Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a0b9e0f

Browse files
bdamelebdamele
committed
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2 parents 195d174 + c06f94e commit a0b9e0f

7 files changed

Lines changed: 97 additions & 13 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
from lib.core.common import findDynamicContent
2323
from lib.core.common import Format
2424
from lib.core.common import getLastRequestHTTPError
25+
from lib.core.common import getPublicTypeMembers
2526
from lib.core.common import getSortedInjectionTests
2627
from lib.core.common import getUnicode
2728
from lib.core.common import intersect
@@ -42,6 +43,8 @@
4243
from lib.core.data import logger
4344
from lib.core.datatype import AttribDict
4445
from lib.core.datatype import InjectionDict
46+
from lib.core.dicts import FROM_DUMMY_TABLE
47+
from lib.core.enums import DBMS
4548
from lib.core.enums import HEURISTIC_TEST
4649
from lib.core.enums import HTTPHEADER
4750
from lib.core.enums import HTTPMETHOD
@@ -55,7 +58,7 @@
5558
from lib.core.settings import FORMAT_EXCEPTION_STRINGS
5659
from lib.core.settings import HEURISTIC_CHECK_ALPHABET
5760
from lib.core.settings import SUHOSIN_MAX_VALUE_LENGTH
58-
from lib.core.settings import UNKNOWN_DBMS_VERSION
61+
from lib.core.settings import UNKNOWN_DBMS
5962
from lib.core.settings import LOWER_RATIO_BOUND
6063
from lib.core.settings import UPPER_RATIO_BOUND
6164
from lib.core.settings import IDS_WAF_CHECK_PAYLOAD
@@ -441,11 +444,17 @@ def genCmpPayload():
441444
configUnion(test.request.char, test.request.columns)
442445

443446
if not Backend.getIdentifiedDbms():
444-
warnMsg = "using unescaped version of the test "
445-
warnMsg += "because of zero knowledge of the "
446-
warnMsg += "back-end DBMS. You can try to "
447-
warnMsg += "explicitly set it using option '--dbms'"
448-
singleTimeWarnMessage(warnMsg)
447+
if not kb.heuristicDbms:
448+
kb.heuristicDbms = heuristicCheckDbms(injection) or UNKNOWN_DBMS
449+
450+
if kb.heuristicDbms == UNKNOWN_DBMS:
451+
warnMsg = "using unescaped version of the test "
452+
warnMsg += "because of zero knowledge of the "
453+
warnMsg += "back-end DBMS. You can try to "
454+
warnMsg += "explicitly set it using option '--dbms'"
455+
singleTimeWarnMessage(warnMsg)
456+
else:
457+
Backend.forceDbms(kb.heuristicDbms)
449458

450459
if unionExtended:
451460
infoMsg = "automatically extending ranges "
@@ -582,6 +591,32 @@ def genCmpPayload():
582591

583592
return injection
584593

594+
def heuristicCheckDbms(injection):
595+
retVal = None
596+
597+
if not Backend.getIdentifiedDbms() and len(injection.data) == 1 and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data:
598+
pushValue(kb.injection)
599+
kb.injection = injection
600+
randStr1, randStr2 = randomStr(), randomStr()
601+
602+
for dbms in getPublicTypeMembers(DBMS, True):
603+
Backend.forceDbms(dbms)
604+
605+
if checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr1)):
606+
if not checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr2)):
607+
retVal = dbms
608+
break
609+
610+
Backend.flushForcedDbms()
611+
kb.injection = popValue()
612+
613+
if retVal:
614+
infoMsg = "heuristic test showed that the back-end DBMS "
615+
infoMsg += "could be '%s' " % retVal
616+
logger.info(infoMsg)
617+
618+
return retVal
619+
585620
def checkFalsePositives(injection):
586621
"""
587622
Checks for false positives (only in single special cases)
@@ -723,7 +758,7 @@ def _(page):
723758
kb.ignoreCasted = readInput(message, default='Y' if conf.multipleTargets else 'N').upper() != 'N'
724759

725760
elif result:
726-
infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION)
761+
infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS)
727762
logger.info(infoMsg)
728763

729764
else:

‎lib/core/common.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@
122122
from lib.core.settings import TEXT_TAG_REGEX
123123
from lib.core.settings import TIME_STDEV_COEFF
124124
from lib.core.settings import UNICODE_ENCODING
125+
from lib.core.settings import UNKNOWN_DBMS
125126
from lib.core.settings import UNKNOWN_DBMS_VERSION
126127
from lib.core.settings import URI_QUESTION_MARKER
127128
from lib.core.settings import URLENCODE_CHAR_LIMIT

‎lib/core/option.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1526,6 +1526,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
15261526
kb.fileReadMode = False
15271527
kb.forcedDbms = None
15281528
kb.headersFp = {}
1529+
kb.heuristicDbms = None
15291530
kb.heuristicTest = None
15301531
kb.hintValue = None
15311532
kb.htmlFp = []

‎lib/core/settings.py‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@
3636
# Markers for special cases when parameter values contain html encoded characters
3737
PARAMETER_AMP_MARKER = "__AMP__"
3838
PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__"
39-
PARTIAL_VALUE_MARKER = "__PARTIAL__"
39+
PARTIAL_VALUE_MARKER = "__PARTIAL_VALUE__"
40+
PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__"
4041
URI_QUESTION_MARKER = "__QUESTION_MARK__"
4142
ASTERISK_MARKER = "__ASTERISK_MARK__"
4243

