CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 06:50:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module).

Browse source 
Minor layout adjustments.
This commit is contained in:
Bernardo Damele 2010-03-26 23:23:25 +00:00
parent 4ca1adba2c
commit 1416cd0d86
32 changed files with 791 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/controller/action.py
View file

@ -43,7 +43,7 @@ def action():
# First of all we have to identify the back-end database management
# system to be able to go ahead with the injection
conf.dbmsHandler = setHandler()
setHandler()
if not conf.dbmsHandler:
htmlParsed = getHtmlErrorFp()
@ -166,3 +166,6 @@ def action():
# Miscellaneous options
if conf.cleanup:
conf.dbmsHandler.cleanup()
if conf.direct:
conf.dbmsConnector.close()

15
lib/controller/controller.py
View file

@ -76,7 +76,7 @@ def __selectInjection(injData):
return "Quit"
else:
warnMsg = "Invalid choice, retry"
warnMsg = "invalid choice, retry"
logger.warn(warnMsg)
__selectInjection(injData)
@ -92,6 +92,13 @@ def start():
if not conf.start:
return
if conf.direct:
initTargetEnv()
setupTargetEnv()
action()
return
if conf.url:
kb.targetUrls.add(( conf.url, conf.method, conf.data, conf.cookie ))
@ -104,9 +111,9 @@ def start():
infoMsg = "sqlmap got a total of %d targets" % len(kb.targetUrls)
logger.info(infoMsg)
hostCount = 0
cookieStr = ""
setCookieAsInjectable = True
hostCount = 0
cookieStr = ""
setCookieAsInjectable = True
for targetUrl, targetMethod, targetData, targetCookie in kb.targetUrls:
try:

32
lib/controller/handler.py
View file

@ -34,12 +34,19 @@ from lib.core.settings import ACCESS_ALIASES
from lib.core.settings import FIREBIRD_ALIASES
from plugins.dbms.mssqlserver import MSSQLServerMap
from plugins.dbms.mssqlserver.connector import Connector as MSSQLServerConn
from plugins.dbms.mysql import MySQLMap
from plugins.dbms.mysql.connector import Connector as MySQLConn
from plugins.dbms.oracle import OracleMap
from plugins.dbms.oracle.connector import Connector as OracleConn
from plugins.dbms.postgresql import PostgreSQLMap
from plugins.dbms.postgresql.connector import Connector as PostgreSQLConn
from plugins.dbms.sqlite import SQLiteMap
from plugins.dbms.sqlite.connector import Connector as SQLiteConn
from plugins.dbms.access import AccessMap
from plugins.dbms.access.connector import Connector as AccessConn
from plugins.dbms.firebird import FirebirdMap
from plugins.dbms.firebird.connector import Connector as FirebirdConn
def setHandler():
"""
@ -50,16 +57,16 @@ def setHandler():
count = 0
dbmsNames = ( "MySQL", "Oracle", "PostgreSQL", "Microsoft SQL Server", "SQLite", "Microsoft Access", "Firebird" )
dbmsMap = (
( MYSQL_ALIASES, MySQLMap ),
( ORACLE_ALIASES, OracleMap ),
( PGSQL_ALIASES, PostgreSQLMap ),
( MSSQL_ALIASES, MSSQLServerMap ),
( SQLITE_ALIASES, SQLiteMap ),
( ACCESS_ALIASES, AccessMap ),
( FIREBIRD_ALIASES, FirebirdMap ),
( MYSQL_ALIASES, MySQLMap, MySQLConn ),
( ORACLE_ALIASES, OracleMap, OracleConn ),
( PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn ),
( MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn ),
( SQLITE_ALIASES, SQLiteMap, SQLiteConn ),
( ACCESS_ALIASES, AccessMap, AccessConn ),
( FIREBIRD_ALIASES, FirebirdMap, FirebirdConn ),
)
for dbmsAliases, dbmsEntry in dbmsMap:
for dbmsAliases, dbmsMap, dbmsConn in dbmsMap:
if conf.dbms and conf.dbms not in dbmsAliases:
debugMsg = "skipping test for %s" % dbmsNames[count]
logger.debug(debugMsg)
@ -68,12 +75,15 @@ def setHandler():
continue
handler = dbmsEntry()
handler = dbmsMap()
conf.dbmsConnector = dbmsConn()
if handler.checkDbms():
if not conf.dbms or conf.dbms in dbmsAliases:
kb.dbmsDetected = True
return handler
conf.dbmsHandler = handler
return None
return
else:
conf.dbmsConnector = None

