Skip to content

Commit bcbf057

Browse files
stamparmstamparm
committed
Implementation for an Issue sqlmapproject#49 
1 parent 763dc98 commit bcbf057

File tree

4 files changed

+52
-36
lines changed

4 files changed

+52
-36
lines changed

‎lib/core/agent.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, where=N
117117

118118
retVal = ET.tostring(root)
119119
elif place in (PLACE.URI, PLACE.CUSTOM_POST):
120-
retVal = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue))
120+
retVal = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)).replace(CUSTOM_INJECTION_MARK_CHAR, "")
121121
elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST):
122122
retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
123123
else:

‎lib/core/settings.py

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@
2525
GIT_REPOSITORY = "git://github.com/sqlmapproject/sqlmap.git"
2626
ML = "sqlmap-users@lists.sourceforge.net"
2727

28-
# minimum distance of ratio from kb.matchRatio to result in True
28+
# Minimum distance of ratio from kb.matchRatio to result in True
2929
DIFF_TOLERANCE = 0.05
3030
CONSTANT_RATIO = 0.9
3131

32-
# lower and upper values for match ratio in case of stable page
32+
# Lower and upper values for match ratio in case of stable page
3333
LOWER_RATIO_BOUND = 0.02
3434
UPPER_RATIO_BOUND = 0.98
3535

36-
# markers for special cases when parameter values contain html encoded characters
36+
# Markers for special cases when parameter values contain html encoded characters
3737
PARAMETER_AMP_MARKER = "__AMP__"
3838
PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__"
3939

@@ -45,90 +45,89 @@
4545
CHAR_INFERENCE_MARK = "%c"
4646
PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7e-\xff]"
4747

48-
# regular expression used for recognition of generic permission messages
48+
# Regular expression used for recognition of generic permission messages
4949
PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied"
5050

51-
# regular expression used for recognition of generic maximum connection messages
51+
# Regular expression used for recognition of generic maximum connection messages
5252
MAX_CONNECTIONS_REGEX = r"max.+connections"
5353

54-
# regular expression used for extracting results from google search
54+
# Regular expression used for extracting results from google search
5555
GOOGLE_REGEX = r"url\?\w+=(http[^>]+)&(sa=U|rct=j)"
5656

57-
# regular expression used for extracting content from "textual" tags
57+
# Regular expression used for extracting content from "textual" tags
5858
TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P<result>[^<]+)"
5959

60-
# dumping characters used in GROUP_CONCAT MySQL technique
60+
# Dumping characters used in GROUP_CONCAT MySQL technique
6161
CONCAT_ROW_DELIMITER = ','
6262
CONCAT_VALUE_DELIMITER = '|'
6363

64-
# coefficient used for a time-based query delay checking (must be >= 7)
64+
# Coefficient used for a time-based query delay checking (must be >= 7)
6565
TIME_STDEV_COEFF = 7
6666

67-
# standard deviation after which a warning message should be displayed about connection lags
67+
# Standard deviation after which a warning message should be displayed about connection lags
6868
WARN_TIME_STDEV = 0.5
6969

70-
# minimum length of usable union injected response (quick defense against substr fields)
70+
# Minimum length of usable union injected response (quick defense against substr fields)
7171
UNION_MIN_RESPONSE_CHARS = 10
7272

73-
# coefficient used for a union-based number of columns checking (must be >= 7)
73+
# Coefficient used for a union-based number of columns checking (must be >= 7)
7474
UNION_STDEV_COEFF = 7
7575

76-
# length of queue for candidates for time delay adjustment
76+
# Length of queue for candidates for time delay adjustment
7777
TIME_DELAY_CANDIDATES = 3
7878

79-
# default value for HTTP Accept header
79+
# Default value for HTTP Accept header
8080
HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
8181

82-
# default value for HTTP Accept-Encoding header
82+
# Default value for HTTP Accept-Encoding header
8383
HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate"
8484

8585
# HTTP timeout in silent mode
8686
HTTP_SILENT_TIMEOUT = 3
8787

88-
# maximum number of techniques used in inject.py/getValue() per one value
88+
# Maximum number of techniques used in inject.py/getValue() per one value
8989
MAX_TECHNIQUES_PER_VALUE = 2
9090

91-
# suffix used for naming meta databases in DBMS(es) without explicit database name
91+
# Suffix used for naming meta databases in DBMS(es) without explicit database name
9292
METADB_SUFFIX = "_masterdb"
9393

94-
# minimum time response set needed for time-comparison based on standard deviation
94+
# Minimum time response set needed for time-comparison based on standard deviation
9595
MIN_TIME_RESPONSES = 10
9696

97-
# minimum comparison ratio set needed for searching valid union column number based on standard deviation
97+
# Minimum comparison ratio set needed for searching valid union column number based on standard deviation
9898
MIN_UNION_RESPONSES = 5
9999

100-
# after these number of blanks at the end inference should stop (just in case)
100+
# After these number of blanks at the end inference should stop (just in case)
101101
INFERENCE_BLANK_BREAK = 10
102102

