MORPH
SIGN IN SIGN UP
sqlmapproject / sqlmap UNCLAIMED

Automatic SQL injection and database takeover tool

36950 0 0 Python
Normal View History Raw
Last preparations for DREI
2019-05-08 12:47:52 +02:00
#!/usr/bin/env python
After the storm, a restore..
2008-10-15 15:38:22 +00:00
"""
Year bump
2026-01-01 19:12:07 +01:00
Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
Replacing doc/COPYING to LICENSE
2017-10-11 14:50:46 +02:00
See the file 'LICENSE' for copying permission
After the storm, a restore..
2008-10-15 15:38:22 +00:00
"""
getting rid of obsolete getCompiledRegex (in newer versions of Python regexes are already cached)
2012-04-03 14:34:15 +00:00
import re
After the storm, a restore..
2008-10-15 15:38:22 +00:00
from xml.sax.handler import ContentHandler
refactoring (class names should always be Capital cased)
2011-01-28 16:36:09 +00:00
from lib.core.common import Backend
some code refactoring
2010-04-16 19:57:00 +00:00
from lib.core.common import parseXmlFile
After the storm, a restore..
2008-10-15 15:38:22 +00:00
from lib.core.common import sanitizeStr
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
from lib.core.data import kb
from lib.core.data import paths
further refactoring (all enumerations are now put into enums.py)
2010-11-08 09:20:02 +00:00
from lib.core.enums import DBMS
Minor enhancement to fingerprint the web server operating system and the web application technology by parsing also HTTP response Server header. Refactor libraries and plugins that parses XML to fingerprint and show on standard output the information. Updated changelog.
2008-11-18 17:42:46 +00:00
from lib.parse.handler import FingerprintHandler
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
class MSSQLBannerHandler(ContentHandler):
"""
This class defines methods to parse and extract information from the
given Microsoft SQL Server banner based upon the data in XML file
"""
Updated to sqlmap 0.7 release candidate 1
2009-04-22 11:48:07 +00:00
def __init__(self, banner, info):
code reviewing part 2
2011-01-15 12:53:40 +00:00
ContentHandler.__init__(self)
Fixes #4510
2021-01-05 13:36:04 +01:00
self._banner = sanitizeStr(banner or "")
some more refactoring
2012-02-16 13:46:01 +00:00
self._inVersion = False
self._inServicePack = False
self._release = None
self._version = ""
self._versionAlt = None
self._servicePack = ""
self._info = info
def _feedInfo(self, key, value):
Major enhancement to the engine to parse XML files and matches on DBMS banner and HTTP response headers. Initial web application technology fingerprint (for the moment based only on X-Powered-By HTTP response header and not shown yet to the user). Minor layout adjustments.
2008-11-17 17:41:02 +00:00
value = sanitizeStr(value)
Minor style update (for the sake of consistency over the code and our PEP8 adaptation)
2013-01-09 15:38:41 +01:00
if value in (None, "None"):
Major enhancement to the engine to parse XML files and matches on DBMS banner and HTTP response headers. Initial web application technology fingerprint (for the moment based only on X-Powered-By HTTP response header and not shown yet to the user). Minor layout adjustments.
2008-11-17 17:41:02 +00:00
return
some more refactoring
2012-02-16 13:46:01 +00:00
self._info[key] = value
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
After the storm, a restore..
2008-10-15 15:38:22 +00:00
def startElement(self, name, attrs):
if name == "signatures":
some more refactoring
2012-02-16 13:46:01 +00:00
self._release = sanitizeStr(attrs.get("release"))
After the storm, a restore..
2008-10-15 15:38:22 +00:00
elif name == "version":
some more refactoring
2012-02-16 13:46:01 +00:00
self._inVersion = True
After the storm, a restore..
2008-10-15 15:38:22 +00:00
elif name == "servicepack":
some more refactoring
2012-02-16 13:46:01 +00:00
self._inServicePack = True
After the storm, a restore..
2008-10-15 15:38:22 +00:00
Further pleasing the pylint gods
2019-05-30 22:40:51 +02:00
def characters(self, content):
some more refactoring
2012-02-16 13:46:01 +00:00
if self._inVersion:
Further pleasing the pylint gods
2019-05-30 22:40:51 +02:00
self._version += sanitizeStr(content)
some more refactoring
2012-02-16 13:46:01 +00:00
elif self._inServicePack:
Further pleasing the pylint gods
2019-05-30 22:40:51 +02:00
self._servicePack += sanitizeStr(content)
After the storm, a restore..
