Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8e44aa6

Browse files
stamparmstamparm
committed
refactoring regarding injection place (more left)
1 parent 0482e02 commit 8e44aa6

6 files changed

Lines changed: 47 additions & 27 deletions

File tree

‎lib/core/agent.py‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
from lib.core.data import queries
2222
from lib.core.datatype import advancedDict
2323
from lib.core.exception import sqlmapNoneDataException
24+
from lib.core.place import PLACE
2425
from lib.core.settings import DBMS
2526
from lib.core.settings import PAYLOAD_DELIMITER
2627

@@ -69,38 +70,38 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, negativ
6970
falseValue = " AND %d=%d" % (randInt, randInt + 1)
7071

7172
# After identifing the injectable parameter
72-
if kb.injPlace == "User-Agent":
73+
if kb.injPlace == PLACE.UA:
7374
retValue = kb.injParameter.replace(kb.injParameter,
7475
self.addPayloadDelimiters("%s%s" % (negValue, kb.injParameter + falseValue + newValue)))
7576
elif kb.injParameter:
7677
paramString = conf.parameters[kb.injPlace]
7778
paramDict = conf.paramDict[kb.injPlace]
7879
value = paramDict[kb.injParameter]
7980

80-
if "POSTxml" in conf.paramDict and kb.injPlace == "POST":
81+
if "POSTxml" in conf.paramDict and kb.injPlace == PLACE.POST:
8182
root = ET.XML(paramString)
8283
iterator = root.getiterator(kb.injParameter)
8384

8485
for child in iterator:
8586
child.text = self.addPayloadDelimiters(negValue + value + falseValue + newValue)
8687

8788
retValue = ET.tostring(root)
88-
elif kb.injPlace == "URI":
89+
elif kb.injPlace == PLACE.URI:
8990
retValue = paramString.replace("*",
9091
self.addPayloadDelimiters("%s%s" % (negValue, falseValue + newValue)))
9192
else:
9293
retValue = paramString.replace("%s=%s" % (kb.injParameter, value),
9394
"%s=%s" % (kb.injParameter, self.addPayloadDelimiters(negValue + value + falseValue + newValue)))
9495

9596
# Before identifing the injectable parameter
96-
elif parameter == "User-Agent":
97+
elif parameter == PLACE.UA:
9798
retValue = value.replace(value, self.addPayloadDelimiters(newValue))
98-
elif place == "URI":
99+
elif place == PLACE.URI:
99100
retValue = value.replace("*", self.addPayloadDelimiters("%s" % newValue.replace(value, str())))
100101
else:
101102
paramString = conf.parameters[place]
102103

103-
if "POSTxml" in conf.paramDict and place == "POST":
104+
if "POSTxml" in conf.paramDict and place == PLACE.POST:
104105
root = ET.XML(paramString)
105106
iterator = root.getiterator(parameter)
106107

‎lib/core/common.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
from lib.core.exception import sqlmapMissingDependence
5050
from lib.core.exception import sqlmapSyntaxException
5151
from lib.core.optiondict import optDict
52+
from lib.core.place import PLACE
5253
from lib.core.settings import DBMS
5354
from lib.core.settings import DESCRIPTION
5455
from lib.core.settings import IS_WIN
@@ -135,7 +136,7 @@ def paramToDict(place, parameters=None):
135136
if place is not "POSTxml":
136137
parameters = parameters.replace(", ", ",")
137138

138-
if place == "Cookie":
139+
if place == PLACE.COOKIE:
139140
splitParams = parameters.split(";")
140141
else:
141142
splitParams = parameters.split("&")
@@ -797,7 +798,7 @@ def parseTargetUrl():
797798
conf.port = 80
798799

799800
if __urlSplit[3]:
800-
conf.parameters["GET"] = __urlSplit[3]
801+
conf.parameters[PLACE.GET] = __urlSplit[3]
801802

802803
conf.url = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, conf.path)
803804

‎lib/core/place.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
7+
See the file 'doc/COPYING' for copying permission
8+
"""
9+
10+
class PLACE:
11+
GET = "GET"
12+
POST = "POST"
13+
URI = "URI"
14+
COOKIE = "Cookie"
15+
UA = "User-Agent"

‎lib/core/session.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
from lib.core.data import conf
1616
from lib.core.data import kb
1717
from lib.core.data import logger
18+
from lib.core.place import PLACE
1819
from lib.core.settings import MSSQL_ALIASES
1920
from lib.core.settings import MYSQL_ALIASES
2021
from lib.core.settings import PGSQL_ALIASES
@@ -74,7 +75,7 @@ def setInjection():
7475
session file.
7576
"""
7677