22
lib/core/agent.py
View file

@ -44,12 +44,25 @@ class Agent:
temp.start = randomStr(6)
temp.stop = randomStr(6)
def payloadDirect(self, query):
if query.startswith(" AND "):
query = query.replace(" AND ", "SELECT ")
elif query.startswith(" UNION ALL "):
query = query.replace(" UNION ALL ", "")
elif query.startswith("; "):
query = query.replace("; ", "")
return query
def payload(self, place=None, parameter=None, value=None, newValue=None, negative=False, falseCond=False):
"""
This method replaces the affected parameter with the SQL
injection statement to request
"""
if conf.direct:
return self.payloadDirect(newValue)
falseValue = ""
negValue = ""
retValue = ""
@ -83,6 +96,9 @@ class Agent:
return retValue
def fullPayload(self, query):
if conf.direct:
return self.payloadDirect(query)
query = self.prefixQuery(query)
query = self.postfixQuery(query)
payload = self.payload(newValue=query)
@ -96,6 +112,9 @@ class Agent:
identified as valid
"""
if conf.direct:
return self.payloadDirect(string)
query = ""
if conf.prefix:
@ -123,6 +142,9 @@ class Agent:
SQL injection request
"""
if conf.direct:
return self.payloadDirect(string)
randInt = randomInt()
randStr = randomStr()

