Skip to content

Commit 282eea3

Browse files
stamparmstamparm
committed
Another patch for #5798 
1 parent 22ddd4e commit 282eea3

File tree

3 files changed

+74
-72
lines changed

3 files changed

+74
-72
lines changed

‎data/txt/sha256sums.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ bf77f9fc4296f239687297aee1fd6113b34f855965a6f690b52e26bd348cb353 lib/core/profi
188188
4eff81c639a72b261c8ba1c876a01246e718e6626e8e77ae9cc6298b20a39355 lib/core/replication.py
189189
bbd1dcda835934728efc6d68686e9b0da72b09b3ee38f3c0ab78e8c18b0ba726 lib/core/revision.py
190190
eed6b0a21b3e69c5583133346b0639dc89937bd588887968ee85f8389d7c3c96 lib/core/session.py
191-
d21819319315ee0e2b686639f6ca426b5172d0105315a42b3d3f1a98d1f2e8ad lib/core/settings.py
191+
adc1416c7893869711eda091bb4d8b0699a528f012a79377be3cf3e336b4474a lib/core/settings.py
192192
2bec97d8a950f7b884e31dfe9410467f00d24f21b35672b95f8d68ed59685fd4 lib/core/shell.py
193193
e90a359b37a55c446c60e70ccd533f87276714d0b09e34f69b0740fd729ddbf8 lib/core/subprocessng.py
194194
54f7c70b4c7a9931f7ff3c1c12030180bde38e35a306d5e343ad6052919974cd lib/core/target.py
@@ -242,7 +242,7 @@ f948fefb0fa67da8cf037f7abbcdbb740148babda9ad8a58fab1693456834817 lib/techniques
242242
700cc5e8cae85bd86674d0cb6c97093fde2c52a480cc1e40ae0010fffd649395 lib/techniques/union/test.py
243243
4252a1829e60bb9a69e3927bf68a320976b8ef637804b7032d7497699f2e89e7 lib/techniques/union/use.py
244244
6b3f83a85c576830783a64e943a58e90b1f25e9e24cd51ae12b1d706796124e9 lib/utils/api.py
245-
1d4d1e49a0897746d4ad64316d4d777f4804c4c11e349e9eb3844130183d4887 lib/utils/brute.py
245+
e00740b9a4c997152fa8b00d3f0abf45ae15e23c33a92966eaa658fde83c586f lib/utils/brute.py
246246
c0a4765aa80c5d9b7ef1abe93401a78dd45b2766a1f4ff6286287dc6188294de lib/utils/crawler.py
247247
3f97e327c548d8b5d74fda96a2a0d1b2933b289b9ec2351b06c91cefdd38629d lib/utils/deps.py
248248
e81393f0d077578e6dcd3db2887e93ac2bfbdef2ce87686e83236a36112ca7d3 lib/utils/getch.py

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from thirdparty import six
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.8.11.0"
22+
VERSION = "1.8.11.1"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/utils/brute.py‎

Lines changed: 71 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -228,93 +228,95 @@ def columnExists(columnFile, regex=None):
228228
columns.extend(_addPageTextWords())
229229
columns = filterListValue(columns, regex)
230230

231-
table = safeSQLIdentificatorNaming(conf.tbl, True)
231+
for table in conf.tbl.split(','):
232+
table = safeSQLIdentificatorNaming(table, True)
232233

233-
if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD):
234-
table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table)
234+
if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD):
235+
table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table)
235236

236-
kb.threadContinue = True
237-
kb.bruteMode = True
238-
239-
threadData = getCurrentThreadData()
240-
threadData.shared.count = 0
241-
threadData.shared.limit = len(columns)
242-
threadData.shared.files = []
237+
kb.threadContinue = True
238+
kb.bruteMode = True
243239

244-
def columnExistsThread():
245240
threadData = getCurrentThreadData()
241+
threadData.shared.count = 0
242+
threadData.shared.limit = len(columns)
243+
threadData.shared.files = []
246244

247-
while kb.threadContinue:
248-
kb.locks.count.acquire()
249-
if threadData.shared.count < threadData.shared.limit:
250-
column = safeSQLIdentificatorNaming(columns[threadData.shared.count])
251-
threadData.shared.count += 1
252-
kb.locks.count.release()
253-
else:
254-
kb.locks.count.release()
255-
break
245+
def columnExistsThread():
246+
threadData = getCurrentThreadData()
256247

257-
if Backend.isDbms(DBMS.MCKOI):
258-
result = inject.checkBooleanExpression(safeStringFormat("0<(SELECT COUNT(%s) FROM %s)", (column, table)))
259-
else:
260-
result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table)))
248+
while kb.threadContinue:
249+
kb.locks.count.acquire()
261250

