Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8576817

Browse files
bdamelebdamele
committed
Added support for SOAP requests: fixed, extended and tested a user's patch - closes #196.
1 parent ea45d75 commit 8576817

5 files changed

Lines changed: 65 additions & 21 deletions

File tree

‎doc/THANKS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,9 @@ Jason Swan <[email protected]>
294294
for reporting a bug when enumerating columns on Microsoft SQL Server
295295
for suggesting a couple of improvements
296296

297+
Chilik Tamir <[email protected]>
298+
for providing a patch for initial support SOAP requests
299+
297300
Alessandro Tanasi <[email protected]>
298301
for extensively beta-testing sqlmap
299302
for suggesting many features and reporting some bugs

‎lib/core/agent.py‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424

2525
import re
2626

27+
from xml.etree import ElementTree as ET
28+
2729
from lib.core.common import randomInt
2830
from lib.core.common import randomStr
2931
from lib.core.convert import urlencode
@@ -33,7 +35,6 @@
3335
from lib.core.data import temp
3436
from lib.core.exception import sqlmapNoneDataException
3537

36-
3738
class Agent:
3839
"""
3940
This class defines the SQL agent methods.
@@ -82,16 +83,36 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, negativ
8283
paramString = conf.parameters[kb.injPlace]
8384
paramDict = conf.paramDict[kb.injPlace]
8485
value = paramDict[kb.injParameter]
85-
retValue = paramString.replace("%s=%s" % (kb.injParameter, value),
86-
"%s=%s%s" % (kb.injParameter, negValue, value + falseValue + newValue))
86+
87+
if "POSTxml" in conf.paramDict and kb.injPlace == "POST":
88+
root = ET.XML(paramString)
89+
iterator = root.getiterator(kb.injParameter)
90+
91+
for child in iterator:
92+
child.text = "%s%s" % (negValue, value + falseValue + newValue)
93+
94+
retValue = ET.tostring(root)
95+
else:
96+
retValue = paramString.replace("%s=%s" % (kb.injParameter, value),
97+
"%s=%s%s" % (kb.injParameter, negValue, value + falseValue + newValue))
8798

8899
# Before identifing the injectable parameter
89100
elif parameter == "User-Agent":
90101
retValue = value.replace(value, newValue)
91102
else:
92103
paramString = conf.parameters[place]
93-
retValue = paramString.replace("%s=%s" % (parameter, value),
94-
"%s=%s" % (parameter, newValue))
104+
105+
if "POSTxml" in conf.paramDict and place == "POST":
106+
root = ET.XML(paramString)
107+
iterator = root.getiterator(parameter)
108+
109+
for child in iterator:
110+
child.text = newValue
111+
112+
retValue = ET.tostring(root)
113+
else:
114+
retValue = paramString.replace("%s=%s" % (parameter, value),
115+
"%s=%s" % (parameter, newValue))
95116

96117
return retValue
97118

‎lib/core/common.py‎

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
from subprocess import Popen as execute
4545
from tempfile import NamedTemporaryFile
4646
from tempfile import mkstemp
47+
from xml.etree import ElementTree as ET
4748
from xml.sax import parse
4849

4950
from extra.cloak.cloak import decloak
@@ -96,25 +97,36 @@ def paramToDict(place, parameters=None):
9697
if conf.parameters.has_key(place) and not parameters:
9798
parameters = conf.parameters[place]
9899

99-
parameters = parameters.replace(", ", ",")
100+
if place is not "POSTxml":
101+
parameters = parameters.replace(", ", ",")
100102

101-
if place == "Cookie":
102-
splitParams = parameters.split(";")
103-
else:
104-
splitParams = parameters.split("&")
103+
if place == "Cookie":
104+
splitParams = parameters.split(";")
105+
else:
106+
splitParams = parameters.split("&")
107+
108+
for element in splitParams:
109+
elem = element.split("=")
105110

106-
for element in splitParams:
107-
elem = element.split("=")
111+
if len(elem) == 2:
112+
parameter = elem[0].replace(" ", "")
108113

109-
if len(elem) == 2:
110-
parameter = elem[0].replace(" ", "")
114+
condition = not conf.testParameter
115+
condition |= parameter in conf.testParameter
116+
117+
if condition:
118+
testableParameters[parameter] = elem[1]
119+
else:
120+
root = ET.XML(parameters)
121+
iterator = root.getiterator()
111122

112-
condition = not conf.testParameter
113-
condition |= parameter in conf.testParameter
123+
for child in iterator:
124+
parameter = child.tag
125+
condition = not conf.testParameter
126+
condition |= parameter.split("}")[1] in conf.testParameter
114127

115128
if condition:
116-
value = elem[1]
117-
testableParameters[parameter] = value
129+
testableParameters[parameter] = child.text
118130

119131
if conf.testParameter and not testableParameters:
120132
paramStr = ", ".join(test for test in conf.testParameter)

‎lib/core/convert.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ def urldecode(string):
8686
return result
8787

8888
def urlencode(string, safe=":/?%&=", convall=False):
89-
if conf.direct:
89+
if conf.direct or "POSTxml" in conf.paramDict:
9090
return string
9191

9292
result = None
@@ -95,7 +95,7 @@ def urlencode(string, safe=":/?%&=", convall=False):
9595
return result
9696

9797
if convall:
98-
result = urllib.quote(utf8encode(string)) #Reference: http://old.nabble.com/Re:-Problem:-neither-urllib2.quote-nor-urllib.quote-encode-the--unicode-strings-arguments-p19823144.html
98+
result = urllib.quote(utf8encode(string)) # Reference: http://old.nabble.com/Re:-Problem:-neither-urllib2.quote-nor-urllib.quote-encode-the--unicode-strings-arguments-p19823144.html
9999
else:
100100
result = urllib.quote(utf8encode(string), safe)
101101

‎lib/core/target.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
import codecs
2626
import os
27+
import re
2728
import time
2829

2930
from lib.core.common import dataToSessionFile
@@ -66,8 +67,15 @@ def __setRequestParams():
6667
raise sqlmapSyntaxException, errMsg
6768

6869
if conf.data:
70+
conf.data = conf.data.replace("\n", " ")
6971
conf.parameters["POST"] = conf.data
70-
__paramDict = paramToDict("POST", conf.data)
72+
73+
# Check if POST data is in xml syntax
74+
if re.match("[\n]*<(\?xml |soap\:|ns).*>", conf.data):
75+
conf.paramDict["POSTxml"] = True
76+
__paramDict = paramToDict("POSTxml", conf.data)
77+
else:
78+
__paramDict = paramToDict("POST", conf.data)
7179

7280
if __paramDict:
7381
conf.paramDict["POST"] = __paramDict

0 commit comments

Comments
 (0)