#!/usr/bin/env python

"""

Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)

See the file 'doc/COPYING' for copying permission

"""

import codecs

import contextlib

import cookielib

import copy

import getpass

import hashlib

import httplib

import inspect

import json

import locale

import logging

import ntpath

import os

import posixpath

import random

import re

import socket

import string

import subprocess

import sys

import tempfile

import threading

import time

import urllib

import urllib2

import urlparse

import unicodedata

from ConfigParser import DEFAULTSECT

from ConfigParser import RawConfigParser

from StringIO import StringIO

from difflib import SequenceMatcher

from math import sqrt

from optparse import OptionValueError

from xml.dom import minidom

from xml.sax import parse

from xml.sax import SAXParseException

from extra.beep.beep import beep

from extra.cloak.cloak import decloak

from extra.safe2bin.safe2bin import safecharencode

from lib.core.bigarray import BigArray

from lib.core.data import conf

from lib.core.data import kb

from lib.core.data import logger

from lib.core.data import paths

from lib.core.convert import base64pickle

from lib.core.convert import base64unpickle

from lib.core.convert import hexdecode

from lib.core.convert import htmlunescape

from lib.core.convert import stdoutencode

from lib.core.convert import unicodeencode

from lib.core.convert import utf8encode

from lib.core.decorators import cachedmethod

from lib.core.defaults import defaults

from lib.core.dicts import DBMS_DICT

from lib.core.dicts import DEFAULT_DOC_ROOTS

from lib.core.dicts import DEPRECATED_OPTIONS

from lib.core.dicts import SQL_STATEMENTS

from lib.core.enums import ADJUST_TIME_DELAY

from lib.core.enums import CONTENT_STATUS

from lib.core.enums import CHARSET_TYPE

from lib.core.enums import DBMS

from lib.core.enums import EXPECTED

from lib.core.enums import HEURISTIC_TEST

from lib.core.enums import HTTP_HEADER

from lib.core.enums import HTTPMETHOD

from lib.core.enums import MKSTEMP_PREFIX

from lib.core.enums import OPTION_TYPE

from lib.core.enums import OS

from lib.core.enums import PLACE

from lib.core.enums import PAYLOAD

from lib.core.enums import REFLECTIVE_COUNTER

from lib.core.enums import SORT_ORDER

from lib.core.exception import SqlmapDataException

from lib.core.exception import SqlmapGenericException

from lib.core.exception import SqlmapNoneDataException

from lib.core.exception import SqlmapInstallationException

from lib.core.exception import SqlmapMissingDependence

from lib.core.exception import SqlmapSilentQuitException

from lib.core.exception import SqlmapSyntaxException

from lib.core.exception import SqlmapSystemException

from lib.core.exception import SqlmapUserQuitException

from lib.core.exception import SqlmapValueException

from lib.core.log import LOGGER_HANDLER

from lib.core.optiondict import optDict

from lib.core.settings import BANNER

from lib.core.settings import BOLD_PATTERNS

from lib.core.settings import BOUNDED_INJECTION_MARKER

from lib.core.settings import BRUTE_DOC_ROOT_PREFIXES

from lib.core.settings import BRUTE_DOC_ROOT_SUFFIXES

from lib.core.settings import BRUTE_DOC_ROOT_TARGET_MARK

from lib.core.settings import DBMS_DIRECTORY_DICT

from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR

from lib.core.settings import DEFAULT_COOKIE_DELIMITER

from lib.core.settings import DEFAULT_GET_POST_DELIMITER

from lib.core.settings import DEFAULT_MSSQL_SCHEMA

from lib.core.settings import DUMMY_USER_INJECTION

from lib.core.settings import DYNAMICITY_MARK_LENGTH

from lib.core.settings import ERROR_PARSING_REGEXES

from lib.core.settings import FILE_PATH_REGEXES

from lib.core.settings import FORCE_COOKIE_EXPIRATION_TIME

