Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c9ee11e

Browse files
bdamelebdamele
committed
Added support to search for tables (--search with -T). See #190.
1 parent e938331 commit c9ee11e

4 files changed

Lines changed: 235 additions & 9 deletions

File tree

‎plugins/dbms/mssqlserver/enumeration.py‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
2323
"""
2424

25+
from lib.core.agent import agent
26+
from lib.core.common import getRange
2527
from lib.core.data import conf
2628
from lib.core.data import kb
2729
from lib.core.data import logger
@@ -116,3 +118,89 @@ def getTables(self):
116118
raise sqlmapNoneDataException(errMsg)
117119

118120
return kb.data.cachedTables
121+
122+
def searchTable(self):
123+
rootQuery = queries[kb.dbms].searchTable
124+
foundTbls = {}
125+
tblList = conf.tbl.split(",")
126+
tblCond = rootQuery["inband"]["condition"]
127+
dbCond = rootQuery["inband"]["condition2"]
128+
129+
tblConsider, tblCondParam = self.likeOrExact("table")
130+
131+
if not len(kb.data.cachedDbs):
132+
enumDbs = self.getDbs()
133+
else:
134+
enumDbs = kb.data.cachedDbs
135+
136+
for db in enumDbs:
137+
foundTbls[db] = []
138+
139+
for tbl in tblList:
140+
infoMsg = "searching table"
141+
if tblConsider == "1":
142+
infoMsg += "s like"
143+
infoMsg += " '%s'" % tbl
144+
logger.info(infoMsg)
145+
146+
if conf.excludeSysDbs:
147+
exclDbsQuery = "".join(" AND '%s' != %s" % (db, dbCond) for db in self.excludeDbsList)
148+
infoMsg = "skipping system databases '%s'" % ", ".join(db for db in self.excludeDbsList)
149+
logger.info(infoMsg)
150+
else:
151+
exclDbsQuery = ""
152+
153+
tblQuery = "%s%s" % (tblCond, tblCondParam)
154+
tblQuery = tblQuery % tbl
155+
156+
for db in foundTbls.keys():
157+
if kb.unionPosition or conf.direct:
158+
query = rootQuery["inband"]["query"] % db
159+
query += tblQuery
160+
query += exclDbsQuery
161+
values = inject.getValue(query, blind=False)
162+
163+
if values:
164+
if isinstance(values, str):
165+
values = [ values ]
166+
167+
for foundTbl in values:
168+
foundTbls[db].append(foundTbl)
169+
else:
170+
infoMsg = "fetching number of table"
171+
if tblConsider == "1":
172+
infoMsg += "s like"
173+
infoMsg += " '%s' in database '%s'" % (tbl, db)
174+
logger.info(infoMsg)
175+
176+
query = rootQuery["blind"]["count2"]
177+
query = query % db
178+
query += " AND %s" % tblQuery
179+
count = inject.getValue(query, inband=False, expected="int", charsetType=2)
180+
181+
if not count.isdigit() or not len(count) or count == "0":
182+
warnMsg = "no table"
183+
if tblConsider == "1":
184+
warnMsg += "s like"
185+
warnMsg += " '%s' " % tbl
186+
warnMsg += "in database '%s'" % db
187+
logger.warn(warnMsg)
188+
189+
continue
190+
191+
indexRange = getRange(count)
192+
193+
for index in indexRange:
194+
query = rootQuery["blind"]["query2"]
195+
query = query % db
196+
query += " AND %s" % tblQuery
197+
query = agent.limitQuery(index, query, tblCond)
198+
tbl = inject.getValue(query, inband=False)
199+
kb.hintValue = tbl
200+
foundTbls[db].append(tbl)
201+
202+
for db, tbls in foundTbls.items():
203+
if len(tbls) == 0:
204+
foundTbls.pop(db)
205+
206+
return foundTbls

‎plugins/generic/enumeration.py‎

Lines changed: 129 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1269,8 +1269,125 @@ def searchDb(self):
12691269
return foundDbs
12701270

