Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ec253dd

Browse files
stamparmstamparm
committed
Support for table name retrieval from mysql.innodb_table_stats (fallback if primary fails)
1 parent 4c25a20 commit ec253dd

4 files changed

Lines changed: 24 additions & 20 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.11"
22+
VERSION = "1.2.9.12"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎plugins/generic/databases.py‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -261,24 +261,28 @@ def getTables(self, bruteForce=None):
261261
rootQuery = queries[Backend.getIdentifiedDbms()].tables
262262

263263
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
264-
query = rootQuery.inband.query
265-
condition = rootQuery.inband.condition if 'condition' in rootQuery.inband else None
264+
values = []
266265

267-
if condition:
268-
if not Backend.isDbms(DBMS.SQLITE):
269-
query += " WHERE %s" % condition
266+
for query, condition in ((rootQuery.inband.query, getattr(rootQuery.inband, "condition", None)), (getattr(rootQuery.inband, "query2", None), getattr(rootQuery.inband, "condition2", None))):
267+
if not isNoneValue(values) or not query:
268+
break
270269

271-
if conf.excludeSysDbs:
272-
infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList))
273-
logger.info(infoMsg)
274-
query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs) if db not in self.excludeDbsList)
275-
else:
276-
query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs))
270+
if condition:
271+
if not Backend.isDbms(DBMS.SQLITE):
272+
query += " WHERE %s" % condition
277273

278-
if len(dbs) < 2 and ("%s," % condition) in query:
279-
query = query.replace("%s," % condition, "", 1)
274+
if conf.excludeSysDbs:
275+
infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList))
276+
logger.info(infoMsg)
277+
query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs) if db not in self.excludeDbsList)
278+
else:
279+
query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs))
280280

281-
values = inject.getValue(query, blind=False, time=False)
281+
if len(dbs) < 2 and ("%s," % condition) in query:
282+
query = query.replace("%s," % condition, "", 1)
283+
284+
if query:
285+
values = inject.getValue(query, blind=False, time=False)
282286

283287
if not isNoneValue(values):
284288
values = filter(None, arrayizeValue(values))

‎txt/checksum.md5‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
e595397f965c89ed29d9b4b89aada743 lib/core/settings.py
53+
39a71984ff7fd683d06c489f33d477a7 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5656
815d1cf27f0f8738d81531e73149867d lib/core/target.py
@@ -207,7 +207,7 @@ a3db8618eed5bb2807b6f77605cba9cc plugins/dbms/sybase/__init__.py
207207
79f6c7017db4ded8f74a0117188836ff plugins/dbms/sybase/takeover.py
208208
34d181a7086d6dfc7e72ae5f8a4cfe0f plugins/generic/connector.py
209209
ce6a6ff713852b5eca7b78316cc941c4 plugins/generic/custom.py
210-
78813e60e7108f78ef1af46d360f41bf plugins/generic/databases.py
210+
2e0c1c5ced14222d9fef2dd12447d815 plugins/generic/databases.py
211211
4e2b366bb9cfdaaed719b219913357c6 plugins/generic/entries.py
212212
d82f2c78c1d4d7c6487e94fd3a68a908 plugins/generic/enumeration.py
213213
0a67b8b46f69df7cfacc286b47a0d9a5 plugins/generic/filesystem.py
@@ -478,4 +478,4 @@ fe2a865a8579f2045d2be057a00f5b49 xml/payloads/boolean_blind.xml
478478
3194e2688a7576e1f877d5b137f7c260 xml/payloads/stacked_queries.xml
479479
92c41925eba27afeed76bceba6b18be2 xml/payloads/time_blind.xml
480480
ac649aff0e7db413e4937e446e398736 xml/payloads/union_query.xml
481-
a5eecbca03800851635817e0ca832a92 xml/queries.xml
481+
b148ef9ef70aaada9eb6e58ab1e384e1 xml/queries.xml

‎xml/queries.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@
4646
<blind query="SELECT DISTINCT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1" query2="SELECT DISTINCT(db) FROM mysql.db LIMIT %d,1" count="SELECT COUNT(DISTINCT(schema_name)) FROM INFORMATION_SCHEMA.SCHEMATA" count2="SELECT COUNT(DISTINCT(db)) FROM mysql.db"/>
4747
</dbs>
4848
<tables>
49-
<inband query="SELECT table_schema,table_name FROM INFORMATION_SCHEMA.TABLES" condition="table_schema"/>
50-
<blind query="SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s' LIMIT %d,1" count="SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s'"/>
49+
<inband query="SELECT table_schema,table_name FROM INFORMATION_SCHEMA.TABLES" query2="SELECT database_name,table_name FROM mysql.innodb_table_stats" condition="table_schema" condition2="database_name"/>
50+
<blind query="SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s' LIMIT %d,1" query2="SELECT table_name FROM mysql.innodb_table_stats WHERE database_name='%s' LIMIT %d,1" count="SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s'" count2="SELECT COUNT(table_name) FROM mysql.innodb_table_stats WHERE database_name='%s'"/>
5151
</tables>
5252
<columns>
5353
<inband query="SELECT column_name,column_type FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND table_schema='%s'" condition="column_name"/>

0 commit comments

Comments
 (0)