from lib.core.settings import FORM_SEARCH_REGEX

from lib.core.settings import GENERIC_DOC_ROOT_DIRECTORY_NAMES

from lib.core.settings import GIT_PAGE

from lib.core.settings import GITHUB_REPORT_OAUTH_TOKEN

from lib.core.settings import GOOGLE_ANALYTICS_COOKIE_PREFIX

from lib.core.settings import HASHDB_MILESTONE_VALUE

from lib.core.settings import HOST_ALIASES

from lib.core.settings import IGNORE_SAVE_OPTIONS

from lib.core.settings import INFERENCE_UNKNOWN_CHAR

from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT

from lib.core.settings import IP_ADDRESS_REGEX

from lib.core.settings import ISSUES_PAGE

from lib.core.settings import IS_WIN

from lib.core.settings import LARGE_OUTPUT_THRESHOLD

from lib.core.settings import LOCALHOST

from lib.core.settings import MIN_ENCODED_LEN_CHECK

from lib.core.settings import MIN_TIME_RESPONSES

from lib.core.settings import MIN_VALID_DELAYED_RESPONSE

from lib.core.settings import NETSCAPE_FORMAT_HEADER_COOKIES

from lib.core.settings import NULL

from lib.core.settings import PARAMETER_AMP_MARKER

from lib.core.settings import PARAMETER_SEMICOLON_MARKER

from lib.core.settings import PARTIAL_HEX_VALUE_MARKER

from lib.core.settings import PARTIAL_VALUE_MARKER

from lib.core.settings import PAYLOAD_DELIMITER

from lib.core.settings import PLATFORM

from lib.core.settings import PRINTABLE_CHAR_REGEX

from lib.core.settings import PUSH_VALUE_EXCEPTION_RETRY_COUNT

from lib.core.settings import PYVERSION

from lib.core.settings import REFERER_ALIASES

from lib.core.settings import REFLECTED_BORDER_REGEX

from lib.core.settings import REFLECTED_MAX_REGEX_PARTS

from lib.core.settings import REFLECTED_REPLACEMENT_REGEX

from lib.core.settings import REFLECTED_REPLACEMENT_TIMEOUT

from lib.core.settings import REFLECTED_VALUE_MARKER

from lib.core.settings import REFLECTIVE_MISS_THRESHOLD

from lib.core.settings import SENSITIVE_DATA_REGEX

from lib.core.settings import SENSITIVE_OPTIONS

from lib.core.settings import SUPPORTED_DBMS

from lib.core.settings import TEXT_TAG_REGEX

from lib.core.settings import TIME_STDEV_COEFF

from lib.core.settings import UNICODE_ENCODING

from lib.core.settings import UNKNOWN_DBMS_VERSION

from lib.core.settings import URI_QUESTION_MARKER

from lib.core.settings import URLENCODE_CHAR_LIMIT

from lib.core.settings import URLENCODE_FAILSAFE_CHARS

from lib.core.settings import USER_AGENT_ALIASES

from lib.core.settings import VERSION_STRING

from lib.core.threads import getCurrentThreadData

from lib.utils.sqlalchemy import _sqlalchemy

from thirdparty.clientform.clientform import ParseResponse

from thirdparty.clientform.clientform import ParseError

from thirdparty.colorama.initialise import init as coloramainit

from thirdparty.magic import magic

from thirdparty.odict.odict import OrderedDict

from thirdparty.termcolor.termcolor import colored

class UnicodeRawConfigParser(RawConfigParser):

"""

RawConfigParser with unicode writing support

"""

def write(self, fp):

"""

Write an .ini-format representation of the configuration state.

"""

if self._defaults:

fp.write("[%s]\n" % DEFAULTSECT)

for (key, value) in self._defaults.items():

fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t')))

fp.write("\n")

for section in self._sections:

fp.write("[%s]\n" % section)

for (key, value) in self._sections[section].items():

if key != "__name__":

if value is None:

fp.write("%s\n" % (key))

else:

fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t')))

fp.write("\n")

class Format(object):

@staticmethod

def humanize(values, chain=" or "):

return chain.join(values)

# Get methods

@staticmethod

def getDbms(versions=None):

"""

Format the back-end DBMS fingerprint value and return its

values formatted as a human readable string.

