SIGN IN SIGN UP
sqlmapproject / sqlmap UNCLAIMED

Automatic SQL injection and database takeover tool

0 0 0 Python
2019-05-08 12:47:52 +02:00
#!/usr/bin/env python
2008-10-15 15:38:22 +00:00
"""
2026-01-01 19:12:07 +01:00
Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
2017-10-11 14:50:46 +02:00
See the file 'LICENSE' for copying permission
2008-10-15 15:38:22 +00:00
"""
2016-10-26 22:33:04 +02:00
try:
2016-10-29 00:13:04 +02:00
import cPickle as pickle
2016-10-26 22:33:04 +02:00
except:
2016-10-29 00:13:04 +02:00
import pickle
2016-10-26 22:33:04 +02:00
2015-01-15 17:32:07 +01:00
import base64
2019-05-08 12:28:50 +02:00
import binascii
2019-05-03 13:20:15 +02:00
import codecs
import json
2016-01-08 11:47:12 +01:00
import re
import sys
2023-09-28 20:34:52 +02:00
import time
2008-10-15 15:38:22 +00:00
2019-06-26 11:02:43 +02:00
from lib.core.bigarray import BigArray
2019-12-09 11:35:22 +01:00
from lib.core.compat import xrange
2019-05-06 00:54:21 +02:00
from lib.core.data import conf
from lib.core.data import kb
2019-05-03 13:20:15 +02:00
from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA
2019-05-21 14:37:55 +02:00
from lib.core.settings import IS_TTY
2012-07-31 11:03:44 +02:00
from lib.core.settings import IS_WIN
2019-05-06 00:54:21 +02:00
from lib.core.settings import NULL
from lib.core.settings import PICKLE_PROTOCOL
2019-05-03 13:20:15 +02:00
from lib.core.settings import SAFE_HEX_MARKER
2011-03-03 10:39:04 +00:00
from lib.core.settings import UNICODE_ENCODING
from thirdparty import six
2019-05-15 10:57:22 +02:00
from thirdparty.six import unichr as _unichr
2025-12-28 11:26:17 +01:00
from thirdparty.six.moves import html_parser
from thirdparty.six.moves import collections_abc as _collections
2019-12-02 10:10:58 +01:00
try:
from html import escape as htmlEscape
except ImportError:
from cgi import escape as htmlEscape
def base64pickle(value):
2013-03-11 14:58:05 +01:00
"""
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
2019-05-02 16:54:54 +02:00
>>> base64unpickle(base64pickle([1, 2, 3])) == [1, 2, 3]
True
2013-03-11 14:58:05 +01:00
"""
2012-11-26 11:16:59 +01:00
retVal = None
2014-11-13 10:52:33 +01:00
2012-11-26 11:16:59 +01:00
try:
retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL), binary=False)
2012-11-26 11:16:59 +01:00
except:
warnMsg = "problem occurred while serializing "
warnMsg += "instance of a type '%s'" % type(value)
singleTimeWarnMessage(warnMsg)
try:
retVal = encodeBase64(pickle.dumps(value), binary=False)
except:
2025-12-28 01:17:19 +01:00
raise
2012-11-26 11:16:59 +01:00
return retVal
2019-03-27 01:28:34 +01:00
def base64unpickle(value):
2013-03-11 14:58:05 +01:00
"""
2013-03-26 14:11:17 +01:00
Decodes value from Base64 to plain format and deserializes (with pickle) its content
2013-03-11 14:58:05 +01:00
2019-05-02 16:54:54 +02:00
>>> type(base64unpickle('gAJjX19idWlsdGluX18Kb2JqZWN0CnEBKYFxAi4=')) == object
True
2013-03-11 14:58:05 +01:00
"""
2014-11-13 10:52:33 +01:00
retVal = None
try:
2019-05-03 13:20:15 +02:00
retVal = pickle.loads(decodeBase64(value))
except TypeError:
2019-05-03 13:20:15 +02:00