12711271
def searchTable(self):
1272-
errMsg = "search for table names is not supported yet"
1273-
raise sqlmapUnsupportedFeatureException, errMsg
1272+
if kb.dbms == "MySQL" and not kb.data.has_information_schema:
1273+
errMsg = "information_schema not available, "
1274+
errMsg += "back-end DBMS is MySQL < 5.0"
1275+
raise sqlmapUnsupportedFeatureException, errMsg
1276+
1277+
rootQuery = queries[kb.dbms].searchTable
1278+
foundTbls = {}
1279+
tblList = conf.tbl.split(",")
1280+
tblCond = rootQuery["inband"]["condition"]
1281+
dbCond = rootQuery["inband"]["condition2"]
1282+
1283+
tblConsider, tblCondParam = self.likeOrExact("table")
1284+
1285+
for tbl in tblList:
1286+
if kb.dbms == "Oracle":
1287+
tbl = tbl.upper()
1288+
1289+
infoMsg = "searching table"
1290+
if tblConsider == "1":
1291+
infoMsg += "s like"
1292+
infoMsg += " '%s'" % tbl
1293+
logger.info(infoMsg)
1294+
1295+
if conf.excludeSysDbs:
1296+
exclDbsQuery = "".join(" AND '%s' != %s" % (db, dbCond) for db in self.excludeDbsList)
1297+
infoMsg = "skipping system databases '%s'" % ", ".join(db for db in self.excludeDbsList)
1298+
logger.info(infoMsg)
1299+
else:
1300+
exclDbsQuery = ""
1301+
1302+
tblQuery = "%s%s" % (tblCond, tblCondParam)
1303+
tblQuery = tblQuery % tbl
1304+
1305+
if kb.unionPosition or conf.direct:
1306+
query = rootQuery["inband"]["query"]
1307+
query += tblQuery
1308+
query += exclDbsQuery
1309+
values = inject.getValue(query, blind=False)
1310+
1311+
if values:
1312+
if isinstance(values, str):
1313+
values = [ values ]
1314+
1315+
for foundDb, foundTbl in values:
1316+
if foundDb in foundTbls:
1317+
foundTbls[foundDb].append(foundTbl)
1318+
else:
1319+
foundTbls[foundDb] = [ foundTbl ]
1320+
else:
1321+
infoMsg = "fetching number of databases with table"
1322+
if tblConsider == "1":
1323+
infoMsg += "s like"
1324+
infoMsg += " '%s'" % tbl
1325+
logger.info(infoMsg)
1326+
1327+
query = rootQuery["blind"]["count"]
1328+
query += tblQuery
1329+
query += exclDbsQuery
1330+
count = inject.getValue(query, inband=False, expected="int", charsetType=2)
1331+
1332+
if not count.isdigit() or not len(count) or count == "0":
1333+
warnMsg = "no databases have table"
1334+
if tblConsider == "1":
1335+
warnMsg += "s like"
1336+
warnMsg += " '%s'" % tbl
1337+
logger.warn(warnMsg)
1338+
1339+
continue
1340+
1341+
indexRange = getRange(count)
1342+
1343+
for index in indexRange:
1344+
query = rootQuery["blind"]["query"]
1345+
query += tblQuery
1346+
query += exclDbsQuery
1347+
query = agent.limitQuery(index, query)
1348+
foundDb = inject.getValue(query, inband=False)
1349+
foundTbls[foundDb] = []
1350+
1351+
if tblConsider == "2":
1352+
foundTbls[foundDb].append(tbl)
1353+
1354+
if tblConsider == "2":
1355+
continue
1356+
1357+
for db in foundTbls.keys():
1358+
infoMsg = "fetching number of table"
1359+
if tblConsider == "1":
1360+
infoMsg += "s like"
1361+
infoMsg += " '%s' in database '%s'" % (tbl, db)
1362+
logger.info(infoMsg)
1363+
1364+
query = rootQuery["blind"]["count2"]
1365+
query = query % db
1366+
query += " AND %s" % tblQuery
1367+
count = inject.getValue(query, inband=False, expected="int", charsetType=2)
1368+
1369+
if not count.isdigit() or not len(count) or count == "0":
1370+
warnMsg = "no table"
1371+
if tblConsider == "1":
1372+
warnMsg += "s like"
1373+
warnMsg += " '%s' " % tbl
1374+
warnMsg += "in database '%s'" % db
1375+
logger.warn(warnMsg)
1376+
1377+
continue
1378+
1379+
indexRange = getRange(count)
1380+
1381+
for index in indexRange:
1382+
query = rootQuery["blind"]["query2"]
1383+
query = query % db
1384+
query += " AND %s" % tblQuery
1385+
query = agent.limitQuery(index, query)
1386+
foundTbl = inject.getValue(query, inband=False)
1387+
kb.hintValue = foundTbl
1388+
foundTbls[db].append(foundTbl)
1389+
1390+
return foundTbls
12741391

