Minor adjustments and bug fixes

bdamele · bdamele · commit dda62ba46372 · 2008-12-17T20:11:18.000Z
diff --git a/lib/core/agent.py b/lib/core/agent.py
@@ -246,10 +246,15 @@ def getFields(self, query):
         @rtype: C{str}
         """
 
-        fieldsSelectTop      = re.search("\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I)
-        fieldsSelectDistinct = re.search("\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", query, re.I)
-        fieldsSelectFrom     = re.search("\ASELECT\s+(.+?)\s+FROM\s+", query, re.I)
-        fieldsSelect         = re.search("\ASELECT\s+(.*)", query, re.I)
+        if "(SELECT " in query:
+            firstChar = "\\("
+        else:
+            firstChar = "\\A"
+
+        fieldsSelectTop      = re.search("%sSELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM" % firstChar, query, re.I)
+        fieldsSelectDistinct = re.search("%sSELECT\s+DISTINCT\((.+?)\)\s+FROM" % firstChar, query, re.I)
+        fieldsSelectFrom     = re.search("%sSELECT\s+(.+?)\s+FROM\s+" % firstChar, query, re.I)
+        fieldsSelect         = re.search("%sSELECT\s+(.*)" % firstChar, query, re.I)
         fieldsNoSelect       = query
 
         if fieldsSelectTop:
@@ -296,11 +301,11 @@ def concatQuery(self, query):
         """
 
         concatQuery = ""
-        query = query.replace(", ", ",")
+        query       = query.replace(", ", ",")
 
         fieldsSelectFrom, fieldsSelect, fieldsNoSelect, _, fieldsToCastStr = self.getFields(query)
         castedFields = self.nullCastConcatFields(fieldsToCastStr)
-        concatQuery = query.replace(fieldsToCastStr, castedFields, 1)
+        concatQuery  = query.replace(fieldsToCastStr, castedFields, 1)
 
         if kb.dbms == "MySQL":
             if fieldsSelectFrom:
diff --git a/lib/request/inject.py b/lib/request/inject.py
@@ -228,6 +228,15 @@ def __goInferenceProxy(expression, fromUser=False, expected=None):
 
                                 return None
 
+                        elif count and not count.isdigit():
+                            warnMsg  = "it was not possible to count the number "
+                            warnMsg += "of entries for the SQL query provided. "
+                            warnMsg += "sqlmap will assume that it returns only "
+                            warnMsg += "one entry"
+                            logger.warn(warnMsg)
+
+                            stopLimit = 1
+
                         elif ( not count or int(count) == 0 ):
                             warnMsg  = "the SQL query provided does not "
                             warnMsg += "return any output"
diff --git a/lib/techniques/inband/union/use.py b/lib/techniques/inband/union/use.py
@@ -237,6 +237,15 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False):
                             infoMsg += "%d entries" % stopLimit
                             logger.info(infoMsg)
 
+                        elif count and not count.isdigit():
+                            warnMsg  = "it was not possible to count the number "
+                            warnMsg += "of entries for the SQL query provided. "
+                            warnMsg += "sqlmap will assume that it returns only "
+                            warnMsg += "one entry"
+                            logger.warn(warnMsg)
+
+                            stopLimit = 1
+
                         elif ( not count or int(count) == 0 ):
                             warnMsg  = "the SQL query provided does not "
                             warnMsg += "return any output"
diff --git a/xml/banner/generic.xml b/xml/banner/generic.xml
@@ -19,6 +19,10 @@
         <info type="Windows" distrib="2003"/>
     </regexp>
 
+    <regexp value="Microsoft.*5\.2">
+        <info type="Windows" distrib="2003"/>
+    </regexp>
+
     <regexp value="Microsoft.*5\.1">
         <info type="Windows" distrib="XP"/>
     </regexp>
diff --git a/xml/queries.xml b/xml/queries.xml
@@ -74,10 +74,6 @@
         <timedelay query="BEGIN DBMS_LOCK.SLEEP(%d); END" query2="EXEC DBMS_LOCK.SLEEP(%d.00)" query3="EXEC USER_LOCK.SLEEP(%d00)"/>
         <substring query="SUBSTR((%s), %d, %d)"/>
         <inference query="AND ASCII(SUBSTR((%s), %d, 1)) > %d"/>
-        <!--
-             TODO: the following query does not work with inband SQL injection:
-             SELECT banner FROM (SELECT banner, ROWNUM AS limit FROM v$version) WHERE limit=4
-        -->
         <banner query="SELECT banner FROM v$version WHERE ROWNUM=1"/>
         <current_user query="SELECT SYS.LOGIN_USER FROM DUAL"/>
         <current_db query="SELECT SYS.DATABASE_NAME FROM DUAL"/>