retVal = pickle.loads(decodeBase64(bytes(value)))
2019-05-02 16:54:54 +02:00
return retVal
2019-05-20 11:24:43 +02:00
def htmlUnescape(value):
2013-03-11 14:58:05 +01:00
"""
2025-12-28 00:55:09 +01:00
Returns HTML unescaped value
2013-03-11 14:58:05 +01:00
>>> htmlUnescape('a&lt;b') == 'a<b'
True
2025-12-28 00:45:12 +01:00
>>> htmlUnescape('a&lt;b') == 'a<b'
True
>>> htmlUnescape('&#x66;&#x6f;&#x6f;&#x62;&#x61;&#x72;') == 'foobar'
True
2025-12-28 00:55:09 +01:00
>>> htmlUnescape('&#102;&#111;&#111;&#98;&#97;&#114;') == 'foobar'
True
>>> htmlUnescape('&copy;&euro;') == htmlUnescape('&#xA9;&#x20AC;')
True
2013-03-11 14:58:05 +01:00
"""
if value and isinstance(value, six.string_types):
2025-12-28 00:55:09 +01:00
if six.PY3:
import html
return html.unescape(value)
else:
return html_parser.HTMLParser().unescape(value)
return value
2012-07-31 11:03:44 +02:00
2018-03-21 14:29:54 +01:00
def singleTimeWarnMessage(message): # Cross-referenced function
2014-11-29 23:33:24 +01:00
sys.stdout.write(message)
sys.stdout.write("\n")
sys.stdout.flush()
2012-07-31 11:03:44 +02:00
2019-05-06 00:54:21 +02:00
def filterNone(values): # Cross-referenced function
return [_ for _ in values if _] if isinstance(values, _collections.Iterable) else values
2019-05-06 00:54:21 +02:00
def isListLike(value): # Cross-referenced function
2019-06-26 11:02:43 +02:00
return isinstance(value, (list, tuple, set, BigArray))
2019-05-06 00:54:21 +02:00
2019-05-21 14:18:14 +02:00
def shellExec(cmd): # Cross-referenced function
raise NotImplementedError
def jsonize(data):
2013-03-11 14:58:05 +01:00
"""
Returns JSON serialized data
>>> jsonize({'foo':'bar'})
'{\\n "foo": "bar"\\n}'
"""
return json.dumps(data, sort_keys=False, indent=4)
def dejsonize(data):
2013-03-11 14:58:05 +01:00
"""
Returns JSON deserialized data
2019-05-02 16:54:54 +02:00
>>> dejsonize('{\\n "foo": "bar"\\n}') == {u'foo': u'bar'}
True
2013-03-11 14:58:05 +01:00
"""
return json.loads(data)
2019-05-03 13:20:15 +02:00
def decodeHex(value, binary=True):
"""
2025-11-06 11:41:35 +01:00
Returns a decoded representation of the provided hexadecimal value
2019-05-03 13:20:15 +02:00
>>> decodeHex("313233") == b"123"
True
>>> decodeHex("313233", binary=False) == u"123"
True
"""
retVal = value
if isinstance(value, six.binary_type):
2019-05-06 00:54:21 +02:00
value = getText(value)
2019-05-03 13:20:15 +02:00
if value.lower().startswith("0x"):
value = value[2:]
2019-05-08 12:28:50 +02:00
try:
retVal = codecs.decode(value, "hex")
except LookupError:
retVal = binascii.unhexlify(value)
2019-05-03 13:20:15 +02:00
if not binary:
retVal = getText(retVal)
return retVal
def encodeHex(value, binary=True):
"""
2025-11-06 11:41:35 +01:00
Returns an encoded representation of the provided value
2019-05-03 13:20:15 +02:00
>>> encodeHex(b"123") == b"313233"
True
>>> encodeHex("123", binary=False)
'313233'
2019-07-04 11:18:55 +02:00
>>> encodeHex(b"123"[0]) == b"31"
True
2025-12-28 00:58:30 +01:00
>>> encodeHex(123, binary=False)
'7b'
2019-05-03 13:20:15 +02:00
"""
2019-07-04 11:18:55 +02:00
if isinstance(value, int):
2025-12-28 00:58:30 +01:00
value = six.int2byte(value)
