Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 68e13c3

Browse files
stamparmstamparm
committed
periodical commit
1 parent 9c1d82c commit 68e13c3

6 files changed

Lines changed: 113 additions & 7 deletions

File tree

‎lib/core/common.py‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1086,6 +1086,40 @@ def isBase64EncodedString(subject):
10861086
def isHexEncodedString(subject):
10871087
return re.match(r"\A[0-9a-fA-F]+\Z", subject) is not None
10881088

1089+
def profile(profileOutputFile='sqlmap.profile', imageOutputFile='profile.png'):
1090+
import cProfile
1091+
cProfile.run("start()", profileOutputFile)
1092+
1093+
graphScript = 'gprof2dot.py'
1094+
graphScriptRepositoryUrl = 'http://gprof2dot.jrfonseca.googlecode.com/hg/'
1095+
graphScriptPath = os.path.join(paths.SQLMAP_ROOT_PATH, graphScript)
1096+
if not os.path.exists(graphScriptPath):
1097+
errMsg = "unable to find Jose Fonseca's '%s' graph " % graphScript
1098+
errMsg += "conversion script. please download it from "
1099+
errMsg += "official repository at '%s' " % graphScriptRepositoryUrl
1100+
errMsg += "and put it inside sqlmap's root directory ('%s')." % paths.SQLMAP_ROOT_PATH
1101+
logger.error(errMsg)
1102+
return
1103+
1104+
infoMsg = "converting profile data to an image."
1105+
logger.info(infoMsg)
1106+
1107+
if os.path.exists(imageOutputFile):
1108+
os.remove(imageOutputFile)
1109+
1110+
msg = subprocess.Popen('python %s -f pstats %s | dot -Tpng -o %s' % (graphScriptPath, profileOutputFile, imageOutputFile), shell=True, stderr=subprocess.PIPE).stderr.read()
1111+
1112+
if msg:
1113+
errMsg = "there was an error while converting ('%s')." % msg.strip()
1114+
logger.error(errMsg)
1115+
else:
1116+
if os.name == 'mac':
1117+
subprocess.call(('open', imageOutputFile))
1118+
elif os.name == 'posix':
1119+
subprocess.call(('xdg-open', imageOutputFile))
1120+
elif os.name == 'nt':
1121+
subprocess.call(('start', imageOutputFile))
1122+
10891123
def getConsoleWidth(default=80):
10901124
width = None
10911125

@@ -1118,3 +1152,51 @@ def parseXmlFile(xmlFile, handler):
11181152

11191153
def calculateDeltaSeconds(start, epsilon=0.05):
11201154
return int(time.time() - start + epsilon)
1155+
1156+
def getCommonPredictionTables(value, originalTable):
1157+
if not kb.commonTables:
1158+
kb.commonTables = {}
1159+
fileName = os.path.join(paths.SQLMAP_TXT_PATH, 'common-tables.txt')
1160+
file = open(fileName, 'r')
1161+
key = None
1162+
for line in file.xreadlines():
1163+
line = line.strip()
1164+
if len(line) > 1:
1165+
if line[0] == '[' and line[-1] == ']':
1166+
key = line[1:-1]
1167+
elif key:
1168+
if key not in kb.commonTables:
1169+
kb.commonTables[key] = []
1170+
kb.commonTables[key].append(line.strip())
1171+
1172+
predictionSet = set()
1173+
wildIndexes = []
1174+
1175+
kb.dbms = 'MySQL'
1176+
1177+
if value[-1] != '.':
1178+
value += '.'
1179+
charIndex = 0
1180+
findIndex = value.find('.', charIndex)
1181+
while findIndex != -1:
1182+
wildIndexes.append(findIndex)
1183+
charIndex += 1
1184+
findIndex = value.find('.', charIndex)
1185+
if kb.dbms in kb.commonTables:
1186+
for item in kb.commonTables[kb.dbms]:
1187+
if re.search('\A%s' % value, item):
1188+
for index in wildIndexes:
1189+
char = item[index]
1190+
if char not in predictionSet:
1191+
predictionSet.add(char)
1192+
predictionTable = []
1193+
otherTable = []
1194+
for ordChar in originalTable:
1195+
if chr(ordChar) not in predictionSet:
1196+
otherTable.append(ordChar)
1197+
else:
1198+
predictionTable.append(ordChar)
1199+
predictionTable.sort()
1200+
return predictionTable, otherTable
1201+
else:
1202+
return None, originalTable

