Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a7fa8d4

Browse files
stamparmstamparm
committed
update regarding brute force retrieval of table names and table column names
1 parent 45f2d8f commit a7fa8d4

4 files changed

Lines changed: 98 additions & 59 deletions

File tree

‎lib/controller/action.py‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
from lib.core.exception import sqlmapUnsupportedDBMSException
1717
from lib.core.settings import SUPPORTED_DBMS
1818
from lib.techniques.blind.timebased import timeTest
19+
from lib.techniques.brute.use import columnExists
1920
from lib.techniques.brute.use import tableExists
2021
from lib.techniques.error.test import errorTest
2122
from lib.techniques.inband.union.test import unionTest
@@ -105,15 +106,15 @@ def action():
105106
if conf.getTables:
106107
conf.dumper.dbTables(conf.dbmsHandler.getTables())
107108

108-
if conf.cExists:
109+
if conf.bruteTables:
109110
conf.dumper.dbTables(tableExists(paths.COMMON_TABLES))
110111

111-
if conf.tableFile:
112-
conf.dumper.dbTables(tableExists(conf.tableFile))
113-
114112
if conf.getColumns:
115113
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns())
116114

115+
if conf.bruteColumns:
116+
conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS))
117+
117118
if conf.dumpTable:
118119
conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
119120

‎lib/core/dump.py‎

Lines changed: 74 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ def dbTables(self, dbTables):
148148

149149
dbTables.sort(key=lambda x: x.lower())
150150

151-
self.__write("Brute-forced tables:")
151+
self.__write("Brute-forced table names:")
152152

153153
if len(dbTables) == 1:
154154
self.__write("[1 table]")
@@ -199,69 +199,96 @@ def dbTables(self, dbTables):
199199
self.string("tables", dbTables)
200200

201201
def dbTableColumns(self, tableColumns):
202-
for db, tables in tableColumns.items():
203-
if not db:
204-
db = "All"
202+
if isinstance(tableColumns, list) and len(tableColumns) > 0:
203+
maxlength = 0
205204

206-
for table, columns in tables.items():
207-
maxlength1 = 0
208-
maxlength2 = 0
205+
for table in tableColumns:
206+
maxlength = max(maxlength, len(table))
209207

210-
colList = columns.keys()
211-
colList.sort(key=lambda x: x.lower())
208+
lines = "-" * (int(maxlength) + 2)
212209

213-
for column in colList:
214-
colType = columns[column]
215-
maxlength1 = max(maxlength1, len(column))
210+
tableColumns.sort(key=lambda x: x.lower())
216211

217-
if colType is not None:
218-
maxlength2 = max(maxlength2, len(colType))
212+
self.__write("Brute-forced column names for table '%s':" % conf.tbl)
219213

220-
maxlength1 = max(maxlength1, len("COLUMN"))
221-
lines1 = "-" * (int(maxlength1) + 2)
214+
if len(tableColumns) == 1:
215+
self.__write("[1 column]")
216+
else:
217+
self.__write("[%d columns]" % len(tableColumns))
222218

223-
if colType is not None:
224-
maxlength2 = max(maxlength2, len("TYPE"))
225-
lines2 = "-" * (int(maxlength2) + 2)
219+
self.__write("+%s+" % lines)
226220

227-
self.__write("Database: %s\nTable: %s" % (db, table))
221+
for table in tableColumns:
222+
blank = " " * (maxlength - len(table))
223+
self.__write("| %s%s |" % (table, blank))
228224

229-
if len(columns) == 1:
230-
self.__write("[1 column]")
231-
else:
232-
self.__write("[%d columns]" % len(columns))
225+
self.__write("+%s+\n" % lines)
233226

234-
if colType is not None:
235-
self.__write("+%s+%s+" % (lines1, lines2))
236-
else:
237-
self.__write("+%s+" % lines1)
227+
elif isinstance(tableColumns, dict) and len(tableColumns) > 0:
238228

239-
blank1 = " " * (maxlength1 - len("COLUMN"))
229+
for db, tables in tableColumns.items():
230+
if not db:
231+
db = "All"
240232

241-
if colType is not None:
242-
blank2 = " " * (maxlength2 - len("TYPE"))
233+
for table, columns in tables.items():
234+
maxlength1 = 0
235+
maxlength2 = 0
243236

244-
if colType is not None:
245-
self.__write("| Column%s | Type%s |" % (blank1, blank2))
246-
self.__write("+%s+%s+" % (lines1, lines2))
247-
else:
248-
self.__write("| Column%s |" % blank1)
249-
self.__write("+%s+" % lines1)
237+
colList = columns.keys()
238+
colList.sort(key=lambda x: x.lower())
239+
240+
for column in colList:
241+
colType = columns[column]
242+
maxlength1 = max(maxlength1, len(column))
243+
244+
if colType is not None:
245+
maxlength2 = max(maxlength2, len(colType))
246+
247+
maxlength1 = max(maxlength1, len("COLUMN"))
248+
lines1 = "-" * (int(maxlength1) + 2)
250249