77-
if kb.injPlace == "User-Agent":
78+
if kb.injPlace == PLACE.UA:
7879
kb.injParameter = conf.agent
7980

8081
condition = (

‎lib/request/connect.py‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
from lib.core.data import logger
2828
from lib.core.common import sanitizeAsciiString
2929
from lib.core.exception import sqlmapConnectionException
30+
from lib.core.place import PLACE
3031
from lib.request.basic import decodePage
3132
from lib.request.basic import forgeHeaders
3233
from lib.request.basic import parseResponse
@@ -106,16 +107,16 @@ def getPage(**kwargs):
106107
return page
107108

108109
else:
109-
if conf.parameters.has_key("GET") and not get:
110-
get = conf.parameters["GET"]
110+
if conf.parameters.has_key(PLACE.GET) and not get:
111+
get = conf.parameters[PLACE.GET]
111112

112113
if get:
113114
url = "%s?%s" % (url, get)
114115
requestMsg += "?%s" % get
115116

116117
if conf.method == "POST":
117-
if conf.parameters.has_key("POST") and not post:
118-
post = conf.parameters["POST"]
118+
if conf.parameters.has_key(PLACE.POST) and not post:
119+
post = conf.parameters[PLACE.POST]
119120

120121
requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str
121122

@@ -303,8 +304,8 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
303304
page = None
304305
pageLength = None
305306
uri = None
306-
raise404 = place != "URI" if raise404 is None else raise404
307-
toUrlencode = { "GET": True, "POST": True, "Cookie": conf.cookieUrlencode, "User-Agent": True, "URI": False }
307+
raise404 = place != PLACE.URI if raise404 is None else raise404
308+
toUrlencode = { PLACE.GET: True, PLACE.POST: True, PLACE.COOKIE: conf.cookieUrlencode, PLACE.UA: True, PLACE.URI: False }
308309

309310
if not place:
310311
place = kb.injPlace
@@ -320,7 +321,7 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
320321

321322
logger.log(9, payload)
322323

323-
if place == "Cookie" and conf.cookieUrlencode:
324+
if place == PLACE.COOKIE and conf.cookieUrlencode:
324325
value = agent.removePayloadDelimiters(value, False)
325326
value = urlEncodeCookieValues(value)
326327
elif place:
@@ -329,20 +330,20 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
329330
if conf.checkPayload:
330331
checkPayload(value)
331332

332-
if "GET" in conf.parameters:
333-
get = conf.parameters["GET"] if place != "GET" or not value else value
333+
if PLACE.GET in conf.parameters:
334+
get = conf.parameters[PLACE.GET] if place != PLACE.GET or not value else value
334335

335-
if "POST" in conf.parameters:
336-
post = conf.parameters["POST"] if place != "POST" or not value else value
336+
if PLACE.POST in conf.parameters:
337+
post = conf.parameters[PLACE.POST] if place != PLACE.POST or not value else value
337338

338-
if "Cookie" in conf.parameters:
339-
cookie = conf.parameters["Cookie"] if place != "Cookie" or not value else value
339+
if PLACE.COOKIE in conf.parameters:
340+
cookie = conf.parameters[PLACE.COOKIE] if place != PLACE.COOKIE or not value else value
340341

341-
if "User-Agent" in conf.parameters:
342-
ua = conf.parameters["User-Agent"] if place != "User-Agent" or not value else value
342+
if PLACE.UA in conf.parameters:
343+
ua = conf.parameters[PLACE.UA] if place != PLACE.UA or not value else value
343344

344-
if "URI" in conf.parameters:
345-
uri = conf.url if place != "URI" or not value else value
345+
if PLACE.URI in conf.parameters:
346+
uri = conf.url if place != PLACE.URI or not value else value
346347
else:
347348
uri = conf.url
348349

‎plugins/dbms/mysql/filesystem.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
from lib.core.data import kb
1313
from lib.core.data import logger
1414
from lib.core.exception import sqlmapNoneDataException
15+
from lib.core.place import PLACE
1516
from lib.request import inject
1617
from lib.techniques.inband.union.test import unionTest
1718
from lib.techniques.inband.union.use import unionUse
@@ -78,7 +79,7 @@ def unionWriteFile(self, wFile, dFile, fileType, confirm=True):
7879
fcEncodedStr = fcEncodedList[0]
7980
fcEncodedStrLen = len(fcEncodedStr)
8081

81-
if kb.injPlace == "GET" and fcEncodedStrLen > 8000:
82+
if kb.injPlace == PLACE.GET and fcEncodedStrLen > 8000:
8283
warnMsg = "the injection is on a GET parameter and the file "
8384
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
8485
warnMsg += "bytes, this might cause errors in the file "

0 commit comments

Comments
 (0)