103-
# use this replacement character for cases when inference is not able to retrieve the proper character value
103+
# Use this replacement character for cases when inference is not able to retrieve the proper character value
104104
INFERENCE_UNKNOWN_CHAR = '?'
105105

106-
# character used for operation "greater" in inference
106+
# Character used for operation "greater" in inference
107107
INFERENCE_GREATER_CHAR = ">"
108108

109-
# character used for operation "equals" in inference
109+
# Character used for operation "equals" in inference
110110
INFERENCE_EQUALS_CHAR = "="
111111

112-
# character used for operation "not-equals" in inference
112+
# Character used for operation "not-equals" in inference
113113
INFERENCE_NOT_EQUALS_CHAR = "!="
114114

115-
# string used for representation of unknown dbms version
115+
# String used for representation of unknown dbms version
116116
UNKNOWN_DBMS_VERSION = "Unknown"
117117

118-
# dynamicity mark length used in dynamicity removal engine
118+
# Dynamicity mark length used in dynamicity removal engine
119119
DYNAMICITY_MARK_LENGTH = 32
120120

121-
# dummy user prefix used in dictionary attack
121+
# Dummy user prefix used in dictionary attack
122122
DUMMY_USER_PREFIX = "__dummy__"
123123

124124
# Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1
125125
DEFAULT_PAGE_ENCODING = "iso-8859-1"
126126

127127
# System variables
128128
IS_WIN = subprocess.mswindows
129-
# The name of the operating system dependent module imported. The following
130-
# names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce',
131-
# 'java', 'riscos'
129+
130+
# The name of the operating system dependent module imported. The following names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', 'java', 'riscos'
132131
PLATFORM = os.name
133132
PYVERSION = sys.version.split()[0]
134133

@@ -171,7 +170,7 @@
171170
REFERER_ALIASES = ( "ref", "referer", "referrer" )
172171
HOST_ALIASES = ( "host", )
173172

174-
# items displayed in basic help (-h) output
173+
# Items displayed in basic help (-h) output
175174
BASIC_HELP_ITEMS = (
176175
"url",
177176
"googleDork",
@@ -205,13 +204,13 @@
205204
"wizard"
206205
)
207206

208-
# string representation for NULL value
207+
# String representation for NULL value
209208
NULL = "NULL"
210209

211-
# string representation for blank ('') value
210+
# String representation for blank ('') value
212211
BLANK = "<blank>"
213212

214-
# string representation for current database
213+
# String representation for current database
215214
CURRENT_DB = "CD"
216215

217216
# Regular expressions used for parsing error messages (--parse-errors)
@@ -470,3 +469,6 @@
470469

471470
# Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems)
472471
LIMITED_ROWS_TEST_NUMBER = 15
472+
473+
# Regular expressing used for detecting JSON-like POST data
474+
JSON_RECOGNITION_REGEX = r'(?s)\A\s*.*"[^"]+"\s*:\s*"[^"]+".+\}\s*\Z'

‎lib/core/target.py

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
from lib.core.option import __setAuthCred
4040
from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
4141
from lib.core.settings import HOST_ALIASES
42+
from lib.core.settings import JSON_RECOGNITION_REGEX
4243
from lib.core.settings import REFERER_ALIASES
4344
from lib.core.settings import RESULTS_FILE_FORMAT
4445
from lib.core.settings import SOAP_REGEX
@@ -110,11 +111,23 @@ def __setRequestParams():
110111
elif test[0] in ("q", "Q"):
111112
raise sqlmapUserQuitException
112113

114+
115+
if re.search(JSON_RECOGNITION_REGEX, conf.data or ""):
116+
message = "JSON like data found in POST data. "
117+
message += "Do you want to process it? [Y/n/q] "
118+
test = readInput(message, default="Y")
119+
if test and test[0] in ("q", "Q"):
120+
raise sqlmapUserQuitException
121+
elif test[0] not in ("n", "N"):
122+
conf.data = re.sub(r'("[^"]+"\s*:\s*"[^"]+)"', r'\g<1>*"', conf.data or "")
123+
kb.processUserMarks = True
124+
113125
for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data)):
114126
if CUSTOM_INJECTION_MARK_CHAR in (value or ""):
115127
if kb.processUserMarks is None:
128+
_ = {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data'}
116129
message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR
117-
message += "'%s'. Do you want to process it? [Y/n/q] " % {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data'}[place]
130+
message += "'%s'. Do you want to process it? [Y/n/q] " % _[place]
118131
test = readInput(message, default="Y")
119132
if test and test[0] in ("q", "Q"):
120133
raise sqlmapUserQuitException

‎lib/request/connect.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -685,6 +685,7 @@ def _randomizeParameter(paramString, randomParameter):
685685
msg += "which is usually causing problems "
686686
msg += "in this kind of situations? [Y/n]"
687687
skipUrlEncode = conf.skipUrlEncode = readInput(msg, default="Y").upper() != "N"
688+
688689
if place not in (PLACE.POST, PLACE.SOAP, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE):
689690
post = getattr(post, UNENCODED_ORIGINAL_VALUE)
690691
elif not skipUrlEncode and place not in (PLACE.SOAP,):

0 commit comments

Comments
 (0)