@return: detected back-end DBMS based upon fingerprint techniques.

@rtype: C{str}

"""

if versions is None and Backend.getVersionList():

versions = Backend.getVersionList()

return Backend.getDbms() if versions is None else "%s %s" % (Backend.getDbms(), " and ".join(filter(None, versions)))

@staticmethod

def getErrorParsedDBMSes():

"""

Parses the knowledge base htmlFp list and return its values

formatted as a human readable string.

@return: list of possible back-end DBMS based upon error messages

parsing.

@rtype: C{str}

"""

htmlParsed = None

if len(kb.htmlFp) == 0 or kb.heuristicTest != HEURISTIC_TEST.POSITIVE:

pass

elif len(kb.htmlFp) == 1:

htmlParsed = kb.htmlFp[0]

elif len(kb.htmlFp) > 1:

htmlParsed = " or ".join(kb.htmlFp)

return htmlParsed

@staticmethod

def getOs(target, info):

"""

Formats the back-end operating system fingerprint value

and return its values formatted as a human readable string.

Example of info (kb.headersFp) dictionary:

{

'distrib': set(['Ubuntu']),

'type': set(['Linux']),

'technology': set(['PHP 5.2.6', 'Apache 2.2.9']),

'release': set(['8.10'])

}

Example of info (kb.bannerFp) dictionary:

{

'sp': set(['Service Pack 4']),

'dbmsVersion': '8.00.194',

'dbmsServicePack': '0',

'distrib': set(['2000']),

'dbmsRelease': '2000',

'type': set(['Windows'])

}

@return: detected back-end operating system based upon fingerprint

techniques.

@rtype: C{str}

"""

infoStr = ""

infoApi = {}

if info and "type" in info:

if conf.api:

infoApi["%s operating system" % target] = info

else:

infoStr += "%s operating system: %s" % (target, Format.humanize(info["type"]))

if "distrib" in info:

infoStr += " %s" % Format.humanize(info["distrib"])

if "release" in info:

infoStr += " %s" % Format.humanize(info["release"])

if "sp" in info:

infoStr += " %s" % Format.humanize(info["sp"])

if "codename" in info:

infoStr += " (%s)" % Format.humanize(info["codename"])

if "technology" in info:

if conf.api:

infoApi["web application technology"] = Format.humanize(info["technology"], ", ")

else:

infoStr += "\nweb application technology: %s" % Format.humanize(info["technology"], ", ")

if conf.api:

return infoApi

else:

return infoStr.lstrip()

class Backend:

# Set methods

@staticmethod

def setDbms(dbms):

dbms = aliasToDbmsEnum(dbms)

if dbms is None:

return None

# Little precaution, in theory this condition should always be false

elif kb.dbms is not None and kb.dbms != dbms:

warnMsg = "there appears to be a high probability that "

warnMsg += "this could be a false positive case"

logger.warn(warnMsg)

msg = "sqlmap previously fingerprinted back-end DBMS as "

msg += "%s. However now it has been fingerprinted " % kb.dbms

msg += "as %s. " % dbms

msg += "Please, specify which DBMS should be "

msg += "correct [%s (default)/%s] " % (kb.dbms, dbms)

while True:

choice = readInput(msg, default=kb.dbms)

if aliasToDbmsEnum(choice) == kb.dbms:

kb.dbmsVersion = []

kb.resolutionDbms = kb.dbms

break

elif aliasToDbmsEnum(choice) == dbms:

kb.dbms = aliasToDbmsEnum(choice)

break

else:

warnMsg = "invalid value"

logger.warn(warnMsg)

elif kb.dbms is None:

kb.dbms = aliasToDbmsEnum(dbms)

return kb.dbms

@staticmethod

def setVersion(version):

if isinstance(version, basestring):

kb.dbmsVersion = [version]

return kb.dbmsVersion

@staticmethod

def setVersionList(versionsList):

if isinstance(versionsList, list):

kb.dbmsVersion = versionsList

elif isinstance(versionsList, basestring):