2019-07-04 11:18:55 +02:00
2019-05-03 13:20:15 +02:00
if isinstance(value, six.text_type):
value = value.encode(UNICODE_ENCODING)
2019-05-08 12:28:50 +02:00
try:
retVal = codecs.encode(value, "hex")
except LookupError:
retVal = binascii.hexlify(value)
2019-05-03 13:20:15 +02:00
if not binary:
retVal = getText(retVal)
return retVal
2019-09-16 19:29:38 +02:00
def decodeBase64(value, binary=True, encoding=None):
2019-05-03 13:20:15 +02:00
"""
Returns a decoded representation of provided Base64 value
>>> decodeBase64("MTIz") == b"123"
True
>>> decodeBase64("MTIz", binary=False)
'123'
2020-08-10 22:26:03 +02:00
>>> decodeBase64("A-B_CDE") == decodeBase64("A+B/CDE")
2020-08-10 21:54:58 +02:00
True
2020-07-01 11:56:24 +02:00
>>> decodeBase64(b"MTIzNA") == b"1234"
True
>>> decodeBase64("MTIzNA") == b"1234"
True
>>> decodeBase64("MTIzNA==") == b"1234"
True
2019-05-03 13:20:15 +02:00
"""
2020-08-10 21:54:58 +02:00
if value is None:
return None
2020-07-01 11:56:24 +02:00
padding = b'=' if isinstance(value, bytes) else '='
# Reference: https://stackoverflow.com/a/49459036
if not value.endswith(padding):
value += 3 * padding
2020-08-10 21:54:58 +02:00
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
# Reference: https://perldoc.perl.org/MIME/Base64.html
if isinstance(value, bytes):
value = value.replace(b'-', b'+').replace(b'_', b'/')
else:
value = value.replace('-', '+').replace('_', '/')
2019-05-03 13:20:15 +02:00
retVal = base64.b64decode(value)
if not binary:
2019-09-16 19:29:38 +02:00
retVal = getText(retVal, encoding)
2019-05-03 13:20:15 +02:00
return retVal
2020-08-10 22:26:03 +02:00
def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False):
2019-05-03 13:20:15 +02:00
"""
2025-11-06 11:41:35 +01:00
Returns a Base64 encoded representation of the provided value
2019-05-03 13:20:15 +02:00
>>> encodeBase64(b"123") == b"MTIz"
True
2020-08-10 21:54:58 +02:00
>>> encodeBase64(u"1234", binary=False)
'MTIzNA=='
>>> encodeBase64(u"1234", binary=False, padding=False)
'MTIzNA'
2020-08-10 22:26:03 +02:00
>>> encodeBase64(decodeBase64("A-B_CDE"), binary=False, safe=True)
'A-B_CDE'
2019-05-03 13:20:15 +02:00
"""
2020-08-10 21:54:58 +02:00
if value is None:
return None
2019-05-03 13:20:15 +02:00
if isinstance(value, six.text_type):
2019-09-16 19:29:38 +02:00
value = value.encode(encoding or UNICODE_ENCODING)
2019-05-03 13:20:15 +02:00
retVal = base64.b64encode(value)
if not binary:
2019-09-16 19:29:38 +02:00
retVal = getText(retVal, encoding)
2019-05-03 13:20:15 +02:00
2020-08-10 22:26:03 +02:00
if safe:
padding = False
# Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
# Reference: https://perldoc.perl.org/MIME/Base64.html
if isinstance(retVal, bytes):
retVal = retVal.replace(b'+', b'-').replace(b'/', b'_')
else:
retVal = retVal.replace('+', '-').replace('/', '_')
2020-08-10 21:54:58 +02:00
if not padding:
retVal = retVal.rstrip(b'=' if isinstance(retVal, bytes) else '=')
2019-05-03 13:20:15 +02:00
return retVal
2020-01-09 11:59:50 +01:00
def getBytes(value, encoding=None, errors="strict", unsafe=True):
2019-05-03 13:20:15 +02:00
"""
Returns byte representation of provided Unicode value