12751392
def searchColumn(self):
12761393
if kb.dbms == "MySQL" and not kb.data.has_information_schema:
@@ -1291,7 +1408,16 @@ def searchColumn(self):
12911408
if kb.dbms == "Oracle":
12921409
column = column.upper()
12931410
conf.db = "USERS"
1294-
elif kb.dbms == "Microsoft SQL Server":
1411+
1412+
infoMsg = "searching column"
1413+
if colConsider == "1":
1414+
infoMsg += "s like"
1415+
infoMsg += " '%s'" % column
1416+
logger.info(infoMsg)
1417+
1418+
foundCols[column] = {}
1419+
1420+
if kb.dbms == "Microsoft SQL Server":
12951421
if not conf.db:
12961422
if not len(kb.data.cachedDbs):
12971423
enumDbs = self.getDbs()
@@ -1300,8 +1426,6 @@ def searchColumn(self):
13001426

13011427
conf.db = ",".join(db for db in enumDbs)
13021428

1303-
foundCols[column] = {}
1304-
13051429
if conf.db:
13061430
for db in conf.db.split(","):
13071431
dbs[db] = {}

‎plugins/generic/misc.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
from lib.core.data import kb
3333
from lib.core.data import logger
3434
from lib.core.data import queries
35+
from lib.core.exception import sqlmapNoneDataException
3536
from lib.core.exception import sqlmapUnsupportedFeatureException
3637
from lib.core.session import setRemoteTempPath
3738
from lib.request import inject