Backend.setVersion(versionsList)

else:

logger.error("invalid format of versionsList")

@staticmethod

def forceDbms(dbms, sticky=False):

if not kb.stickyDBMS:

kb.forcedDbms = aliasToDbmsEnum(dbms)

kb.stickyDBMS = sticky

@staticmethod

def flushForcedDbms(force=False):

if not kb.stickyDBMS or force:

kb.forcedDbms = None

kb.stickyDBMS = False

@staticmethod

def setOs(os):

if os is None:

return None

# Little precaution, in theory this condition should always be false

elif kb.os is not None and isinstance(os, basestring) and kb.os.lower() != os.lower():

msg = "sqlmap previously fingerprinted back-end DBMS "

msg += "operating system %s. However now it has " % kb.os

msg += "been fingerprinted to be %s. " % os

msg += "Please, specify which OS is "

msg += "correct [%s (default)/%s] " % (kb.os, os)

while True:

choice = readInput(msg, default=kb.os)

if choice == kb.os:

break

elif choice == os:

kb.os = choice.capitalize()

break

else:

warnMsg = "invalid value"

logger.warn(warnMsg)

elif kb.os is None and isinstance(os, basestring):

kb.os = os.capitalize()

return kb.os

@staticmethod

def setOsVersion(version):

if version is None:

return None

elif kb.osVersion is None and isinstance(version, basestring):

kb.osVersion = version

@staticmethod

def setOsServicePack(sp):

if sp is None:

return None

elif kb.osSP is None and isinstance(sp, int):

kb.osSP = sp

@staticmethod

def setArch():

msg = "what is the back-end database management system architecture?"

msg += "\n[1] 32-bit (default)"

msg += "\n[2] 64-bit"

while True:

choice = readInput(msg, default='1')

if isinstance(choice, basestring) and choice.isdigit() and int(choice) in (1, 2):

kb.arch = 32 if int(choice) == 1 else 64

break

else:

warnMsg = "invalid value. Valid values are 1 and 2"

logger.warn(warnMsg)

return kb.arch

# Get methods

@staticmethod

def getForcedDbms():

return aliasToDbmsEnum(kb.get("forcedDbms"))

@staticmethod

def getDbms():

return aliasToDbmsEnum(kb.get("dbms"))

@staticmethod

def getErrorParsedDBMSes():

"""

Returns array with parsed DBMS names till now

This functions is called to:

1. Ask user whether or not skip specific DBMS tests in detection phase,

lib/controller/checks.py - detection phase.

2. Sort the fingerprint of the DBMS, lib/controller/handler.py -

fingerprint phase.

"""

return kb.htmlFp if kb.get("heuristicTest") == HEURISTIC_TEST.POSITIVE else []

@staticmethod

def getIdentifiedDbms():

"""

This functions is called to:

1. Sort the tests, getSortedInjectionTests() - detection phase.

2. Etc.

"""

dbms = None

if not kb:

pass

elif not kb.get("testMode") and conf.get("dbmsHandler") and getattr(conf.dbmsHandler, "_dbms", None):

dbms = conf.dbmsHandler._dbms

elif Backend.getForcedDbms() is not None:

dbms = Backend.getForcedDbms()

elif Backend.getDbms() is not None:

dbms = Backend.getDbms()

elif kb.get("injection") and kb.injection.dbms:

dbms = unArrayizeValue(kb.injection.dbms)

elif Backend.getErrorParsedDBMSes():

dbms = unArrayizeValue(Backend.getErrorParsedDBMSes())

elif conf.get("dbms"):

dbms = conf.get("dbms")

return aliasToDbmsEnum(dbms)