73
lib/core/common.py
View file

@ -47,12 +47,21 @@ from lib.core.data import temp
from lib.core.convert import urlencode
from lib.core.exception import sqlmapFilePathException
from lib.core.exception import sqlmapNoneDataException
from lib.core.exception import sqlmapMissingDependence
from lib.core.exception import sqlmapSyntaxException
from lib.core.settings import DESCRIPTION
from lib.core.settings import IS_WIN
from lib.core.settings import SITE
from lib.core.settings import SQL_STATEMENTS
from lib.core.settings import SUPPORTED_DBMS
from lib.core.settings import VERSION_STRING
from lib.core.settings import MSSQL_ALIASES
from lib.core.settings import MYSQL_ALIASES
from lib.core.settings import PGSQL_ALIASES
from lib.core.settings import ORACLE_ALIASES
from lib.core.settings import SQLITE_ALIASES
from lib.core.settings import ACCESS_ALIASES
from lib.core.settings import FIREBIRD_ALIASES
def paramToDict(place, parameters=None):
"""
@ -319,7 +328,7 @@ def getDirs(webApi=None):
[directories.add(directory) for directory in defaultDirs]
return directories
def filePathToString(filePath):
strRepl = filePath.replace("/", "_").replace("\\", "_")
strRepl = strRepl.replace(" ", "_").replace(":", "_")
@ -329,18 +338,18 @@ def filePathToString(filePath):
def dataToStdout(data):
sys.stdout.write(data)
sys.stdout.flush()
def dataToSessionFile(data):
if not conf.sessionFile:
return
conf.sessionFP.write(data)
conf.sessionFP.flush()
def dataToDumpFile(dumpFile, data):
dumpFile.write(data)
dumpFile.flush()
def dataToOutFile(data):
if not data:
return "No data retrieved"
@ -586,10 +595,62 @@ def weAreFrozen():
return hasattr(sys, "frozen")
def parseTargetDirect():
"""
Parse target dbms and set some attributes into the configuration singleton.
"""
if not conf.direct:
return
details = None
for dbms in SUPPORTED_DBMS:
details = re.search("^(%s)://(.+?)\:(.+?)\@(.+?)\:([\d]+)\/(.+?)$" % dbms, conf.direct, re.I)
if details:
conf.dbms = details.group(1)
conf.dbmsUser = details.group(2)
conf.dbmsPass = details.group(3)
conf.hostname = details.group(4)
conf.port = int(details.group(5))
conf.dbmsDb = details.group(6)
conf.parameters[None] = "direct connection"
break
if not details:
errMsg = "invalid target details, valid syntax is for instance: mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME"
raise sqlmapSyntaxException, errMsg
# TODO: add details for others python DBMS libraries
dbmsDict = { "Microsoft SQL Server": [MSSQL_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/"],
"MySQL": [MYSQL_ALIASES, "python-mysqldb", "http://mysql-python.sourceforge.net/"],
"PostgreSQL": [PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/"],
"Oracle": [ORACLE_ALIASES, "", ""],
"SQLite": [SQLITE_ALIASES, "", ""],
"Access": [ACCESS_ALIASES, "", ""],
"Firebird": [FIREBIRD_ALIASES, "", ""] }
for dbmsName, data in dbmsDict.items():
if conf.dbms in data[0]:
try:
if dbmsName == "Microsoft SQL Server":
import pymssql
elif dbmsName == "MySQL":
import MySQLdb
elif dbmsName == "PostgreSQL":
import psycopg2
except ImportError, _:
errMsg = "sqlmap requires %s third-party library " % data[1]
errMsg += "in order to directly connect to the database "
errMsg += "%s. Download from %s" % (dbmsName, data[2])
raise sqlmapMissingDependence, errMsg
def parseTargetUrl():
"""
Parse target url and set some attributes into the configuration
singleton.
Parse target url and set some attributes into the configuration singleton.
"""
if not conf.url:

5
lib/core/convert.py
View file

@ -32,6 +32,8 @@ import sys
import struct
import urllib
from lib.core.data import conf
def base64decode(string):
return string.decode("base64")
@ -77,6 +79,9 @@ def urldecode(string):
return result
def urlencode(string, safe=":/?%&=", convall=False):
if conf.direct:
return string
result = None
if string is None:

6
lib/core/dump.py
View file

@ -92,7 +92,7 @@ class Dump:
if isinstance(element, str):
self.__write("[*] %s" % element)
elif isinstance(element, (list, tuple, set)):
self.__write("[*] " + ", ".join(e for e in element))
self.__write("[*] " + ", ".join(str(e) for e in element))
if elements:
self.__write("")
@ -321,11 +321,11 @@ class Dump:
info = tableValues[column]
value = info["values"][i]
if re.search("^[\ *]*$", value):
if re.search("^[\ *]*$", str(value)):
value = "NULL"
maxlength = int(info["length"])
blank = " " * (maxlength - len(value))
blank = " " * (maxlength - len(str(value)))
self.__write("| %s%s" % (value, blank), n=False)
if not conf.multipleTargets and field == fields:

