Skip to content

Commit 8134c21

Browse files
stamparmstamparm
committed
adding WHERE enum for payloads
1 parent d6c9515 commit 8134c21

6 files changed

Lines changed: 22 additions & 16 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -253,15 +253,15 @@ def checkSqlInjection(place, parameter, value):
253253

254254
# Threat the parameter original value according to the
255255
# test's <where> tag
256-
if where == 1:
256+
if where == PAYLOAD.WHERE.ORIGINAL:
257257
origValue = value
258-
elif where == 2:
258+
elif where == PAYLOAD.WHERE.NEGATIVE:
259259
# Use different page template than the original
260260
# one as we are changing parameters value, which
261261
# will likely result in a different content
262262
origValue = "-%s" % randomInt()
263263
templatePayload = agent.payload(place, parameter, newValue=origValue, where=where)
264-
elif where == 3:
264+
elif where == PAYLOAD.WHERE.REPLACE:
265265
origValue = ""
266266

267267
kb.pageTemplate, kb.errorIsNone = getPageTemplate(templatePayload, place)

‎lib/core/agent.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,14 +80,14 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, where=N
8080
origValue = origValue[origValue.rfind('/') + 1:]
8181

8282
if value is None:
83-
if where == 1:
83+
if where == PAYLOAD.WHERE.ORIGINAL:
8484
value = origValue
85-
elif where == 2:
85+
elif where == PAYLOAD.WHERE.NEGATIVE:
8686
if newValue.startswith("-"):
8787
value = ""
8888
else:
8989
value = "-%s" % randomInt()
90-
elif where == 3:
90+
elif where == PAYLOAD.WHERE.REPLACE:
9191
value = ""
9292
else:
9393
value = origValue
@@ -144,7 +144,7 @@ def prefixQuery(self, string, prefix=None, where=None, clause=None):
144144

145145
# If we are replacing (<where>) the parameter original value with
146146
# our payload do not prepend with the prefix
147-
if where == 3:
147+
if where == PAYLOAD.WHERE.REPLACE:
148148
query = ""
149149

150150
# If the technique is stacked queries (<stype>) do not put a space
@@ -185,7 +185,7 @@ def suffixQuery(self, string, comment=None, suffix=None, where=None):
185185

186186
# If we are replacing (<where>) the parameter original value with
187187
# our payload do not append the suffix
188-
if where == 3:
188+
if where == PAYLOAD.WHERE.REPLACE:
189189
pass
190190

191191
elif kb.injection.suffix is not None:

‎lib/core/enums.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,3 +115,8 @@ class TECHNIQUE:
115115
UNION = 3
116116
STACKED = 4
117117
TIME = 5
118+
119+
class WHERE:
120+
ORIGINAL = 1
121+
NEGATIVE = 2
122+
REPLACE = 3

‎lib/takeover/web.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from lib.core.data import kb
3232
from lib.core.data import logger
3333
from lib.core.data import paths
34+
from lib.core.enums import PAYLOAD
3435
from lib.core.exception import sqlmapUnsupportedDBMSException
3536
from lib.core.shell import autoCompletion
3637
from lib.request.connect import Connect as Request
@@ -108,7 +109,7 @@ def __webFileInject(self, fileContent, fileName, directory):
108109
if isTechniqueAvailable(kb.technique):
109110
where = kb.injection.data[kb.technique].where
110111

111-
if where == 2:
112+
if where == PAYLOAD.WHERE.NEGATIVE:
112113
randInt = randomInt()
113114
query += "OR %d=%d " % (randInt, randInt)
114115

‎lib/techniques/inband/union/test.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
from lib.request.comparison import comparison
3838
from lib.request.connect import Connect as Request
3939

40-
def __findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=1):
40+
def __findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=PAYLOAD.WHERE.ORIGINAL):
4141
"""
4242
Finds number of columns affected by UNION based injection
4343
"""
@@ -83,7 +83,7 @@ def __findUnionCharCount(comment, place, parameter, value, prefix, suffix, where
8383

8484
return retVal
8585

86-
def __unionPosition(comment, place, parameter, value, prefix, suffix, count, where=1):
86+
def __unionPosition(comment, place, parameter, value, prefix, suffix, count, where=PAYLOAD.WHERE.ORIGINAL):
8787
validPayload = None
8888
vector = None
8989

@@ -109,7 +109,7 @@ def __unionPosition(comment, place, parameter, value, prefix, suffix, count, whe
109109
validPayload = payload
110110
vector = (position, count, comment, prefix, suffix, conf.uChar, where)
111111

112-
if where == 1:
112+
if where == PAYLOAD.WHERE.ORIGINAL:
113113
# Prepare expression with delimiters
114114
randQuery2 = randomStr()
115115
phrase2 = "%s%s%s" % (kb.misc.start, randQuery2, kb.misc.stop)
@@ -118,14 +118,14 @@ def __unionPosition(comment, place, parameter, value, prefix, suffix, count, whe
118118

119119
# Confirm that it is a full inband SQL injection
120120
query = agent.forgeInbandQuery(randQueryUnescaped, position, count, comment, prefix, suffix, conf.uChar, multipleUnions=randQueryUnescaped2)
121-
payload = agent.payload(place=place, parameter=parameter, newValue=query, where=2)
121+
payload = agent.payload(place=place, parameter=parameter, newValue=query, where=PAYLOAD.WHERE.NEGATIVE)
122122

123123
# Perform the request
124124
page, headers = Request.queryPage(payload, place=place, content=True, raise404=False)
125125
content = "%s%s" % (page or "", listToStrValue(headers.headers if headers else None) or "")
126126

127127
if content and ((phrase in content and phrase2 not in content) or (phrase not in content and phrase2 in content)):
128-
vector = (position, count, comment, prefix, suffix, conf.uChar, 2)
128+
vector = (position, count, comment, prefix, suffix, conf.uChar, PAYLOAD.WHERE.NEGATIVE)
129129

130130
break
131131

‎lib/techniques/inband/union/use.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ def __oneShotUnionUse(expression, unpack=True, unescape=True):
4141
expression = unescaper.unescape(expression)
4242

4343
if conf.limitStart or conf.limitStop:
44-
where = 2
44+
where = PAYLOAD.WHERE.NEGATIVE
4545
else:
4646
where = None
4747

@@ -129,7 +129,7 @@ def unionUse(expression, unescape=True, unpack=True, dump=False):
129129
# entry per time
130130
# NOTE: I assume that only queries that get data from a table can
131131
# return multiple entries
132-
if (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == 2 or \
132+
if (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.NEGATIVE or \
133133
(dump and (conf.limitStart or conf.limitStop))) and \
134134
" FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \
135135
not in FROM_TABLE) or (Backend.getIdentifiedDbms() in FROM_TABLE \

0 commit comments

Comments
 (0)