>>> getBytes(u"foo\\\\x01\\\\x83\\\\xffbar") == b"foo\\x01\\x83\\xffbar"
True
"""
retVal = value
2020-01-09 11:59:50 +01:00
if encoding is None:
2020-01-15 22:47:06 +01:00
encoding = conf.get("encoding") or UNICODE_ENCODING
2020-01-09 11:59:50 +01:00
2019-11-30 23:10:20 +01:00
try:
codecs.lookup(encoding)
2020-01-09 11:59:50 +01:00
except (LookupError, TypeError):
2019-11-30 23:10:20 +01:00
encoding = UNICODE_ENCODING
2026-01-04 23:39:28 +01:00
if isinstance(value, bytearray):
return bytes(value)
elif isinstance(value, memoryview):
return value.tobytes()
elif isinstance(value, six.text_type):
2019-05-03 13:20:15 +02:00
if INVALID_UNICODE_PRIVATE_AREA:
if unsafe:
for char in xrange(0xF0000, 0xF00FF + 1):
2019-05-15 10:57:22 +02:00
value = value.replace(_unichr(char), "%s%02x" % (SAFE_HEX_MARKER, char - 0xF0000))
2019-05-03 13:20:15 +02:00
retVal = value.encode(encoding, errors)
if unsafe:
2025-11-06 11:14:13 +01:00
retVal = re.sub((r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER).encode(), lambda _: decodeHex(_.group(1)), retVal)
2019-05-03 13:20:15 +02:00
else:
2020-05-27 15:39:03 +02:00
try:
retVal = value.encode(encoding, errors)
except UnicodeError:
retVal = value.encode(UNICODE_ENCODING, errors="replace")
if unsafe:
retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
2019-05-03 13:20:15 +02:00
return retVal
def getOrds(value):
"""
Returns ORD(...) representation of provided string value
>>> getOrds(u'fo\\xf6bar')
[102, 111, 246, 98, 97, 114]
>>> getOrds(b"fo\\xc3\\xb6bar")
[102, 111, 195, 182, 98, 97, 114]
"""
return [_ if isinstance(_, int) else ord(_) for _ in value]
2019-05-06 00:54:21 +02:00
def getUnicode(value, encoding=None, noneToNull=False):
"""
Returns the unicode representation of the supplied value
2019-05-06 00:54:21 +02:00
>>> getUnicode('test') == u'test'
True
>>> getUnicode(1) == u'1'
True
2021-01-05 14:50:54 +01:00
>>> getUnicode(None) == 'None'
True
2025-12-31 10:35:40 +01:00
>>> getUnicode(b'/etc/passwd') == '/etc/passwd'
True
2019-05-06 00:54:21 +02:00
"""
2023-09-28 20:34:52 +02:00
# Best position for --time-limit mechanism
if conf.get("timeLimit") and kb.get("startTime") and (time.time() - kb.startTime > conf.timeLimit):
raise SystemExit
2019-05-06 00:54:21 +02:00
if noneToNull and value is None:
return NULL
if isinstance(value, six.text_type):
return value
elif isinstance(value, six.binary_type):
# Heuristics (if encoding not explicitly specified)
candidates = filterNone((encoding, kb.get("pageEncoding") if kb.get("originalPage") else None, conf.get("encoding"), UNICODE_ENCODING, sys.getfilesystemencoding()))
if all(_ in value for _ in (b'<', b'>')):
pass
2025-12-31 10:35:40 +01:00
elif b'\n' not in value and re.search(r"(?i)\w+\.\w{2,3}\Z|\A(\w:\\|/\w+)", six.text_type(value, UNICODE_ENCODING, errors="ignore")):
2019-05-06 00:54:21 +02:00
candidates = filterNone((encoding, sys.getfilesystemencoding(), kb.get("pageEncoding") if kb.get("originalPage") else None, UNICODE_ENCODING, conf.get("encoding")))
elif conf.get("encoding") and b'\n' not in value:
