Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fc57b75

Browse files
stamparmstamparm
committed
Implementation for an Issue #432 
1 parent 03be419 commit fc57b75

2 files changed

Lines changed: 58 additions & 41 deletions

File tree

‎lib/core/common.py‎

Lines changed: 42 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,9 @@
8282
from lib.core.log import LOGGER_HANDLER
8383
from lib.core.optiondict import optDict
8484
from lib.core.settings import BOLD_PATTERNS
85+
from lib.core.settings import BRUTE_DOC_ROOT_PREFIXES
86+
from lib.core.settings import BRUTE_DOC_ROOT_SUFFIXES
87+
from lib.core.settings import BRUTE_DOC_ROOT_TARGET_MARK
8588
from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
8689
from lib.core.settings import DBMS_DIRECTORY_DICT
8790
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
@@ -99,6 +102,7 @@
99102
from lib.core.settings import HOST_ALIASES
100103
from lib.core.settings import INFERENCE_UNKNOWN_CHAR
101104
from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT
105+
from lib.core.settings import IP_ADDRESS_REGEX
102106
from lib.core.settings import ISSUES_PAGE
103107
from lib.core.settings import IS_WIN
104108
from lib.core.settings import LARGE_OUTPUT_THRESHOLD
@@ -644,38 +648,48 @@ def getDocRoot():
644648

645649
docRoot = []
646650

647-
message = "do you want to provide a text file with a list of "
648-
message += "directories to try? [y/N] "
649-
answer = readInput(message, default="N")
651+
message = "what do you want to use for web server document root?\n"
652+
message += "[1] common location(s) '%s' (default)\n" % ", ".join(root for root in defaultDocRoot)
653+
message += "[2] custom location\n"
654+
message += "[3] custom directory list file\n"
655+
message += "[4] brute force search\n"
656+
choice = readInput(message, default="1").strip()
657+
658+
if choice == "2":
659+
message = "please provide the web server document root: "
660+
docRoot = readInput(message).split(',')
661+
elif choice == "3":
662+
message = "what's the list file location?\n"
663+
listPath = readInput(message)
664+
checkFile(listPath)
665+
docRoot = getFileItems(listPath)
666+
elif choice == "4":
667+
targets = set([conf.hostname])
668+
_ = conf.hostname.split('.')
669+
670+
if _[0] == "www":
671+
targets.add('.'.join(_[1:]))
672+
targets.add('.'.join(_[1:-1]))
673+
else:
674+
targets.add('.'.join(_[:-1]))
650675

651-
if answer and answer.lower() == "y":
652-
message = "please provide the directories list file to try: "
653-
dirFilePath = readInput(message)
676+
targets = filter(None, targets)
654677

655-
if dirFilePath:
656-
if os.path.isfile(dirFilePath):
657-
fd = codecs.open(dirFilePath, "rb", UNICODE_ENCODING)
678+
for prefix in BRUTE_DOC_ROOT_PREFIXES.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]):
679+
if BRUTE_DOC_ROOT_TARGET_MARK in prefix and re.match(IP_ADDRESS_REGEX, conf.hostname):
680+
continue
658681

659-
for filepath in fd.readlines():
660-
docRoot.append(normalizePath(filepath))
682+
for suffix in BRUTE_DOC_ROOT_SUFFIXES:
683+
for target in targets:
684+
item = "%s/%s" % (prefix, suffix)
685+
item = item.replace(BRUTE_DOC_ROOT_TARGET_MARK, target).replace("//", "/")
686+
docRoot.append(item)
661687

662-
else:
663-
errMsg = "provided directory list file %s " % dirFilePath
664-
errMsg += "is not a valid file"
665-
logger.error(errMsg)
666-
667-
if len(docRoot) == 0:
668-
message = "please provide the web server document root "
669-
message += "[%s]: " % ", ".join(root for root in defaultDocRoot)
670-
inputDocRoot = readInput(message, default=defaultDocRoot)
671-
672-
if inputDocRoot:
673-
if isinstance(inputDocRoot, basestring):
674-
docRoot = inputDocRoot.split(',')
675-
else:
676-
docRoot = inputDocRoot
677-
else:
678-
docRoot = defaultDocRoot
688+
if BRUTE_DOC_ROOT_TARGET_MARK not in prefix:
689+
break
690+
691+
else:
692+
docRoot = defaultDocRoot
679693

680694
return docRoot
681695

@@ -700,19 +714,6 @@ def getDirs():
700714
if webDir:
701715
directories.add(webDir)
702716

703-
message = "please provide additional comma separated file paths to "
704-
message += "try to upload the agent inside the possible document: "
705-
message += "root%s [Enter for None]: " % "s" if len(kb.docRoot) > 1 else ""
706-
inputDirs = readInput(message)
707-
708-
if inputDirs:
709-
inputDirs = inputDirs.replace(", ", ",")
710-
inputDirs = inputDirs.split(",")
711-
712-
for inputDir in inputDirs:
713-
if inputDir:
714-
directories.add(inputDir)
715-
716717
return list(directories)
717718

718719
def filePathToSafeString(filePath):

‎lib/core/settings.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
from lib.core.enums import DBMS
1515
from lib.core.enums import DBMS_DIRECTORY_NAME
16+
from lib.core.enums import OS
1617
from lib.core.revision import getRevisionNumber
1718

1819
# sqlmap version and site
@@ -58,6 +59,9 @@
5859
# Regular expression used for extracting content from "textual" tags
5960
TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)"
6061

62+
# Regular expression used for recognition of IP addresses
63+
IP_ADDRESS_REGEX = r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
64+
6165
# Dumping characters used in GROUP_CONCAT MySQL technique
6266
CONCAT_ROW_DELIMITER = ','
6367
CONCAT_VALUE_DELIMITER = '|'
@@ -547,6 +551,18 @@
547551
# Reference: http://www.cookiecentral.com/faq/#3.5
548552
NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File."
549553

554+
# Prefixes used in brute force search for web server document root
555+
BRUTE_DOC_ROOT_PREFIXES = {
556+
OS.LINUX: ("/var/www", "/var/www/%TARGET%", "/var/www/vhosts/%TARGET%", "/var/www/virtual/%TARGET%", "/var/www/clients/vhosts/%TARGET%", "/var/www/clients/virtual/%TARGET%"),
557+
OS.WINDOWS: ("/xampp", "/Program Files/xampp/", "/wamp", "/Program Files/wampp/", "/Inetpub/wwwroot", "/Inetpub/wwwroot/%TARGET%", "/Inetpub/vhosts/%TARGET%")
558+
}
559+
560+
# Suffixes used in brute force search for web server document root
561+
BRUTE_DOC_ROOT_SUFFIXES = ("", "html", "htdocs", "httpdocs", "php", "public", "src", "site", "build", "web", "sites/all", "www/build")
562+
563+
# String used for marking target name inside used brute force web server document root
564+
BRUTE_DOC_ROOT_TARGET_MARK = "%TARGET%"
565+
550566
# CSS style used in HTML dump format
551567
HTML_DUMP_CSS_STYLE = """<style>
552568
table{

0 commit comments

Comments
 (0)