251-
for column in colList:
252-
colType = columns[column]
253-
blank1 = " " * (maxlength1 - len(column))
250+
if colType is not None:
251+
maxlength2 = max(maxlength2, len("TYPE"))
252+
lines2 = "-" * (int(maxlength2) + 2)
253+
254+
self.__write("Database: %s\nTable: %s" % (db, table))
255+
256+
if len(columns) == 1:
257+
self.__write("[1 column]")
258+
else:
259+
self.__write("[%d columns]" % len(columns))
254260

255261
if colType is not None:
256-
blank2 = " " * (maxlength2 - len(colType))
257-
self.__write("| %s%s | %s%s |" % (column, blank1, colType, blank2))
262+
self.__write("+%s+%s+" % (lines1, lines2))
258263
else:
259-
self.__write("| %s%s |" % (column, blank1))
264+
self.__write("+%s+" % lines1)
260265

261-
if colType is not None:
262-
self.__write("+%s+%s+\n" % (lines1, lines2))
263-
else:
264-
self.__write("+%s+\n" % lines1)
266+
blank1 = " " * (maxlength1 - len("COLUMN"))
267+
268+
if colType is not None:
269+
blank2 = " " * (maxlength2 - len("TYPE"))
270+
271+
if colType is not None:
272+
self.__write("| Column%s | Type%s |" % (blank1, blank2))
273+
self.__write("+%s+%s+" % (lines1, lines2))
274+
else:
275+
self.__write("| Column%s |" % blank1)
276+
self.__write("+%s+" % lines1)
277+
278+
for column in colList:
279+
colType = columns[column]
280+
blank1 = " " * (maxlength1 - len(column))
281+
282+
if colType is not None:
283+
blank2 = " " * (maxlength2 - len(colType))
284+
self.__write("| %s%s | %s%s |" % (column, blank1, colType, blank2))
285+
else:
286+
self.__write("| %s%s |" % (column, blank1))
287+
288+
if colType is not None:
289+
self.__write("+%s+%s+\n" % (lines1, lines2))
290+
else:
291+
self.__write("+%s+\n" % lines1)
265292

266293
def dbTableValues(self, tableValues):
267294
replication = None

‎lib/parse/cmdline.py‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -341,11 +341,16 @@ def cmdLineParser():
341341
action="store_true", default=False,
342342
help="Prompt for an interactive SQL shell")
343343

344-
enumeration.add_option("--common-exists", dest="cExists", action="store_true",
344+
# User-defined function options
345+
brute = OptionGroup(parser, "Brute force", "These "
346+
"options can be used to run brute force "
347+
"checks.")
348+
349+
brute.add_option("--brute-tables", dest="bruteTables", action="store_true",
345350
default=False, help="Check existence of common tables")
346351

347-
enumeration.add_option("--exists", dest="tableFile",
348-
help="Check existence of user specified tables")
352+
brute.add_option("--brute-columns", dest="bruteColumns", action="store_true",
353+
default=False, help="Check existence of common columns")
349354

350355
# User-defined function options
351356
udf = OptionGroup(parser, "User-defined function injection", "These "
@@ -526,6 +531,7 @@ def cmdLineParser():
526531
parser.add_option_group(techniques)
527532
parser.add_option_group(fingerprint)
528533
parser.add_option_group(enumeration)
534+
parser.add_option_group(brute)
529535
parser.add_option_group(udf)
530536
parser.add_option_group(filesystem)
531537
parser.add_option_group(takeover)

‎lib/techniques/brute/use.py‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
from lib.core.common import safeStringFormat
2020
from lib.core.data import conf
2121
from lib.core.data import logger
22+
from lib.core.exception import sqlmapMissingMandatoryOptionException
2223
from lib.request.connect import Connect as Request
2324

2425
def tableExists(tableFile):
@@ -57,19 +58,23 @@ def tableExists(tableFile):
5758

5859
return retVal
5960

60-
def columnExists(table, columnFile):
61-
tables = getFileItems(columnFile, None)
61+
def columnExists(columnFile):
62+
if not conf.tbl:
63+
errMsg = "missing table parameter"
64+
raise sqlmapMissingMandatoryOptionException, errMsg
65+
66+
columns = getFileItems(columnFile, None)
6267
retVal = []
63-
infoMsg = "checking column existence for table '%s' using items from '%s'" % (table, columnFile)
68+
infoMsg = "checking column existence for table '%s' using items from '%s'" % (conf.tbl, columnFile)
6469
logger.info(infoMsg)
6570

6671
pushValue(conf.verbose)
6772
conf.verbose = 0
6873
count = 0
69-
length = len(tables)
74+
length = len(columns)
7075

7176
for column in columns:
72-
query = agent.prefixQuery("%s" % safeStringFormat("AND EXISTS(SELECT %s FROM %s)", (column, table)))
77+
query = agent.prefixQuery("%s" % safeStringFormat("AND EXISTS(SELECT %s FROM %s)", (column, conf.tbl)))
7378
query = agent.postfixQuery(query)
7479
result = Request.queryPage(agent.payload(newValue=query))
7580

0 commit comments

Comments
 (0)