46
lib/core/option.py
View file

@ -37,6 +37,7 @@ from ConfigParser import ConfigParser
from lib.core.common import getFileType
from lib.core.common import normalizePath
from lib.core.common import ntToPosixSlashes
from lib.core.common import parseTargetDirect
from lib.core.common import parseTargetUrl
from lib.core.common import paths
from lib.core.common import randomRange
@ -58,6 +59,9 @@ from lib.core.settings import MSSQL_ALIASES
from lib.core.settings import MYSQL_ALIASES
from lib.core.settings import PGSQL_ALIASES
from lib.core.settings import ORACLE_ALIASES
from lib.core.settings import SQLITE_ALIASES
from lib.core.settings import ACCESS_ALIASES
from lib.core.settings import FIREBIRD_ALIASES
from lib.core.settings import IS_WIN
from lib.core.settings import PLATFORM
from lib.core.settings import SITE
@ -493,7 +497,10 @@ def __setDBMS():
firstRegExp = "(%s|%s|%s|%s)" % ("|".join([alias for alias in MSSQL_ALIASES]),
"|".join([alias for alias in MYSQL_ALIASES]),
"|".join([alias for alias in PGSQL_ALIASES]),
"|".join([alias for alias in ORACLE_ALIASES]))
"|".join([alias for alias in ORACLE_ALIASES]),
"|".join([alias for alias in SQLITE_ALIASES]),
"|".join([alias for alias in ACCESS_ALIASES]),
"|".join([alias for alias in FIREBIRD_ALIASES]))
dbmsRegExp = re.search("%s ([\d\.]+)" % firstRegExp, conf.dbms)
if dbmsRegExp:
@ -606,7 +613,7 @@ def __setHTTPAuthentication():
elif aTypeLower == "digest":
authHandler = urllib2.HTTPDigestAuthHandler(passwordMgr)
elif aTypeLower == "ntlm":
try:
from ntlm import HTTPNtlmAuthHandler
@ -861,6 +868,7 @@ def __setConfAttributes():
logger.debug(debugMsg)
conf.cj = None
conf.dbmsConnector = None
conf.dbmsHandler = None
conf.dumpPath = None
conf.httpHeaders = []
@ -1045,28 +1053,30 @@ def init(inputOptions=advancedDict()):
__setConfAttributes()
__setKnowledgeBaseAttributes()
__cleanupOptions()
__setRequestFromFile()
parseTargetUrl()
__setHTTPTimeout()
__setHTTPCookies()
__setHTTPReferer()
__setHTTPUserAgent()
__setHTTPExtraHeaders()
__setHTTPMethod()
__setHTTPAuthentication()
__setHTTPProxy()
parseTargetUrl()
parseTargetDirect()
if conf.url or conf.list or conf.requestFile or conf.googleDork:
__setHTTPTimeout()
__setHTTPCookies()
__setHTTPReferer()
__setHTTPUserAgent()
__setHTTPExtraHeaders()
__setHTTPMethod()
__setHTTPAuthentication()
__setHTTPProxy()
__setUnionTech()
__setGoogleDorking()
__setMultipleTargets()
__urllib2Opener()
__setDBMS()
__setThreads()
__setDBMS()
__setOS()
__setUnionTech()
__setWriteFile()
__setMetasploit()
__setGoogleDorking()
__setMultipleTargets()
__urllib2Opener()
update()
queriesParser()

1
lib/core/optiondict.py
View file

@ -25,6 +25,7 @@ Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
optDict = {
# Family: { "parameter_name": "parameter_datatype" },
"Target": {
"direct": "string",
"url": "string",
"list": "string",
"requestFile": "string",

4
lib/core/target.py
View file

@ -43,6 +43,10 @@ def __setRequestParams():
HTTP method POST.
"""
if conf.direct:
conf.parameters[None] = "direct connection"
return
__testableParameters = False
# Perform checks on GET parameters

7
lib/parse/cmdline.py
View file

@ -48,6 +48,9 @@ def cmdLineParser():
"options has to be specified to set the source "
"to get target urls from.")
target.add_option("-d", dest="direct", help="Direct "
"connection to the database")
target.add_option("-u", "--url", dest="url", help="Target url")
target.add_option("-l", dest="list", help="Parse targets from Burp "
@ -437,8 +440,8 @@ def cmdLineParser():
(args, _) = parser.parse_args()
if not args.url and not args.list and not args.googleDork and not args.configFile and not args.requestFile and not args.updateAll:
errMsg = "missing a mandatory parameter ('-u', '-l', '-r', '-g', '-c' or '--update'), "
if not args.direct and not args.url and not args.list and not args.googleDork and not args.configFile and not args.requestFile and not args.updateAll:
errMsg = "missing a mandatory parameter ('-d', '-u', '-l', '-r', '-g', '-c' or '--update'), "
errMsg += "-h for help"
parser.error(errMsg)

