
660+
661+
if readInput(message, default='N', boolean=True):
662662
testableParameters[parameter] = re.sub(regex, "\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter])
663663
break
664664

@@ -965,7 +965,7 @@ def dataToOutFile(filename, data):
965965

966966
return retVal
967967

968-
def readInput(message, default=None, checkBatch=True):
968+
def readInput(message, default=None, checkBatch=True, boolean=False):
969969
"""
970970
Reads input from terminal
971971
"""
@@ -1038,6 +1038,9 @@ def readInput(message, default=None, checkBatch=True):
10381038
finally:
10391039
logging._releaseLock()
10401040

1041+
if boolean:
1042+
retVal = retVal.strip().upper == 'Y'
1043+
10411044
return retVal
10421045

10431046
def randomRange(start=0, stop=1000, seed=None):
@@ -1979,9 +1982,8 @@ def getSQLSnippet(dbms, sfile, **variables):
19791982
logger.error(errMsg)
19801983

19811984
msg = "do you want to provide the substitution values? [y/N] "
1982-
choice = readInput(msg, default="N")
19831985

1984-
if choice and choice[0].lower() == "y":
1986+
if readInput(msg, default='N', boolean=True):
19851987
for var in variables:
19861988
msg = "insert value for variable '%s': " % var
19871989
val = readInput(msg, default="")
@@ -2370,8 +2372,8 @@ def wasLastResponseDelayed():
23702372
if kb.adjustTimeDelay is None:
23712373
msg = "do you want sqlmap to try to optimize value(s) "
23722374
msg += "for DBMS delay responses (option '--time-sec')? [Y/n] "
2373-
choice = readInput(msg, default='Y')
2374-
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if choice.upper() == 'N' else ADJUST_TIME_DELAY.YES
2375+
2376+
kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if not readInput(msg, default='Y', boolean=True) else ADJUST_TIME_DELAY.YES
23752377
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES:
23762378
adjustTimeDelay(threadData.lastQueryDuration, lowerStdLimit)
23772379

@@ -3263,11 +3265,11 @@ def createGithubIssue(errMsg, excMsg):
32633265
msg += "with the unhandled exception information at "
32643266
msg += "the official Github repository? [y/N] "
32653267
try:
3266-
test = readInput(msg, default="N")
3268+
choice = readInput(msg, default='N', boolean=True)
32673269
except:
3268-
test = None
3270+
choice = None
32693271

3270-
if test and test[0] in ("y", "Y"):
3272+
if choice:
32713273
ex = None
32723274
errMsg = errMsg[errMsg.find("\n"):]
32733275

‎lib/core/option.py‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -542,8 +542,7 @@ def retrieve():
542542
elif re.search(URI_INJECTABLE_REGEX, link, re.I):
543543
if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork:
544544
message = "do you want to scan only results containing GET parameters? [Y/n] "
545-
test = readInput(message, default="Y")
546-
kb.data.onlyGETs = test.lower() != 'n'
545+
kb.data.onlyGETs = readInput(message, default='Y', boolean=True)
547546
if not kb.data.onlyGETs or conf.googleDork:
548547
kb.targets.add((link, conf.method, conf.data, conf.cookie, None))
549548

@@ -570,9 +569,8 @@ def retrieve():
570569
message += "for your search dork expression, but none of them "
571570
message += "have GET parameters to test for SQL injection. "
572571
message += "Do you want to skip to the next result page? [Y/n]"
573-
test = readInput(message, default="Y")
574572

575-
if test[0] in ("n", "N"):
573+
if not readInput(message, default='Y', boolean=True):
576574
raise SqlmapSilentQuitException
577575
else:
578576
conf.googlePage += 1
@@ -946,14 +944,14 @@ def _setTamperingFunctions():
946944
message = "it appears that you might have mixed "
947945
message += "the order of tamper scripts. "
948946
message += "Do you want to auto resolve this? [Y/n/q] "
949-
test = readInput(message, default="Y")
947+
choice = readInput(message, default='Y').strip().upper()
950948

951-
if not test or test[0] in ("y", "Y"):
952-
resolve_priorities = True
953-
elif test[0] in ("n", "N"):
949+
if choice == 'N':
954950
resolve_priorities = False
955-
elif test[0] in ("q", "Q"):
951+
elif choice == 'Q':
956952
raise SqlmapUserQuitException
953+
else:
954+
resolve_priorities = True
957955

958956
check_priority = False
959957

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.1.4.31"
22+
VERSION = "1.1.4.32"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

0 commit comments

Comments
 (0)