2008-10-15 15:38:22 +00:00
def endElement(self, name):
if name == "signature":
some more refactoring
2012-02-16 13:46:01 +00:00
for version in (self._version, self._versionAlt):
Fixes #4510
2021-01-05 13:36:04 +01:00
if version and self._banner and re.search(r" %s[\.\ ]+" % re.escape(version), self._banner):
some more refactoring
2012-02-16 13:46:01 +00:00
self._feedInfo("dbmsRelease", self._release)
self._feedInfo("dbmsVersion", self._version)
self._feedInfo("dbmsServicePack", self._servicePack)
fix for that banner fetching issue reported by Daniel Huckmann
2010-03-01 10:33:36 +00:00
break
After the storm, a restore..
2008-10-15 15:38:22 +00:00
some more refactoring
2012-02-16 13:46:01 +00:00
self._version = ""
self._versionAlt = None
self._servicePack = ""
After the storm, a restore..
2008-10-15 15:38:22 +00:00
elif name == "version":
some more refactoring
2012-02-16 13:46:01 +00:00
self._inVersion = False
self._version = self._version.replace(" ", "")
introducing regex caching mechanism
2010-05-21 14:42:59 +00:00
getting rid of obsolete getCompiledRegex (in newer versions of Python regexes are already cached)
2012-04-03 14:34:15 +00:00
match = re.search(r"\A(?P<major>\d+)\.00\.(?P<build>\d+)\Z", self._version)
some more refactoring
2012-02-16 13:46:01 +00:00
self._versionAlt = "%s.0.%s.0" % (match.group('major'), match.group('build')) if match else None
After the storm, a restore..
2008-10-15 15:38:22 +00:00
elif name == "servicepack":
some more refactoring
2012-02-16 13:46:01 +00:00
self._inServicePack = False
self._servicePack = self._servicePack.replace(" ", "")
After the storm, a restore..
2008-10-15 15:38:22 +00:00
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
def bannerParser(banner):
After the storm, a restore..
2008-10-15 15:38:22 +00:00
"""
This function calls a class to extract information from the given
DBMS banner based upon the data in XML file
"""
Initial support for SQLite (90% approx). Initial support for Firebird (30% approx). Initial support for Access (10% approx). Shared libraries code/installation scripts ported to 64bit, directory structure adapted. Minor code adjustments.
2010-03-18 17:20:54 +00:00
xmlfile = None
important update regarding (Bug #209) - probably more will be needed
2010-10-29 16:11:50 +00:00
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
if Backend.isDbms(DBMS.MSSQL):
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
xmlfile = paths.MSSQL_XML
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
elif Backend.isDbms(DBMS.MYSQL):
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
xmlfile = paths.MYSQL_XML
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
elif Backend.isDbms(DBMS.ORACLE):
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
xmlfile = paths.ORACLE_XML
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
elif Backend.isDbms(DBMS.PGSQL):
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
xmlfile = paths.PGSQL_XML
Initial support for SQLite (90% approx). Initial support for Firebird (30% approx). Initial support for Access (10% approx). Shared libraries code/installation scripts ported to 64bit, directory structure adapted. Minor code adjustments.
2010-03-18 17:20:54 +00:00
if not xmlfile:
return
important update regarding (Bug #209) - probably more will be needed
2010-10-29 16:11:50 +00:00
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
if Backend.isDbms(DBMS.MSSQL):
Updated to sqlmap 0.7 release candidate 1
2009-04-22 11:48:07 +00:00
handler = MSSQLBannerHandler(banner, kb.bannerFp)
some code refactoring
2010-04-16 19:57:00 +00:00
parseXmlFile(xmlfile, handler)
Minor enhancement to fingerprint the web server operating system and the web application technology by parsing also HTTP response Server header. Refactor libraries and plugins that parses XML to fingerprint and show on standard output the information. Updated changelog.
2008-11-18 17:42:46 +00:00
handler = FingerprintHandler(banner, kb.bannerFp)
some code refactoring
2010-04-16 19:57:00 +00:00
parseXmlFile(paths.GENERIC_XML, handler)
Minor enhancement to fingerprint the back-end DBMS operating system (type, version, release, distribution, codename and service pack) by parsing the DBMS banner value when both -f and -b are provided: adapted the code and added XML files defining regular expressions for matching. Example of the -f -b output now on MySQL 5.0.67 running on latest Ubuntu: --8<-- back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 comment injection fingerprint: MySQL 5.0.67 banner parsing fingerprint: MySQL 5.0.67 html error message fingerprint: MySQL back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid) --8<--
2008-11-15 23:41:31 +00:00
else:
Minor enhancement to fingerprint the web server operating system and the web application technology by parsing also HTTP response Server header. Refactor libraries and plugins that parses XML to fingerprint and show on standard output the information. Updated changelog.
2008-11-18 17:42:46 +00:00
handler = FingerprintHandler(banner, kb.bannerFp)
some code refactoring
2010-04-16 19:57:00 +00:00
parseXmlFile(xmlfile, handler)
parseXmlFile(paths.GENERIC_XML, handler)
Reference in New Issue Copy Permalink