‎lib/core/option.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -882,7 +882,6 @@ def __setConfAttributes():
882882
debugMsg = "initializing the configuration"
883883
logger.debug(debugMsg)
884884

885-
conf.cpuThrottleDelay = 0.001
886885
conf.cj = None
887886
conf.dbmsConnector = None
888887
conf.dbmsHandler = None
@@ -929,6 +928,7 @@ def __setKnowledgeBaseAttributes():
929928
kb.absFilePaths = set()
930929
kb.bannerFp = advancedDict()
931930
kb.data = advancedDict()
931+
kb.commonTables = None
932932

933933
# Basic back-end DBMS fingerprint
934934
kb.dbms = None

‎lib/parse/cmdline.py‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
from optparse import OptionError
2828
from optparse import OptionGroup
2929
from optparse import OptionParser
30+
from optparse import SUPPRESS_HELP
3031

3132
from lib.core.data import logger
3233
from lib.core.settings import VERSION_STRING
@@ -415,10 +416,10 @@ def cmdLineParser():
415416
miscellaneous.add_option("-s", dest="sessionFile",
416417
help="Save and resume all data retrieved "
417418
"on a session file")
418-
419+
419420
miscellaneous.add_option("--flush-session", dest="flushSession", action="store_true",
420421
help="Flush session file for current target")
421-
422+
422423
miscellaneous.add_option("--eta", dest="eta", action="store_true",
423424
help="Display for each output the "
424425
"estimated time of arrival")
@@ -439,6 +440,16 @@ def cmdLineParser():
439440
help="Clean up the DBMS by sqlmap specific "
440441
"UDF and tables")
441442

443+
# Hidden and/or experimental options
444+
parser.add_option("--profile", dest="profile", action="store_true",
445+
help=SUPPRESS_HELP)
446+
447+
parser.add_option("--cpu-throttle", dest="cpuThrottle", type="int", default=10,
448+
help=SUPPRESS_HELP)
449+
450+
parser.add_option("--common-prediction", dest="useCommonPrediction", action="store_true",
451+
help=SUPPRESS_HELP)
452+
442453
parser.add_option_group(target)
443454
parser.add_option_group(request)
444455
parser.add_option_group(injection)

‎lib/request/connect.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,10 @@ def getPage(**kwargs):
260260

261261
logger.log(8, responseMsg)
262262

263-
time.sleep(conf.cpuThrottleDelay)
263+
if conf.cpuThrottle:
264+
minThrottleDelay, maxThrottleDelay = 0.0001, 0.1
265+
delay = minThrottleDelay + (maxThrottleDelay-minThrottleDelay) * conf.cpuThrottle
266+
time.sleep(delay)
264267

265268
return page, responseHeaders
266269

‎lib/techniques/blind/inference.py‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,14 @@ def downloadThread():
340340
while True:
341341
index += 1
342342
charStart = time.time()
343-
val = getChar(index, asciiTbl)
343+
344+
if conf.useCommonPrediction:
345+
commonTbl, otherTbl = getCommonPredictionTables(finalValue, asciiTbl)
346+
val = getChar(index, commonTbl) if commonTbl else None
347+
if not val:
348+
val = getChar(index, otherTbl)
349+
else:
350+
val = getChar(index, asciiTbl)
344351

345352
if val is None or ( lastChar > 0 and index > lastChar ):
346353
break

‎sqlmap.py‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939

4040
from lib.controller.controller import start
4141
from lib.core.common import banner
42+
from lib.core.common import profile
4243
from lib.core.common import setPaths
4344
from lib.core.common import weAreFrozen
4445
from lib.core.data import conf
@@ -75,8 +76,10 @@ def main():
7576

7677
try:
7778
init(cmdLineOptions)
78-
start()
79-
79+
if not conf.profile:
80+
start()
81+
else:
82+
profile()
8083
except exceptionsTuple, e:
8184
e = str(e)
8285
logger.error(e)

0 commit comments

Comments
 (0)