@staticmethod

def getVersion():

versions = filter(None, flattenValue(kb.dbmsVersion))

if not isNoneValue(versions):

return versions[0]

else:

return None

@staticmethod

def getVersionList():

versions = filter(None, flattenValue(kb.dbmsVersion))

if not isNoneValue(versions):

return versions

else:

return None

@staticmethod

def getOs():

return kb.os

@staticmethod

def getOsVersion():

return kb.osVersion

@staticmethod

def getOsServicePack():

return kb.osSP

@staticmethod

def getArch():

if kb.arch is None:

Backend.setArch()

return kb.arch

# Comparison methods

@staticmethod

def isDbms(dbms):

if not kb.get("testMode") and all((Backend.getDbms(), Backend.getIdentifiedDbms())) and Backend.getDbms() != Backend.getIdentifiedDbms():

singleTimeWarnMessage("identified ('%s') and fingerprinted ('%s') DBMSes differ. If you experience problems in enumeration phase please rerun with '--flush-session'" % (Backend.getIdentifiedDbms(), Backend.getDbms()))

return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms)

@staticmethod

def isDbmsWithin(aliases):

return Backend.getDbms() is not None and Backend.getDbms().lower() in aliases

@staticmethod

def isVersion(version):

return Backend.getVersion() is not None and Backend.getVersion() == version

@staticmethod

def isVersionWithin(versionList):

if Backend.getVersionList() is None:

return False

for _ in Backend.getVersionList():

if _ != UNKNOWN_DBMS_VERSION and _ in versionList:

return True

return False

@staticmethod

def isVersionGreaterOrEqualThan(version):

return Backend.getVersion() is not None and str(Backend.getVersion()) >= str(version)

@staticmethod

def isOs(os):

return Backend.getOs() is not None and Backend.getOs().lower() == os.lower()

def paramToDict(place, parameters=None):

"""

Split the parameters into names and values, check if these parameters

are within the testable parameters and return in a dictionary.

"""

testableParameters = OrderedDict()

if place in conf.parameters and not parameters:

parameters = conf.parameters[place]

parameters = re.sub(r"&(\w{1,4});", r"%s\g<1>%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), parameters)

if place == PLACE.COOKIE:

splitParams = parameters.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER)

else:

splitParams = parameters.split(conf.paramDel or DEFAULT_GET_POST_DELIMITER)

for element in splitParams:

element = re.sub(r"%s(.+?)%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), r"&\g<1>;", element)

parts = element.split("=")

if len(parts) >= 2:

parameter = urldecode(parts[0].replace(" ", ""))

if not parameter:

continue

if conf.paramDel and conf.paramDel == '\n':

parts[-1] = parts[-1].rstrip()

condition = not conf.testParameter

condition |= conf.testParameter is not None and parameter in conf.testParameter

condition |= place == PLACE.COOKIE and len(intersect((PLACE.COOKIE,), conf.testParameter, True)) > 0

if condition:

testableParameters[parameter] = "=".join(parts[1:])

if not conf.multipleTargets and not (conf.csrfToken and parameter == conf.csrfToken):

_ = urldecode(testableParameters[parameter], convall=True)

if (_.endswith("'") and _.count("'") == 1

or re.search(r'\A9{3,}', _) or re.search(r'\A-\d+\Z', _) or re.search(DUMMY_USER_INJECTION, _))\

and not parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX):

warnMsg = "it appears that you have provided tainted parameter values "

warnMsg += "('%s') with most likely leftover " % element

warnMsg += "chars/statements from manual SQL injection test(s). "

warnMsg += "Please, always use only valid parameter values "

warnMsg += "so sqlmap could be able to run properly"

logger.warn(warnMsg)

message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] "

if not readInput(message, default='N', boolean=True):

raise SqlmapSilentQuitException

elif not _:

warnMsg = "provided value for parameter '%s' is empty. " % parameter

warnMsg += "Please, always use only valid parameter values "