‎xml/queries.xml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,10 @@
6363
<inband query="SELECT schema_name FROM information_schema.SCHEMATA WHERE " query2="SELECT db FROM mysql.db WHERE " condition="schema_name" condition2="db"/>
6464
<blind query="SELECT DISTINCT(schema_name) FROM information_schema.SCHEMATA WHERE " query2="SELECT DISTINCT(db) FROM mysql.db WHERE " count="SELECT COUNT(DISTINCT(schema_name)) FROM information_schema.SCHEMATA WHERE " count2="SELECT COUNT(DISTINCT(db)) FROM mysql.db WHERE " condition="schema_name" condition2="db"/>
6565
</search_db>
66-
<search_table/>
66+
<search_table>
67+
<inband query="SELECT table_schema, table_name FROM information_schema.TABLES WHERE " condition="table_name" condition2="table_schema"/>
68+
<blind query="SELECT DISTINCT(table_schema) FROM information_schema.TABLES WHERE " query2="SELECT DISTINCT(table_name) FROM information_schema.TABLES WHERE table_schema='%s'" count="SELECT COUNT(DISTINCT(table_schema)) FROM information_schema.TABLES WHERE " count2="SELECT COUNT(DISTINCT(table_name)) FROM information_schema.TABLES WHERE table_schema='%s'" condition="table_name" condition2="table_schema"/>
69+
</search_table>
6770
<search_column>
6871
<inband query="SELECT table_schema FROM information_schema.COLUMNS WHERE " query2="SELECT table_name FROM information_schema.COLUMNS WHERE table_schema='%s'" condition="column_name" condition2="table_schema"/>
6972
<blind query="SELECT DISTINCT(table_schema) FROM information_schema.COLUMNS WHERE " query2="SELECT DISTINCT(table_name) FROM information_schema.COLUMNS WHERE table_schema='%s'" count="SELECT COUNT(DISTINCT(table_schema)) FROM information_schema.COLUMNS WHERE " count2="SELECT COUNT(DISTINCT(table_name)) FROM information_schema.COLUMNS WHERE table_schema='%s'" condition="column_name" condition2="table_schema"/>
@@ -136,7 +139,11 @@
136139
<blind query="SELECT %s FROM (SELECT %s, ROWNUM AS LIMIT FROM %s) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
137140
</dump_table>
138141
<search_db/>
139-
<search_table/>
142+
<search_table>
143+
<!-- NOTE: in Oracle the TABLESPACE_NAME is the spacename corresponding to SYS, SYSDBA, USERS. It is NOT the database name -->
144+
<inband query="SELECT TABLESPACE_NAME, TABLE_NAME FROM SYS.ALL_TABLES WHERE " condition="TABLE_NAME" condition2="TABLESPACE_NAME"/>
145+
<blind query="SELECT DISTINCT(TABLESPACE_NAME) FROM SYS.ALL_TABLES WHERE " query2="SELECT TABLE_NAME FROM SYS.ALL_TABLES WHERE TABLESPACE_NAME='%s'" count="SELECT COUNT(DISTINCT(TABLESPACE_NAME)) FROM SYS.ALL_TABLES WHERE " count2="SELECT COUNT(TABLE_NAME) FROM SYS.ALL_TABLES WHERE TABLESPACE_NAME='%s'" condition="TABLE_NAME" condition2="TABLESPACE_NAME"/>
146+
</search_table>
140147
<search_column>
141148
<inband query="" query2="SELECT TABLE_NAME FROM SYS.ALL_TAB_COLUMNS" condition="COLUMN_NAME" condition2="TABLESPACE_NAME"/>
142149
<blind query="" query2="SELECT DISTINCT(TABLE_NAME) FROM SYS.ALL_TAB_COLUMNS" count="" count2="SELECT COUNT(DISTINCT(TABLE_NAME)) FROM SYS.ALL_TAB_COLUMNS" condition="COLUMN_NAME" condition2="TABLESPACE_NAME"/>
@@ -205,7 +212,10 @@
205212
<inband query="SELECT datname FROM pg_database WHERE " query2="" condition="datname" condition2=""/>
206213
<blind query="SELECT DISTINCT(datname) FROM pg_database WHERE " query2="" count="SELECT COUNT(DISTINCT(datname)) FROM pg_database WHERE " count2="" condition="datname" condition2=""/>
207214
</search_db>
208-
<search_table/>
215+
<search_table>
216+
<inband query="SELECT schemaname, tablename FROM pg_tables WHERE " condition="tablename" condition2="schemaname"/>
217+
<blind query="SELECT DISTINCT(schemaname) FROM pg_tables WHERE " query2="SELECT tablename FROM pg_tables WHERE schemaname='%s'" count="SELECT COUNT(DISTINCT(schemaname)) FROM pg_tables WHERE " count2="SELECT COUNT(tablename) FROM pg_tables WHERE schemaname='%s'" condition="tablename" condition2="schemaname"/>
218+
</search_table>
209219
<search_column>
210220
<inband query="SELECT nspname FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " query2="SELECT relname FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND nspname='%s'" condition="attname" condition2="nspname"/>
211221
<blind query="SELECT DISTINCT(nspname) FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " query2="SELECT DISTINCT(relname) FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND nspname='%s'" count="SELECT COUNT(DISTINCT(nspname)) FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " count2="SELECT COUNT(DISTINCT(relname)) FROM pg_namespace, pg_type, pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND nspname='%s'" condition="attname" condition2="nspname"/>
@@ -265,7 +275,10 @@
265275
<inband query="SELECT name FROM master..sysdatabases WHERE " condition="name"/>
266276
<blind query="SELECT name FROM master..sysdatabases WHERE " count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases WHERE " condition="name"/>
267277
</search_db>
268-
<search_table/>
278+
<search_table>
279+
<inband query="SELECT name FROM %s..sysobjects WHERE xtype IN ('u', 'v') AND " condition="name" condition2="name"/>
280+
<blind query="" query2="SELECT name FROM %s..sysobjects WHERE xtype IN ('u', 'v') " count="" count2="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE xtype IN ('u', 'v')" condition="name" condition2="name"/>
281+
</search_table>
269282
<search_column>
270283
<inband query="" query2="SELECT %s..sysobjects.name FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" condition="[DB]..syscolumns.name"/>
271284
<blind query="" query2="SELECT %s..sysobjects.name FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" count="" count2="SELECT COUNT(%s..sysobjects.name) FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" condition="[DB]..syscolumns.name"/>

0 commit comments

Comments
 (0)