candidates = filterNone((encoding, conf.get("encoding"), kb.get("pageEncoding") if kb.get("originalPage") else None, sys.getfilesystemencoding(), UNICODE_ENCODING))
for candidate in candidates:
try:
return six.text_type(value, candidate)
2020-01-08 00:11:13 +01:00
except (UnicodeDecodeError, LookupError):
2019-05-06 00:54:21 +02:00
pass
try:
return six.text_type(value, encoding or (kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING)
except UnicodeDecodeError:
return six.text_type(value, UNICODE_ENCODING, errors="reversible")
elif isListLike(value):
value = list(getUnicode(_, encoding, noneToNull) for _ in value)
return value
else:
try:
return six.text_type(value)
except UnicodeDecodeError:
return six.text_type(str(value), errors="ignore") # encoding ignored for non-basestring instances
2019-09-16 19:29:38 +02:00
def getText(value, encoding=None):
2019-05-03 13:20:15 +02:00
"""
Returns textual value of a given value (Note: not necessary Unicode on Python2)
>>> getText(b"foobar")
'foobar'
>>> isinstance(getText(u"fo\\u2299bar"), six.text_type)
True
"""
retVal = value
if isinstance(value, six.binary_type):
2019-09-16 19:29:38 +02:00
retVal = getUnicode(value, encoding)
2019-05-03 13:20:15 +02:00
if six.PY2:
try:
retVal = str(retVal)
except:
pass
return retVal
2019-05-25 00:22:27 +02:00
def stdoutEncode(value):
"""
2025-12-31 11:04:12 +01:00
Returns textual representation of a given value safe for writing to stdout
>>> stdoutEncode(b"foobar")
'foobar'
2019-05-25 00:22:27 +02:00
"""
2025-12-31 11:04:12 +01:00
if value is None:
value = ""
2019-05-25 00:22:27 +02:00
if IS_WIN and IS_TTY and kb.get("codePage", -1) is None:
output = shellExec("chcp")
match = re.search(r": (\d{3,})", output or "")
if match:
try:
candidate = "cp%s" % match.group(1)
codecs.lookup(candidate)
kb.codePage = candidate
2025-12-31 11:04:12 +01:00
except (LookupError, TypeError):
pass
2019-05-25 00:22:27 +02:00
kb.codePage = kb.codePage or ""
2025-12-31 11:04:12 +01:00
encoding = kb.get("codePage") or getattr(sys.stdout, "encoding", None) or UNICODE_ENCODING
2019-05-25 00:22:27 +02:00
2025-12-31 11:04:12 +01:00
if six.PY3:
if isinstance(value, (bytes, bytearray)):
value = getUnicode(value, encoding)
elif not isinstance(value, str):
value = str(value)
2019-05-25 00:22:27 +02:00
2025-12-31 11:04:12 +01:00
try:
retVal = value.encode(encoding, errors="replace").decode(encoding, errors="replace")
except (LookupError, TypeError):
retVal = value.encode("ascii", errors="replace").decode("ascii", errors="replace")
2019-05-25 00:22:27 +02:00
else:
2025-12-31 11:04:12 +01:00
if isinstance(value, six.text_type):
try:
retVal = value.encode(encoding, errors="replace")
except (LookupError, TypeError):
retVal = value.encode("ascii", errors="replace")
else:
retVal = value
2019-05-25 00:22:27 +02:00
return retVal
def getConsoleLength(value):
"""
Returns console width of unicode values
>>> getConsoleLength("abc")
3
>>> getConsoleLength(u"\\u957f\\u6c5f")
4
"""
if isinstance(value, six.text_type):
2025-12-25 22:15:06 +01:00
retVal = len(value) + sum(ord(_) >= 0x3000 for _ in value)
else:
retVal = len(value)
2019-11-30 23:10:20 +01:00
return retVal