warnMsg += "so sqlmap could be able to run properly"

logger.warn(warnMsg)

if place in (PLACE.POST, PLACE.GET):

for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"):

match = re.search(regex, testableParameters[parameter])

if match:

try:

candidates = OrderedDict()

def walk(head, current=None):

if current is None:

current = head

if isListLike(current):

for _ in current:

walk(head, _)

elif isinstance(current, dict):

for key in current.keys():

value = current[key]

if isinstance(value, (list, tuple, set, dict)):

if value:

walk(head, value)

elif isinstance(value, (bool, int, float, basestring)):

original = current[key]

if isinstance(value, bool):

current[key] = "%s%s" % (str(value).lower(), BOUNDED_INJECTION_MARKER)

else:

current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)

candidates["%s (%s)" % (parameter, key)] = re.sub("(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized), parameters)

current[key] = original

deserialized = json.loads(testableParameters[parameter])

walk(deserialized)

if candidates:

message = "it appears that provided value for %s parameter '%s' " % (place, parameter)

message += "is JSON deserializable. Do you want to inject inside? [y/N] "

if not readInput(message, default='N', boolean=True):

del testableParameters[parameter]

testableParameters.update(candidates)

break

except (KeyboardInterrupt, SqlmapUserQuitException):

raise

except Exception:

pass

_ = re.sub(regex, "\g<1>%s\g<%d>" % (kb.customInjectionMark, len(match.groups())), testableParameters[parameter])

message = "it appears that provided value for %s parameter '%s' " % (place, parameter)

message += "has boundaries. Do you want to inject inside? ('%s') [y/N] " % getUnicode(_)

if readInput(message, default='N', boolean=True):

testableParameters[parameter] = re.sub(regex, "\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter])

break

if conf.testParameter:

if not testableParameters:

paramStr = ", ".join(test for test in conf.testParameter)

if len(conf.testParameter) > 1:

warnMsg = "provided parameters '%s' " % paramStr

warnMsg += "are not inside the %s" % place

logger.warn(warnMsg)

else:

parameter = conf.testParameter[0]

if not intersect(USER_AGENT_ALIASES + REFERER_ALIASES + HOST_ALIASES, parameter, True):

debugMsg = "provided parameter '%s' " % paramStr

debugMsg += "is not inside the %s" % place

logger.debug(debugMsg)

elif len(conf.testParameter) != len(testableParameters.keys()):

for parameter in conf.testParameter:

if parameter not in testableParameters:

debugMsg = "provided parameter '%s' " % parameter

debugMsg += "is not inside the %s" % place

logger.debug(debugMsg)

if testableParameters:

for parameter, value in testableParameters.items():

if value and not value.isdigit():

for encoding in ("hex", "base64"):

try:

decoded = value.decode(encoding)

if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in string.printable for _ in decoded):

warnMsg = "provided parameter '%s' " % parameter

warnMsg += "appears to be '%s' encoded" % encoding

logger.warn(warnMsg)

break

except:

pass

return testableParameters

def getManualDirectories():

directories = None

defaultDocRoot = DEFAULT_DOC_ROOTS.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX])

if kb.absFilePaths:

for absFilePath in kb.absFilePaths:

if directories:

break

if directoryPath(absFilePath) == '/':

continue

absFilePath = normalizePath(absFilePath)

windowsDriveLetter = None

if isWindowsDriveLetterPath(absFilePath):

windowsDriveLetter, absFilePath = absFilePath[:2], absFilePath[2:]

absFilePath = ntToPosixSlashes(posixToNtSlashes(absFilePath))

for _ in list(GENERIC_DOC_ROOT_DIRECTORY_NAMES) + [conf.hostname]:

