Morph MORPH
SIGN IN SIGN UP
sqlmapproject / sqlmap UNCLAIMED

Automatic SQL injection and database takeover tool

0 0 5 Python
Normal View History Raw
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
#!/usr/bin/env python
"""
updated copyright
2013-01-18 14:07:51 +00:00
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
See the file 'doc/COPYING' for copying permission
"""
import time
code refactoring
2010-11-23 21:00:42 +00:00
from lib.core.common import clearConsoleLine
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.common import dataToStdout
basic --search now works with MS Access
2010-12-26 23:50:16 +00:00
from lib.core.common import filterListValue
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.common import getFileItems
refactoring (class names should always be Capital cased)
2011-01-28 16:36:09 +00:00
from lib.core.common import Backend
minor beautification (WordsSet is considered as a bad english)
2011-06-18 15:47:19 +00:00
from lib.core.common import getPageWordSet
added helper function for HashDB data storing/retrieval
2012-02-24 13:07:20 +00:00
from lib.core.common import hashDBWrite
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.common import randomInt
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
from lib.core.common import randomStr
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.common import safeStringFormat
refactoring, cleanup and improvement
2011-03-29 21:54:15 +00:00
from lib.core.common import safeSQLIdentificatorNaming
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.data import conf
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
from lib.core.data import kb
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
from lib.core.data import logger
minor improvement
2010-12-26 11:15:02 +00:00
from lib.core.enums import DBMS
some refactoring
2011-12-28 13:50:03 +00:00
from lib.core.enums import HASHDB_KEYS
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
from lib.core.exception import SqlmapDataException
from lib.core.exception import SqlmapMissingMandatoryOptionException
blind dumping of tables in sqlite implemented
2010-12-11 22:13:19 +00:00
from lib.core.settings import METADB_SUFFIX
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
from lib.core.settings import BRUTE_COLUMN_EXISTS_TEMPLATE
from lib.core.settings import BRUTE_TABLE_EXISTS_TEMPLATE
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
from lib.core.threads import getCurrentThreadData
from lib.core.threads import runThreads
update
2010-12-08 22:14:42 +00:00
from lib.request import inject
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
def _addPageTextWords():
Use getPageTextWordsSet() also in --common-columns
2011-06-18 12:30:26 +00:00
wordsList = []
Minor code cleanup
2011-02-08 00:02:54 +00:00
minor update
2010-12-26 09:40:40 +00:00
infoMsg = "adding words used on web page to the check list"
getPageTextWordsSet on tableExists is pretty powerful stuff
2010-12-25 09:37:33 +00:00
logger.info(infoMsg)
minor beautification (WordsSet is considered as a bad english)
2011-06-18 15:47:19 +00:00
pageWords = getPageWordSet(kb.originalPage)
Mere cosmetics
2011-01-07 16:36:32 +00:00
getPageTextWordsSet on tableExists is pretty powerful stuff
2010-12-25 09:37:33 +00:00
for word in pageWords:
minor update (to prevent adding too much items)
2010-12-25 10:42:36 +00:00
word = word.lower()
Mere cosmetics
2011-01-07 16:36:32 +00:00
Use getPageTextWordsSet() also in --common-columns
2011-06-18 12:30:26 +00:00
if len(word) > 2 and not word[0].isdigit() and word not in wordsList:
wordsList.append(word)
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Use getPageTextWordsSet() also in --common-columns
2011-06-18 12:30:26 +00:00
return wordsList
def tableExists(tableFile, regex=None):
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), randomStr())))
if result:
errMsg = "can't use table existence check because of detected invalid results "
errMsg += "(most probably caused by inability of the used injection "
errMsg += "to distinguish errornous results)"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapDataException(errMsg)
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
minor fix
2012-06-15 20:49:28 +00:00
tables = getFileItems(tableFile, lowercase=Backend.getIdentifiedDbms() in (DBMS.ACCESS,), unique=True)
Use getPageTextWordsSet() also in --common-columns
2011-06-18 12:30:26 +00:00
infoMsg = "checking table existence using items from '%s'" % tableFile
logger.info(infoMsg)
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
tables.extend(_addPageTextWords())
basic --search now works with MS Access
2010-12-26 23:50:16 +00:00
tables = filterListValue(tables, regex)
more refactoring
2011-06-07 10:08:12 +00:00
threadData = getCurrentThreadData()
threadData.shared.count = 0
threadData.shared.limit = len(tables)
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
threadData.shared.value = []
more refactoring
2011-06-07 10:08:12 +00:00
threadData.shared.unique = set()
removed some blank trailing spaces (with extra/shutils/blanks.sh)
2010-12-21 10:31:56 +00:00
minor update
2010-12-20 23:21:01 +00:00
def tableExistsThread():
more refactoring
2011-06-07 10:08:12 +00:00
threadData = getCurrentThreadData()
