Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6df2d98

Browse files
bdamelebdamele
committed
Minor bug fix in common.py goGoodSamaritan().
Minor code cleanup and adjustments.
1 parent bb6e3c6 commit 6df2d98

3 files changed

Lines changed: 34 additions & 29 deletions

File tree

‎lib/core/common.py‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,7 @@
5454
from lib.core.data import paths
5555
from lib.core.data import queries
5656
from lib.core.data import temp
57-
from lib.core.convert import md5hash
58-
from lib.core.convert import sha1hash
5957
from lib.core.convert import urlencode
60-
from lib.core.convert import utf8decode
6158
from lib.core.exception import sqlmapFilePathException
6259
from lib.core.exception import sqlmapNoneDataException
6360
from lib.core.exception import sqlmapMissingDependence
@@ -1220,15 +1217,14 @@ def initCommonOutputs():
12201217
line = line.strip()
12211218

12221219
if len(line) > 1:
1223-
if line[0] == '[' and line[-1] == ']':
1220+
if line.startswith('[') and line.endswith(']'):
12241221
key = line[1:-1]
12251222
elif key:
12261223
if key not in kb.commonOutputs:
12271224
kb.commonOutputs[key] = []
12281225

1229-
item = line.strip()
1230-
if item not in kb.commonOutputs[key]:
1231-
kb.commonOutputs[key].append(item)
1226+
if line not in kb.commonOutputs[key]:
1227+
kb.commonOutputs[key].append(line)
12321228

12331229
cfile.close()
12341230

@@ -1257,15 +1253,19 @@ def goGoodSamaritan(part, prevValue, originalCharset):
12571253
wildIndexes = []
12581254
singleValue = None
12591255

1260-
# If the header we are looking for has common outputs defined
1256+
# If the header (e.g. Databases) we are looking for has common
1257+
# outputs defined
12611258
if part in kb.commonOutputs:
1259+
# For each common output
12621260
for item in kb.commonOutputs[part]:
12631261
# Check if the common output (item) starts with prevValue
1262+
# where prevValue is the enumerated character(s) so far
12641263
if item.startswith(prevValue):
12651264
singleValue = item
12661265

12671266
if len(item) > len(prevValue):
12681267
char = item[len(prevValue)]
1268+
12691269
if char not in predictionSet:
12701270
predictionSet.add(char)
12711271

@@ -1285,7 +1285,7 @@ def goGoodSamaritan(part, prevValue, originalCharset):
12851285
if len(commonCharset) > 1:
12861286
return None, commonCharset, otherCharset
12871287
else:
1288-
return singleValue, None, originalCharset
1288+
return singleValue, commonCharset, originalCharset
12891289
else:
12901290
return None, None, originalCharset
12911291

@@ -1294,6 +1294,7 @@ def getCompiledRegex(regex, *args):
12941294
Returns compiled regular expression and stores it in cache for further
12951295
usage
12961296
"""
1297+
12971298
if (regex, args) in kb.cache.regex:
12981299
return kb.cache.regex[(regex, args)]
12991300
else:

‎lib/techniques/blind/inference.py‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ def getChar(idx, charTbl=asciiTbl, continuousOrder=True):
157157
forgedPayload = safeStringFormat(payload.replace('%3E', '%3D'), (expressionUnescaped, idx, charTbl[0]))
158158
queriesCount[0] += 1
159159
result = Request.queryPage(urlencode(forgedPayload))
160+
160161
if result:
161162
return chr(charTbl[0]) if charTbl[0] < 128 else unichr(charTbl[0])
162163
else:
@@ -171,10 +172,7 @@ def getChar(idx, charTbl=asciiTbl, continuousOrder=True):
171172

172173
if kb.dbms == "SQLite":
173174
posValueOld = posValue
174-
if posValue < 128:
175-
posValue = chr(posValue)
176-
else:
177-
posValue = unichr(posValue)
175+
posValue = chr(posValue) if posValue < 128 else unichr(posValue)
178176

179177
if not conf.useBetween or kb.dbms == "SQLite":
180178
forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx, posValue))
@@ -189,12 +187,14 @@ def getChar(idx, charTbl=asciiTbl, continuousOrder=True):
189187

