Morph MORPH
SIGN IN SIGN UP
sqlmapproject / sqlmap UNCLAIMED

Automatic SQL injection and database takeover tool

0 0 4 Python
Normal View History Raw
Update regarding #2940 (PEP 394)
2019-03-21 14:00:09 +01:00
#!/usr/bin/env python2
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
"""
update_copyright_year()
2019-01-05 21:38:52 +01:00
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
Replacing doc/COPYING to LICENSE
2017-10-11 14:50:46 +02:00
See the file 'LICENSE' for copying permission
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
"""
Added support to directly connect also to Microsoft SQL Server database. Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output). Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods. Forced conf.timeout to 10 seconds when directly connecting to database. Slightly improved regular expression to parse -d parameter. Added import check for all connectors' third-party libraries. Code refactoring: * Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed). * Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
import os
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
from lib.core.data import conf
from lib.core.data import logger
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
from lib.core.exception import SqlmapFilePathException
from lib.core.exception import SqlmapUndefinedMethod
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
class Connector:
"""
This class defines generic dbms protocol functionalities for plugins.
"""
def __init__(self):
self.connector = None
self.cursor = None
Fixes #3357
2018-11-04 14:36:38 +01:00
self.hostname = None
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
def initConnection(self):
Fixes #2598
2017-07-03 14:17:11 +02:00
self.user = conf.dbmsUser or ""
self.password = conf.dbmsPass or ""
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
self.hostname = conf.hostname
self.port = conf.port
self.db = conf.dbmsDb
Code restyling
2013-04-15 14:31:27 +02:00
def printConnected(self):
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname)
infoMsg += ":%d established" % self.port
logger.info(infoMsg)
removed all trailing spaces from blank lines
2010-11-03 10:08:27 +00:00
added support for reusing connections
2010-03-30 13:52:47 +00:00
def closed(self):
Fixes #3357
2018-11-04 14:36:38 +01:00
if self.hostname:
infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname)
infoMsg += ":%d closed" % self.port
logger.info(infoMsg)
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
Added support to directly connect also to Microsoft SQL Server database. Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output). Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods. Forced conf.timeout to 10 seconds when directly connecting to database. Slightly improved regular expression to parse -d parameter. Added import check for all connectors' third-party libraries. Code refactoring: * Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed). * Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
self.connector = None
self.cursor = None
Better naming
2013-01-18 11:21:23 +01:00
def initCursor(self):
Added support to directly connect also to Microsoft SQL Server database. Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output). Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods. Forced conf.timeout to 10 seconds when directly connecting to database. Slightly improved regular expression to parse -d parameter. Added import check for all connectors' third-party libraries. Code refactoring: * Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed). * Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
self.cursor = self.connector.cursor()
def close(self):
minor fix
2012-01-20 00:11:19 +00:00
try:
Introducing lib/utils/sqlalchemy.py (Issue #361)
2013-04-15 10:33:25 +02:00
if self.cursor:
self.cursor.close()
if self.connector:
self.connector.close()
Update related to the last commit
2019-01-22 01:20:27 +01:00
except Exception as ex:
logger.debug(ex)
minor fix
2012-01-20 00:11:19 +00:00
finally:
self.closed()
Added support to directly connect also to Microsoft SQL Server database. Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output). Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods. Forced conf.timeout to 10 seconds when directly connecting to database. Slightly improved regular expression to parse -d parameter. Added import check for all connectors' third-party libraries. Code refactoring: * Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed). * Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
def checkFileDb(self):
if not os.path.exists(self.db):
errMsg = "the provided database file '%s' does not exist" % self.db
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapFilePathException(errMsg)
Added support to directly connect also to Microsoft SQL Server database. Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output). Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods. Forced conf.timeout to 10 seconds when directly connecting to database. Slightly improved regular expression to parse -d parameter. Added import check for all connectors' third-party libraries. Code refactoring: * Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed). * Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
def connect(self):
Minor code restyling
2011-04-30 13:20:05 +00:00
errMsg = "'connect' method must be defined "
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
errMsg += "into the specific DBMS plugin"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapUndefinedMethod(errMsg)
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
def fetchall(self):
Minor code restyling
2011-04-30 13:20:05 +00:00
errMsg = "'fetchall' method must be defined "
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
errMsg += "into the specific DBMS plugin"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapUndefinedMethod(errMsg)
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
def execute(self, query):
Minor code restyling
2011-04-30 13:20:05 +00:00
errMsg = "'execute' method must be defined "
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
errMsg += "into the specific DBMS plugin"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapUndefinedMethod(errMsg)
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
def select(self, query):
Minor code restyling
2011-04-30 13:20:05 +00:00
errMsg = "'select' method must be defined "
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-26 23:23:25 +00:00
errMsg += "into the specific DBMS plugin"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapUndefinedMethod(errMsg)
Reference in New Issue Copy Permalink