while kb.threadContinue:
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.acquire()
more refactoring
2011-06-07 10:08:12 +00:00
if threadData.shared.count < threadData.shared.limit:
some fixes
2011-06-16 14:27:44 +00:00
table = safeSQLIdentificatorNaming(tables[threadData.shared.count], True)
more refactoring
2011-06-07 10:08:12 +00:00
threadData.shared.count += 1
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.release()
more refactoring
2011-06-07 10:08:12 +00:00
else:
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.release()
more refactoring
2011-06-07 10:08:12 +00:00
break
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
big bug fix
2011-05-30 23:15:29 +00:00
if conf.db and METADB_SUFFIX not in conf.db:
one more commit related to the previous one
2011-02-09 17:07:02 +00:00
fullTableName = "%s%s%s" % (conf.db, '..' if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) else '.', table)
resume of brute forced data is now available
2010-12-27 14:17:20 +00:00
else:
fullTableName = table
Mere cosmetics
2011-01-07 16:36:32 +00:00
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), fullTableName)))
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.io.acquire()
Mere cosmetics
2011-01-07 16:36:32 +00:00
more refactoring
2011-06-07 10:08:12 +00:00
if result and table.lower() not in threadData.shared.unique:
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
threadData.shared.value.append(table)
more refactoring
2011-06-07 10:08:12 +00:00
threadData.shared.unique.add(table.lower())
better one for previous commit
2011-04-10 21:52:08 +00:00
minor update
2010-12-20 23:21:01 +00:00
if conf.verbose in (1, 2):
clearConsoleLine(True)
update regarding safe character output together with a small fix for newlines
2011-04-14 09:31:45 +00:00
infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), table)
minor update
2010-12-20 23:21:01 +00:00
dataToStdout(infoMsg, True)
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Minor bug fix to respect -v value in --common-tables and --common-columns
2010-12-13 21:37:12 +00:00
if conf.verbose in (1, 2):
Minor style update
2013-01-09 16:10:26 +01:00
status = '%d/%d items (%d%%)' % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit))
More refactoring and cleanup
2011-01-16 00:15:30 +00:00
dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True)
Mere cosmetics
2011-01-07 16:36:32 +00:00
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.io.release()
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
minor update
2010-12-20 23:21:01 +00:00
try:
more refactoring
2011-06-07 10:08:12 +00:00
runThreads(conf.threads, tableExistsThread, threadChoice=True)
Mere cosmetics
2011-01-07 16:36:32 +00:00
minor update
2010-12-20 23:21:01 +00:00
except KeyboardInterrupt:
more refactoring
2011-06-07 10:08:12 +00:00
warnMsg = "user aborted during table existence "
warnMsg += "check. sqlmap will display partial output"
Added one more warning message to show what's going on with ctrl+c
2011-03-31 14:26:14 +00:00
logger.warn(warnMsg)
code refactoring
2010-11-23 21:00:42 +00:00
clearConsoleLine(True)
More refactoring and cleanup
2011-01-16 00:15:30 +00:00
dataToStdout("\n")
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
if not threadData.shared.value:
better language
2011-05-30 23:04:49 +00:00
warnMsg = "no table(s) found"
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
logger.warn(warnMsg)
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
else:
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
for item in threadData.shared.value:
Minor refactoring
2012-07-14 11:01:30 +02:00
if conf.db not in kb.data.cachedTables:
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
kb.data.cachedTables[conf.db] = [item]
else:
kb.data.cachedTables[conf.db].append(item)
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Minor refactoring
2013-01-10 16:09:28 +01:00
for _ in ((conf.db, item) for item in threadData.shared.value):
some refactoring
2011-12-28 13:50:03 +00:00
if _ not in kb.brute.tables:
kb.brute.tables.append(_)
added helper function for HashDB data storing/retrieval
2012-02-24 13:07:20 +00:00
hashDBWrite(HASHDB_KEYS.KB_BRUTE_TABLES, kb.brute.tables, True)
some refactoring
2011-12-28 13:50:03 +00:00
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
return kb.data.cachedTables
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
basic --search now works with MS Access
2010-12-26 23:50:16 +00:00
def columnExists(columnFile, regex=None):
update regarding brute force retrieval of table names and table column names
2010-11-09 16:15:55 +00:00
if not conf.tbl:
errMsg = "missing table parameter"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapMissingMandatoryOptionException(errMsg)
update regarding brute force retrieval of table names and table column names
2010-11-09 16:15:55 +00:00
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (randomStr(), randomStr())))
if result:
errMsg = "can't use column existence check because of detected invalid results "
errMsg += "(most probably caused by inability of the used injection "
errMsg += "to distinguish errornous results)"
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
raise SqlmapDataException(errMsg)