190188
if result:
191189
minValue = posValue
190+
192191
if type(charTbl) != xrange:
193192
charTbl = charTbl[position:]
194193
else:
195194
charTbl = xrange(charTbl[position], charTbl[-1] + 1)
196195
else:
197196
maxValue = posValue
197+
198198
if type(charTbl) != xrange:
199199
charTbl = charTbl[:position]
200200
else:
@@ -214,12 +214,15 @@ def getChar(idx, charTbl=asciiTbl, continuousOrder=True):
214214
else:
215215
if minValue == maxChar or maxValue == minChar:
216216
return None
217+
217218
for retVal in (originalTbl[originalTbl.index(minValue)], originalTbl[originalTbl.index(minValue) + 1]):
218219
forgedPayload = safeStringFormat(payload.replace('%3E', '%3D'), (expressionUnescaped, idx, retVal))
219220
queriesCount[0] += 1
220221
result = Request.queryPage(urlencode(forgedPayload))
222+
221223
if result:
222224
return chr(retVal) if retVal < 128 else unichr(retVal)
225+
223226
return None
224227

225228
def etaProgressUpdate(charTime, index):
@@ -390,9 +393,8 @@ def downloadThread():
390393
val = None
391394
singleValue, commonCharset, otherCharset = goGoodSamaritan(kb.partRun, finalValue, asciiTbl)
392395

393-
# If there is no singleValue (single match from
394-
# txt/common-outputs.txt) use the returned common
395-
# charset only to retrieve the query output
396+
# If there is one single output in common-outputs, check
397+
# it via equal against the query output
396398
if singleValue is not None:
397399
# One-shot query containing equals singleValue
398400
query = agent.prefixQuery(" %s" % safeStringFormat('AND (%s) = %s', (expressionUnescaped, unescaper.unescape('\'%s\'' % singleValue))))
@@ -412,7 +414,11 @@ def downloadThread():
412414
finalValue = singleValue
413415

414416
break
415-
elif commonCharset:
417+
418+
# Otherwise if there is no singleValue (single match from
419+
# txt/common-outputs.txt) use the returned common
420+
# charset only to retrieve the query output
421+
if commonCharset:
416422
val = getChar(index, commonCharset, False)
417423

418424
# If we had no luck with singleValue and common charset,

‎txt/common-outputs.txt‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,19 @@
11
[Databases]
22

3-
#MySQL
3+
# MySQL
44
information_schema
55
mysql
6-
public
7-
master
86
phpmyadmin
97

10-
#Microsoft SQL Server
8+
# Microsoft SQL Server
119
tempdb
1210
model
1311
master
1412
msdb
1513

16-
[Tables]
1714

18-
#MySQL
15+
[Tables]
16+
# MySQL
1917
CHARACTER_SETS
2018
COLLATION_CHARACTER_SET_APPLICABILITY
2119
COLLATIONS
@@ -68,7 +66,7 @@ time_zone_transition
6866
time_zone_transition_type
6967
user
7068

71-
#PHPMyAdmin
69+
# PHPMyAdmin
7270
pma_bookmark
7371
pma_column_info
7472
pma_designer_coords
@@ -78,14 +76,14 @@ pma_relation
7876
pma_table_coords
7977
pma_table_info
8078

81-
#Oracle
79+
# Oracle
8280
BONUS
8381
DEPT
8482
EMP
8583
SALGRADE
8684
USERS
8785

88-
#Microsoft SQL Server
86+
# Microsoft SQL Server
8987
all_columns
9088
all_objects
9189
all_parameters
@@ -472,13 +470,13 @@ systaskids
472470

473471
[Passwords]
474472

475-
#MySQL
476-
*00E247AC5F9AF26AE0194B41E1E769DEE1429A29 #testpass
473+
# MySQL
474+
*00E247AC5F9AF26AE0194B41E1E769DEE1429A29 # testpass
477475

478476

479477
[Users]
480478

481-
#Oracle
479+
# Oracle
482480
SCOTT
483481
MGMT_VIEW
484482
MDDATA

0 commit comments

Comments
 (0)