262-
kb.locks.io.acquire()
251+
if threadData.shared.count < threadData.shared.limit:
252+
column = safeSQLIdentificatorNaming(columns[threadData.shared.count])
253+
threadData.shared.count += 1
254+
kb.locks.count.release()
255+
else:
256+
kb.locks.count.release()
257+
break
263258

264-
if result:
265-
threadData.shared.files.append(column)
259+
if Backend.isDbms(DBMS.MCKOI):
260+
result = inject.checkBooleanExpression(safeStringFormat("0<(SELECT COUNT(%s) FROM %s)", (column, table)))
261+
else:
262+
result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table)))
266263

267-
if conf.verbose in (1, 2) and not conf.api:
268-
clearConsoleLine(True)
269-
infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(column))
270-
dataToStdout(infoMsg, True)
264+
kb.locks.io.acquire()
271265

272-
if conf.verbose in (1, 2):
273-
status = "%d/%d items (%d%%)" % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit))
274-
dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True)
266+
if result:
267+
threadData.shared.files.append(column)
275268

276-
kb.locks.io.release()
269+
if conf.verbose in (1, 2) and not conf.api:
270+
clearConsoleLine(True)
271+
infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(column))
272+
dataToStdout(infoMsg, True)
277273

278-
try:
279-
runThreads(conf.threads, columnExistsThread, threadChoice=True)
280-
except KeyboardInterrupt:
281-
warnMsg = "user aborted during column existence "
282-
warnMsg += "check. sqlmap will display partial output"
283-
logger.warning(warnMsg)
284-
finally:
285-
kb.bruteMode = False
274+
if conf.verbose in (1, 2):
275+
status = "%d/%d items (%d%%)" % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit))
276+
dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True)
286277

287-
clearConsoleLine(True)
288-
dataToStdout("\n")
278+
kb.locks.io.release()
289279

290-
if not threadData.shared.files:
291-
warnMsg = "no column(s) found"
292-
logger.warning(warnMsg)
293-
else:
294-
columns = {}
295-
296-
for column in threadData.shared.files:
297-
if Backend.getIdentifiedDbms() in (DBMS.MYSQL,):
298-
result = not inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s REGEXP '[^0-9]')", (column, table, column)))
299-
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE,):
300-
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s NOT GLOB '*[^0-9]*')", (column, table, column)))
301-
elif Backend.getIdentifiedDbms() in (DBMS.MCKOI,):
302-
result = inject.checkBooleanExpression("%s" % safeStringFormat("0=(SELECT MAX(%s)-MAX(%s) FROM %s)", (column, column, table)))
303-
else:
304-
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column)))
280+
try:
281+
runThreads(conf.threads, columnExistsThread, threadChoice=True)
282+
except KeyboardInterrupt:
283+
warnMsg = "user aborted during column existence "
284+
warnMsg += "check. sqlmap will display partial output"
285+
logger.warning(warnMsg)
286+
finally:
287+
kb.bruteMode = False
305288

306-
if result:
307-
columns[column] = "numeric"
308-
else:
309-
columns[column] = "non-numeric"
289+
clearConsoleLine(True)
290+
dataToStdout("\n")
291+
292+
if not threadData.shared.files:
293+
warnMsg = "no column(s) found"
294+
logger.warning(warnMsg)
295+
else:
296+
columns = {}
297+
298+
for column in threadData.shared.files:
299+
if Backend.getIdentifiedDbms() in (DBMS.MYSQL,):
300+
result = not inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s REGEXP '[^0-9]')", (column, table, column)))
301+
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE,):
302+
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s NOT GLOB '*[^0-9]*')", (column, table, column)))
303+
elif Backend.getIdentifiedDbms() in (DBMS.MCKOI,):
304+
result = inject.checkBooleanExpression("%s" % safeStringFormat("0=(SELECT MAX(%s)-MAX(%s) FROM %s)", (column, column, table)))
305+
else:
306+
result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column)))
307+
308+
if result:
309+
columns[column] = "numeric"
310+
else:
311+
columns[column] = "non-numeric"
310312

311-
kb.data.cachedColumns[conf.db] = {conf.tbl: columns}
313+
kb.data.cachedColumns[conf.db] = {table: columns}
312314

313-
for _ in ((conf.db, conf.tbl, item[0], item[1]) for item in columns.items()):
314-
if _ not in kb.brute.columns:
315-
kb.brute.columns.append(_)
315+
for _ in ((conf.db, table, item[0], item[1]) for item in columns.items()):
316+
if _ not in kb.brute.columns:
317+
kb.brute.columns.append(_)
316318

317-
hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True)
319+
hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True)
318320

319321
return kb.data.cachedColumns
320322

0 commit comments

Comments
 (0)