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
Use getPageTextWordsSet() also in --common-columns
2011-06-18 12:30:26 +00:00
infoMsg = "checking column existence using items from '%s'" % columnFile
logger.info(infoMsg)
minor improvement
2010-12-26 11:15:02 +00:00
columns = getFileItems(columnFile, unique=True)
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
columns.extend(_addPageTextWords())
basic --search now works with MS Access
2010-12-26 23:50:16 +00:00
columns = filterListValue(columns, regex)
Fix for an Issue #263
2012-11-28 00:03:17 +01:00
table = safeSQLIdentificatorNaming(conf.tbl, True)
big bug fix
2011-05-30 23:15:29 +00:00
if conf.db and METADB_SUFFIX not in conf.db:
Fix for an Issue #263
2012-11-28 00:03:17 +01:00
table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table)
minor update
2010-11-11 22:26:36 +00:00
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
kb.threadContinue = True
fix for those ugly DEBUG messages in brute mode
2011-04-08 11:02:21 +00:00
kb.bruteMode = True
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
threadData = getCurrentThreadData()
threadData.shared.count = 0
threadData.shared.limit = len(columns)
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
threadData.shared.value = []
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
def columnExistsThread():
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
threadData = getCurrentThreadData()
while kb.threadContinue:
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.acquire()
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
if threadData.shared.count < threadData.shared.limit:
column = safeSQLIdentificatorNaming(columns[threadData.shared.count])
threadData.shared.count += 1
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.release()
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
else:
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.count.release()
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
break
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table)))
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.io.acquire()
Mere cosmetics
2011-01-07 16:36:32 +00:00
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
if result:
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
threadData.shared.value.append(column)
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
if conf.verbose in (1, 2):
clearConsoleLine(True)
update regarding safe character output together with a small fix for newlines
2011-04-14 09:31:45 +00:00
infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), column)
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
dataToStdout(infoMsg, True)
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Minor bug fix to respect -v value in --common-tables and --common-columns
2010-12-13 21:37:12 +00:00
if conf.verbose in (1, 2):
Minor style update
2013-01-09 16:10:26 +01:00
status = '%d/%d items (%d%%)' % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit))
More refactoring and cleanup
2011-01-16 00:15:30 +00:00
dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True)
Mere cosmetics
2011-01-07 16:36:32 +00:00
some refactoring
2011-12-28 16:27:17 +00:00
kb.locks.io.release()
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
try:
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
runThreads(conf.threads, columnExistsThread, threadChoice=True)
Mere cosmetics
2011-01-07 16:36:32 +00:00
well, here and there, merry Christmas to all :)
2010-12-24 20:17:53 +00:00
except KeyboardInterrupt:
refactoring and stabilization of multithreading
2011-06-07 09:50:00 +00:00
warnMsg = "user aborted during column existence "
warnMsg += "check. sqlmap will display partial output"
Added one more warning message to show what's going on with ctrl+c
2011-03-31 14:26:14 +00:00
logger.warn(warnMsg)
code refactoring
2010-11-23 21:00:42 +00:00
clearConsoleLine(True)
More refactoring and cleanup
2011-01-16 00:15:30 +00:00
dataToStdout("\n")
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
if not threadData.shared.value:
better language
2011-05-30 23:04:49 +00:00
warnMsg = "no column(s) found"
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
logger.warn(warnMsg)
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
else:
columns = {}
refactoring of brute force techniques
2010-11-09 09:42:43 +00:00
Fix for an Issue #316
2012-12-20 20:55:59 +01:00
for column in threadData.shared.value:
minor fix (for numeric columns with all 0)
2011-01-18 11:42:36 +00:00
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column)))
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
if result:
columns[column] = 'numeric'
else:
columns[column] = 'non-numeric'
kb.data.cachedColumns[conf.db] = {conf.tbl: columns}
some refactoring
2011-12-28 13:50:03 +00:00
for _ in map(lambda x: (conf.db, conf.tbl, x[0], x[1]), columns.items()):
if _ not in kb.brute.columns:
kb.brute.columns.append(_)
added helper function for HashDB data storing/retrieval
2012-02-24 13:07:20 +00:00
hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True)
some refactoring
2011-12-28 13:50:03 +00:00
improvement of --common-tables and --common-columns
2010-11-11 20:37:25 +00:00
return kb.data.cachedColumns
Reference in New Issue Copy Permalink