@@ -111,6 +112,9 @@
111112
# Character used for operation "not-equals" in inference
112113
INFERENCE_NOT_EQUALS_CHAR = "!="
113114

115+
# String used for representation of unknown dbms
116+
UNKNOWN_DBMS = "Unknown"
117+
114118
# String used for representation of unknown dbms version
115119
UNKNOWN_DBMS_VERSION = "Unknown"
116120

@@ -459,7 +463,7 @@
459463
CHECK_ZERO_COLUMNS_THRESHOLD = 10
460464

461465
# Boldify all logger messages containing these "patterns"
462-
BOLD_PATTERNS = ("' injectable", "might be injectable", "' is vulnerable", "is not injectable", "test failed", "test passed", "live test final result")
466+
BOLD_PATTERNS = ("' injectable", "might be injectable", "' is vulnerable", "is not injectable", "test failed", "test passed", "live test final result", "heuristic test showed")
463467

464468
# Generic www root directory names
465469
GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "wwwroot", "www")

‎lib/request/connect.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -687,7 +687,7 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent
687687
else:
688688
uri = conf.url
689689

690-
if place == PLACE.CUSTOM_HEADER:
690+
if value and place == PLACE.CUSTOM_HEADER:
691691
if not auxHeaders:
692692
auxHeaders = {}
693693
auxHeaders[value.split(',')[0]] = value.split(',', 1)[1]

‎lib/techniques/blind/inference.py‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
from lib.core.settings import INFERENCE_EQUALS_CHAR
4343
from lib.core.settings import INFERENCE_NOT_EQUALS_CHAR
4444
from lib.core.settings import MAX_TIME_REVALIDATION_STEPS
45+
from lib.core.settings import PARTIAL_HEX_VALUE_MARKER
4546
from lib.core.settings import PARTIAL_VALUE_MARKER
4647
from lib.core.settings import VALID_TIME_CHARS_RUN_THRESHOLD
4748
from lib.core.threads import getCurrentThreadData
@@ -65,10 +66,17 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
6566
retVal = hashDBRetrieve(expression, checkConf=True)
6667

6768
if retVal:
68-
if PARTIAL_VALUE_MARKER in retVal:
69+
if PARTIAL_HEX_VALUE_MARKER in retVal:
70+
retVal = retVal.replace(PARTIAL_HEX_VALUE_MARKER, "")
71+
72+
if retVal and conf.hexConvert:
73+
partialValue = retVal
74+
infoMsg = "resuming partial value: %s" % safecharencode(partialValue)
75+
logger.info(infoMsg)
76+
elif PARTIAL_VALUE_MARKER in retVal:
6977
retVal = retVal.replace(PARTIAL_VALUE_MARKER, "")
7078

71-
if retVal:
79+
if retVal and not conf.hexConvert:
7280
partialValue = retVal
7381
infoMsg = "resuming partial value: %s" % safecharencode(partialValue)
7482
logger.info(infoMsg)
@@ -545,7 +553,7 @@ def blindThread():
545553
finalValue = decodeHexValue(finalValue) if conf.hexConvert else finalValue
546554
hashDBWrite(expression, finalValue)
547555
elif partialValue:
548-
hashDBWrite(expression, "%s%s" % (PARTIAL_VALUE_MARKER, partialValue))
556+
hashDBWrite(expression, "%s%s" % (PARTIAL_VALUE_MARKER if not conf.hexConvert else PARTIAL_HEX_VALUE_MARKER, partialValue))
549557

550558
if conf.hexConvert and not abortedFlag:
551559
infoMsg = "\r[%s] [INFO] retrieved: %s %s\n" % (time.strftime("%X"), filterControlChars(finalValue), " " * retrievedLength)

‎xml/livetests.xml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3354,6 +3354,41 @@
33543354
<item value="r'performed 112 queries'" console_output="True"/>
33553355
</parse>
33563356
</case>
3357+
<case name="Custom GET parameter injection mark">
3358+
<switches>
3359+
<verbose value="2"/>
3360+
<url value="http://debiandev/sqlmap/mysql/get_int.php?id=1*"/>
3361+
<tech value="B"/>
3362+
<getBanner value="True"/>
3363+
</switches>
3364+
<parse>
3365+
<item value="banner: '5.1.66-0+squeeze1'"/>
3366+
</parse>
3367+
</case>
3368+
<case name="Custom POST data injection mark">
3369+
<switches>
3370+
<verbose value="2"/>
3371+
<url value="http://debiandev/sqlmap/mysql/post_int.php"/>
3372+
<data value="id=1*"/>
3373+
<tech value="E"/>
3374+
<getBanner value="True"/>
3375+
</switches>
3376+
<parse>
3377+
<item value="banner: '5.1.66-0+squeeze1'"/>
3378+
</parse>
3379+
</case>
3380+
<case name="Custom HTTP header (UA) injection mark">
3381+
<switches>
3382+
<verbose value="2"/>
3383+
<url value="http://debiandev/sqlmap/mysql/header_str.php"/>
3384+
<headers value="User-Agent: 1*"/>
3385+
<tech value="U"/>
3386+
<getBanner value="True"/>
3387+
</switches>
3388+
<parse>
3389+
<item value="banner: '5.1.66-0+squeeze1'"/>
3390+
</parse>
3391+
</case>
33573392
<case name="Estimated time of arrival">
33583393
<switches>
33593394
<verbose value="2"/>

0 commit comments

Comments
 (0)