Skip to content

Commit 4cb378c

Browse files
stamparmstamparm
committed
Another update for an Issue sqlmapproject#352 and couple of fixes
1 parent b35122a commit 4cb378c

38 files changed

+127
-146
lines changed

‎lib/core/common.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -736,7 +736,7 @@ def singleTimeLogMessage(message, level=logging.INFO, flag=None):
736736
if flag is None:
737737
flag = hash(message)
738738

739-
if flag not in kb.singleLogFlags:
739+
if not conf.smokeTest and flag not in kb.singleLogFlags:
740740
kb.singleLogFlags.add(flag)
741741
logger.log(level, message)
742742

‎lib/core/testing.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,9 @@
4141

4242
def smokeTest():
4343
"""
44-
This will run the basic smoke testing of a program
44+
Runs the basic smoke testing of a program
4545
"""
46+
4647
retVal = True
4748
count, length = 0, 0
4849

@@ -106,8 +107,9 @@ def adjustValueType(tagName, value):
106107

107108
def liveTest():
108109
"""
109-
This will run the test of a program against the live testing environment
110+
Runs the test of a program against the live testing environment
110111
"""
112+
111113
global failedItem
112114
global failedParseOn
113115
global failedTraceBack

‎tamper/apostrophemask.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,14 @@ def tamper(payload, **kwargs):
1616
"""
1717
Replaces apostrophe character with its UTF-8 full width counterpart
1818
19-
Example:
20-
* Input: AND '1'='1'
21-
* Output: AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87
22-
2319
References:
2420
* http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128
2521
* http://lukasz.pilorz.net/testy/unicode_conversion/
2622
* http://sla.ckers.org/forum/read.php?13,11562,11850
2723
* http://lukasz.pilorz.net/testy/full_width_utf/index.phps
24+
25+
>>> tamper("1 AND '1'='1")
26+
'1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'
2827
"""
2928

3029
return payload.replace('\'', "%EF%BC%87") if payload else payload

‎tamper/apostrophenullencode.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,8 @@ def tamper(payload, **kwargs):
1616
"""
1717
Replaces apostrophe character with its illegal double unicode counterpart
1818
19-
Example:
20-
* Input: AND '1'='1'
21-
* Output: AND %00%271%00%27=%00%271%00%27
19+
>>> tamper("1 AND '1'='1")
20+
'1 AND %00%271%00%27=%00%271'
2221
"""
2322

2423
return payload.replace('\'', "%00%27") if payload else payload

‎tamper/appendnullbyte.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ def tamper(payload, **kwargs):
1616
"""
1717
Appends encoded NULL byte character at the end of payload
1818
19-
Example:
20-
* Input: AND 1=1
21-
* Output: AND 1=1%00
22-
2319
Requirement:
2420
* Microsoft Access
2521
@@ -29,6 +25,9 @@ def tamper(payload, **kwargs):
2925
also possible
3026
3127
Reference: http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection
28+
29+
>>> tamper('1 AND 1=1')
30+
'1 AND 1=1%00'
3231
"""
3332

3433
return "%s%%00" % payload if payload else payload

‎tamper/base64encode.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,8 @@ def tamper(payload, **kwargs):
1818
"""
1919
Base64 all characters in a given payload
2020
21-
Example:
22-
* Input: 1' AND SLEEP(5)#
23-
* Output: MScgQU5EIFNMRUVQKDUpIw==
21+
>>> tamper("1' AND SLEEP(5)#")
22+
'MScgQU5EIFNMRUVQKDUpIw=='
2423
"""
2524

2625
return base64.b64encode(payload) if payload else payload

‎tamper/between.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ def tamper(payload, **kwargs):
1818
"""
1919
Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #'
2020
21-
Example:
22-
* Input: 'A > B'
23-
* Output: 'A NOT BETWEEN 0 AND B'
24-
2521
Tested against:
2622
* Microsoft SQL Server 2005
2723
* MySQL 4, 5.0 and 5.5
@@ -33,6 +29,9 @@ def tamper(payload, **kwargs):
3329
filter the greater than character
3430
* The BETWEEN clause is SQL standard. Hence, this tamper script
3531
should work against all (?) databases
32+
33+
>>> tamper('1 AND A > B--')
34+
'1 AND A NOT BETWEEN 0 AND B--'
3635
"""
3736

3837
retVal = payload

‎tamper/bluecoat.py‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,6 @@ def tamper(payload, **kwargs):
1919
Replaces space character after SQL statement with a valid random blank character.
2020
Afterwards replace character = with LIKE operator
2121
22-
Example:
23-
* Input: SELECT id FROM users where id = 1
24-
* Output: SELECT%09id FROM users where id LIKE 1
25-
2622
Requirement:
2723
* Blue Coat SGOS with WAF activated as documented in
2824
https://kb.bluecoat.com/index?page=content&id=FAQ2147
@@ -32,12 +28,15 @@ def tamper(payload, **kwargs):
3228
3329
Notes:
3430
* Useful to bypass Blue Coat's recommended WAF rule configuration
31+
32+
>>> tamper('SELECT id FROM users where id = 1')
33+
'SELECT%09id FROM users where id LIKE 1'
3534
"""
3635

3736
retVal = payload
3837

3938
if payload:
40-
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>\t", payload)
39+
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>%09", payload)
4140
retVal = re.sub(r"\s*=\s*", " LIKE ", retVal)
4241

4342
return retVal

‎tamper/chardoubleencode.py‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,13 @@ def tamper(payload, **kwargs):
1919
Double url-encodes all characters in a given payload (not processing
2020
already encoded)
2121
22-
Example:
23-
* Input: SELECT FIELD FROM%20TABLE
24-
* Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
25-
2622
Notes:
2723
* Useful to bypass some weak web application firewalls that do not
2824
double url-decode the request before processing it through their
2925
ruleset
26+
27+
>>> tamper('SELECT FIELD FROM%20TABLE')
28+
'%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545'
3029
"""
3130

3231
retVal = payload
@@ -37,7 +36,7 @@ def tamper(payload, **kwargs):
3736

3837
while i < len(payload):
3938
if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits:
40-
retVal += payload[i:i + 3]
39+
retVal += '%%25%s' % payload[i + 1:i + 3]
4140
i += 3
4241
else:
4342
retVal += '%%25%.2X' % ord(payload[i])

‎tamper/charencode.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,6 @@ def tamper(payload, **kwargs):
1919
Url-encodes all characters in a given payload (not processing already
2020
encoded)
2121
22-
Example:
23-
* Input: SELECT FIELD FROM%20TABLE
24-
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
25-
2622
Tested against:
2723
* Microsoft SQL Server 2005
2824
* MySQL 4, 5.0 and 5.5
@@ -34,6 +30,9 @@ def tamper(payload, **kwargs):
3430
url-decode the request before processing it through their ruleset
3531
* The web server will anyway pass the url-decoded version behind,
3632
hence it should work against any DBMS
33+
34+
>>> tamper('SELECT FIELD FROM%20TABLE')
35+
'%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45'
3736
"""
3837

3938
retVal = payload

0 commit comments

Comments
 (0)