_ = "/%s/" % _

if _ in absFilePath:

directories = "%s%s" % (absFilePath.split(_)[0], _)

break

if not directories and conf.path.strip('/') and conf.path in absFilePath:

directories = absFilePath.split(conf.path)[0]

if directories and windowsDriveLetter:

directories = "%s/%s" % (windowsDriveLetter, ntToPosixSlashes(directories))

directories = normalizePath(directories)

if conf.webRoot:

directories = [conf.webRoot]

infoMsg = "using '%s' as web server document root" % conf.webRoot

logger.info(infoMsg)

elif directories:

infoMsg = "retrieved the web server document root: '%s'" % directories

logger.info(infoMsg)

else:

warnMsg = "unable to automatically retrieve the web server "

warnMsg += "document root"

logger.warn(warnMsg)

directories = []

message = "what do you want to use for writable directory?\n"

message += "[1] common location(s) ('%s') (default)\n" % ", ".join(root for root in defaultDocRoot)

message += "[2] custom location(s)\n"

message += "[3] custom directory list file\n"

message += "[4] brute force search"

choice = readInput(message, default='1')

if choice == '2':

message = "please provide a comma separate list of absolute directory paths: "

directories = readInput(message, default="").split(',')

elif choice == '3':

message = "what's the list file location?\n"

listPath = readInput(message, default="")

checkFile(listPath)

directories = getFileItems(listPath)

elif choice == '4':

targets = set([conf.hostname])

_ = conf.hostname.split('.')

if _[0] == "www":

targets.add('.'.join(_[1:]))

targets.add('.'.join(_[1:-1]))

else:

targets.add('.'.join(_[:-1]))

targets = filter(None, targets)

for prefix in BRUTE_DOC_ROOT_PREFIXES.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]):

if BRUTE_DOC_ROOT_TARGET_MARK in prefix and re.match(IP_ADDRESS_REGEX, conf.hostname):

continue

for suffix in BRUTE_DOC_ROOT_SUFFIXES:

for target in targets:

if not prefix.endswith("/%s" % suffix):

item = "%s/%s" % (prefix, suffix)

else:

item = prefix

item = item.replace(BRUTE_DOC_ROOT_TARGET_MARK, target).replace("//", '/').rstrip('/')

if item not in directories:

directories.append(item)

if BRUTE_DOC_ROOT_TARGET_MARK not in prefix:

break

infoMsg = "using generated directory list: %s" % ','.join(directories)

logger.info(infoMsg)

msg = "use any additional custom directories [Enter for None]: "

answer = readInput(msg)

if answer:

directories.extend(answer.split(','))

else:

directories = defaultDocRoot

return directories

def getAutoDirectories():

retVal = set()

if kb.absFilePaths:

infoMsg = "retrieved web server absolute paths: "

infoMsg += "'%s'" % ", ".join(ntToPosixSlashes(path) for path in kb.absFilePaths)

logger.info(infoMsg)

for absFilePath in kb.absFilePaths:

if absFilePath:

directory = directoryPath(absFilePath)

directory = ntToPosixSlashes(directory)

retVal.add(directory)

else:

warnMsg = "unable to automatically parse any web server path"

logger.warn(warnMsg)

return list(retVal)

def filePathToSafeString(filePath):

"""

Returns string representation of a given filepath safe for a single filename usage

>>> filePathToSafeString('C:/Windows/system32')

'C__Windows_system32'

"""

retVal = filePath.replace("/", "_").replace("\\", "_")

retVal = retVal.replace(" ", "_").replace(":", "_")

return retVal

def singleTimeDebugMessage(message):

singleTimeLogMessage(message, logging.DEBUG)

def singleTimeWarnMessage(message):

singleTimeLogMessage(message, logging.WARN)

def singleTimeLogMessage(message, level=logging.INFO, flag=None):

if flag is None:

flag = hash(message)

if not conf.smokeTest and flag not in kb.singleLogFlags:

kb.singleLogFlags.add(flag)

logger.log(level, message)

def boldifyMessage(message):

retVal = message

if any(_ in message for _ in BOLD_PATTERNS):

retVal = setColor(message, True)

return retVal

def setColor(message, bold=False):

retVal = message

level = extractRegexResult(r"\[(?P<result>[A-Z ]+)\]", message) or kb.get("stickyLevel")

if message and getattr(LOGGER_HANDLER, "is_tty", False): # colorizing handler

if bold:

retVal = colored(message, color=None, on_color=None, attrs=("bold",))

elif level:

level = getattr(logging, level, None) if isinstance(level, basestring) else level

