Skip to content

Commit aa9b5e4

Browse files
stamparmstamparm
committed
Implements #2908 
1 parent c938d77 commit aa9b5e4

File tree

20 files changed

+1790
-34
lines changed

20 files changed

+1790
-34
lines changed

‎data/txt/common-files.txt‎

Lines changed: 1641 additions & 0 deletions
Large diffs are not rendered by default.

‎lib/controller/action.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
from lib.core.exception import SqlmapUnsupportedDBMSException
1818
from lib.core.settings import SUPPORTED_DBMS
1919
from lib.utils.brute import columnExists
20+
from lib.utils.brute import fileExists
2021
from lib.utils.brute import tableExists
2122

2223
def action():
@@ -199,6 +200,14 @@ def action():
199200
if conf.fileWrite:
200201
conf.dbmsHandler.writeFile(conf.fileWrite, conf.fileDest, conf.fileWriteType)
201202

203+
if conf.commonFiles:
204+
try:
205+
conf.dumper.rFile(fileExists(paths.COMMON_FILES))
206+
except SqlmapNoneDataException as ex:
207+
logger.critical(ex)
208+
except:
209+
raise
210+
202211
# Operating system options
203212
if conf.osCmd:
204213
conf.dbmsHandler.osCmd()

‎lib/core/common.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1346,6 +1346,7 @@ def setPaths(rootPath):
13461346

13471347
# sqlmap files
13481348
paths.COMMON_COLUMNS = os.path.join(paths.SQLMAP_TXT_PATH, "common-columns.txt")
1349+
paths.COMMON_FILES = os.path.join(paths.SQLMAP_TXT_PATH, "common-files.txt")
13491350
paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt")
13501351
paths.COMMON_OUTPUTS = os.path.join(paths.SQLMAP_TXT_PATH, 'common-outputs.txt')
13511352
paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt")
@@ -4637,6 +4638,8 @@ def decodeDbmsHexValue(value, raw=False):
46374638
def _(value):
46384639
retVal = value
46394640
if value and isinstance(value, six.string_types):
4641+
value = value.strip()
4642+
46404643
if len(value) % 2 != 0:
46414644
retVal = (decodeHex(value[:-1]) + b'?') if len(value) > 1 else value
46424645
singleTimeWarnMessage("there was a problem decoding value '%s' from expected hexadecimal form" % value)

‎lib/core/optiondict.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@
160160
"Brute": {
161161
"commonTables": "boolean",
162162
"commonColumns": "boolean",
163+
"commonFiles": "boolean",
163164
},
164165

165166
"User-defined function": {

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.6.56"
21+
VERSION = "1.3.6.57"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/core/target.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -586,7 +586,7 @@ def _createFilesDir():
586586
Create the file directory.
587587
"""
588588

589-
if not conf.fileRead:
589+
if not any((conf.fileRead, conf.commonFiles)):
590590
return
591591

592592
conf.filePath = paths.SQLMAP_FILES_PATH % conf.hostname

‎lib/core/threads.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,6 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
204204
traceback.print_exc()
205205

206206
finally:
207-
kb.bruteMode = False
208207
kb.threadContinue = True
209208
kb.threadException = False
210209

‎lib/parse/cmdline.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -502,6 +502,9 @@ def cmdLineParser(argv=None):
502502
brute.add_argument("--common-columns", dest="commonColumns", action="store_true",
503503
help="Check existence of common columns")
504504

505+
brute.add_argument("--common-files", dest="commonFiles", action="store_true",
506+
help="Check existence of common files")
507+
505508
# User-defined function options
506509
udf = parser.add_argument_group("User-defined function injection", "These options can be used to create custom user-defined functions")
507510

‎lib/takeover/udf.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ def udfEvalCmd(self, cmd, first=None, last=None, udfName=None):
109109
return output
110110

111111
def udfCheckNeeded(self):
112-
if (not conf.fileRead or (conf.fileRead and not Backend.isDbms(DBMS.PGSQL))) and "sys_fileread" in self.sysUdfs:
112+
if (not any((conf.fileRead, conf.commonFiles)) or (any((conf.fileRead, conf.commonFiles)) and not Backend.isDbms(DBMS.PGSQL))) and "sys_fileread" in self.sysUdfs:
113113
self.sysUdfs.pop("sys_fileread")
114114

115115
if not conf.osPwn:

‎lib/techniques/error/use.py‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
from lib.core.enums import DBMS
4444
from lib.core.enums import HASHDB_KEYS
4545
from lib.core.enums import HTTP_HEADER
46+
from lib.core.enums import PAYLOAD
4647
from lib.core.exception import SqlmapDataException
4748
from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD
4849
from lib.core.settings import MAX_ERROR_CHUNK_LENGTH
@@ -123,7 +124,7 @@ def _oneShotErrorUse(expression, field=None, chunkTest=False):
123124
nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, kb.errorChunkLength)
124125

125126
# Forge the error-based SQL injection request
126-
vector = kb.injection.data[kb.technique].vector
127+
vector = kb.injection.data[PAYLOAD.TECHNIQUE.ERROR].vector
127128
query = agent.prefixQuery(vector)
128129
query = agent.suffixQuery(query)
129130
injExpression = expression.replace(field, nulledCastedField, 1) if field else expression
@@ -134,7 +135,7 @@ def _oneShotErrorUse(expression, field=None, chunkTest=False):
134135
# Perform the request
135136
page, headers, _ = Request.queryPage(payload, content=True, raise404=False)
136137

137-
incrementCounter(kb.technique)
138+
incrementCounter(PAYLOAD.TECHNIQUE.ERROR)
138139

139140
if page and conf.noEscape:
140141
page = re.sub(r"('|\%%27)%s('|\%%27).*?('|\%%27)%s('|\%%27)" % (kb.chars.start, kb.chars.stop), "", page)
@@ -247,7 +248,7 @@ def _errorFields(expression, expressionFields, expressionFieldsList, num=None, e
247248
if not kb.threadContinue:
248249
return None
249250

250-
if not suppressOutput:
251+
if not any((suppressOutput, kb.bruteMode)):
251252
if kb.fileReadMode and output and output.strip():
252253
print()
253254
elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields):
@@ -298,7 +299,7 @@ def errorUse(expression, dump=False):
298299
SQL injection vulnerability on the affected parameter.
299300
"""
300301

301-
initTechnique(kb.technique)
302+
initTechnique(PAYLOAD.TECHNIQUE.ERROR)
302303

303304
abortedFlag = False
304305
count = None
@@ -460,7 +461,7 @@ def errorThread():
460461
duration = calculateDeltaSeconds(start)
461462

462463
if not kb.bruteMode:
463-
debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[kb.technique], duration)
464+
debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[PAYLOAD.TECHNIQUE.ERROR], duration)
464465
logger.debug(debugMsg)
465466

466467
return value

0 commit comments

Comments
 (0)