_ = LOGGER_HANDLER.level_map.get(level)

if _:

background, foreground, bold = _

retVal = colored(message, color=foreground, on_color="on_%s" % background if background else None, attrs=("bold",) if bold else None)

kb.stickyLevel = level if message and message[-1] != "\n" else None

return retVal

def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=CONTENT_STATUS.IN_PROGRESS):

"""

Writes text to the stdout (console) stream

"""

message = ""

if not kb.get("threadException"):

if forceOutput or not getCurrentThreadData().disableStdOut:

if kb.get("multiThreadMode"):

logging._acquireLock()

if isinstance(data, unicode):

message = stdoutencode(data)

else:

message = data

try:

if conf.get("api"):

sys.stdout.write(message, status, content_type)

else:

sys.stdout.write(setColor(message, bold))

sys.stdout.flush()

except IOError:

pass

if kb.get("multiThreadMode"):

logging._releaseLock()

kb.prependFlag = isinstance(data, basestring) and (len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[-1] != '\n')

def dataToTrafficFile(data):

if not conf.trafficFile:

return

try:

conf.trafficFP.write(data)

conf.trafficFP.flush()

except IOError, ex:

errMsg = "something went wrong while trying "

errMsg += "to write to the traffic file '%s' ('%s')" % (conf.trafficFile, getSafeExString(ex))

raise SqlmapSystemException(errMsg)

def dataToDumpFile(dumpFile, data):

try:

dumpFile.write(data)

dumpFile.flush()

except IOError, ex:

if "No space left" in getUnicode(ex):

errMsg = "no space left on output device"

logger.error(errMsg)

elif "Permission denied" in getUnicode(ex):

errMsg = "permission denied when flushing dump data"

logger.error(errMsg)

else:

raise

def dataToOutFile(filename, data):

retVal = None

if data:

while True:

retVal = os.path.join(conf.filePath, filePathToSafeString(filename))

try:

with open(retVal, "w+b") as f: # has to stay as non-codecs because data is raw ASCII encoded data

f.write(unicodeencode(data))

except UnicodeEncodeError, ex:

_ = normalizeUnicode(filename)

if filename != _:

filename = _

else:

errMsg = "couldn't write to the "

errMsg += "output file ('%s')" % getSafeExString(ex)

raise SqlmapGenericException(errMsg)

except IOError, ex:

errMsg = "something went wrong while trying to write "

errMsg += "to the output file ('%s')" % getSafeExString(ex)

raise SqlmapGenericException(errMsg)

else:

break

return retVal

def readInput(message, default=None, checkBatch=True, boolean=False):

"""

Reads input from terminal

"""

retVal = None

kb.stickyLevel = None

message = getUnicode(message)

if "\n" in message:

message += "%s> " % ("\n" if message.count("\n") > 1 else "")

elif message[-1] == ']':

message += " "

if kb.get("prependFlag"):

message = "\n%s" % message

kb.prependFlag = False

if conf.get("answers"):

for item in conf.answers.split(','):

question = item.split('=')[0].strip()

answer = item.split('=')[1] if len(item.split('=')) > 1 else None

if answer and question.lower() in message.lower():

retVal = getUnicode(answer, UNICODE_ENCODING)

elif answer is None and retVal:

retVal = "%s,%s" % (retVal, getUnicode(item, UNICODE_ENCODING))

if retVal:

dataToStdout("\r%s%s\n" % (message, retVal), forceOutput=True, bold=True)

debugMsg = "used the given answer"

logger.debug(debugMsg)