33
lib/request/connect.py
View file

@ -38,6 +38,7 @@ from lib.core.data import kb
from lib.core.data import logger
from lib.core.common import sanitizeAsciiString
from lib.core.exception import sqlmapConnectionException
from lib.core.settings import SQL_STATEMENTS
from lib.request.basic import decodePage
from lib.request.basic import forgeHeaders
from lib.request.basic import parseResponse
@ -263,6 +264,38 @@ class Connect:
string match check ('--string' command line parameter)
"""
if conf.direct:
values = None
select = False
for sqlTitle, sqlStatements in SQL_STATEMENTS.items():
for sqlStatement in sqlStatements:
if value.lower().startswith(sqlStatement) and sqlTitle == "SQL SELECT statement":
select = True
break
if select:
values = conf.dbmsConnector.select(value)
else:
values = conf.dbmsConnector.execute(value)
if values is None or len(values) == 0:
return None
elif content:
if len(values) == 1:
if len(values[0]) == 1:
return str(list(values)[0][0]), None
else:
return list(values), None
else:
return values, None
else:
for value in values:
if value[0] == 1:
return True
else:
return False
get = None
post = None
cookie = None

45
lib/request/inject.py
View file

@ -37,6 +37,7 @@ from lib.core.data import logger
from lib.core.data import queries
from lib.core.data import temp
from lib.request.connect import Connect as Request
from lib.core.settings import SQL_STATEMENTS
from lib.techniques.inband.union.use import unionUse
from lib.techniques.blind.inference import bisection
from lib.utils.resume import queryOutputLength
@ -350,6 +351,32 @@ def getValue(expression, blind=True, inband=True, fromUser=False, expected=None,
(if selected).
"""
if conf.direct:
expression = agent.payloadDirect(expression)
values = None
select = False
for sqlTitle, sqlStatements in SQL_STATEMENTS.items():
for sqlStatement in sqlStatements:
if expression.lower().startswith(sqlStatement) and sqlTitle == "SQL SELECT statement":
select = True
break
if select:
values = conf.dbmsConnector.select(expression)
else:
values = conf.dbmsConnector.execute(expression)
if values is None or len(values) == 0:
return None
elif len(values) == 1:
if len(values[0]) == 1:
return str(list(values)[0][0])
else:
return list(values)
else:
return values
expression = cleanQuery(expression)
expression = expandAsteriskForColumns(expression)
value = None
@ -387,6 +414,24 @@ def getValue(expression, blind=True, inband=True, fromUser=False, expected=None,
def goStacked(expression, silent=False):
expression = cleanQuery(expression)
if conf.direct:
expression = agent.payloadDirect(expression)
values = None
select = False
for sqlTitle, sqlStatements in SQL_STATEMENTS.items():
for sqlStatement in sqlStatements:
if expression.lower().startswith(sqlStatement) and sqlTitle == "SQL SELECT statement":
select = True
break
if select:
values = conf.dbmsConnector.select(expression)
else:
values = conf.dbmsConnector.execute(expression)
return None, None
debugMsg = "query: %s" % expression
logger.debug(debugMsg)

3
lib/techniques/inband/union/test.py
View file

@ -200,6 +200,9 @@ def unionTest():
SQL injection vulnerability. The test is done up to 3*50 times
"""
if conf.direct:
return
if conf.uTech == "orderby":
technique = "ORDER BY clause bruteforcing"
else:

3
lib/techniques/outband/stacked.py
View file

@ -32,6 +32,9 @@ from lib.core.session import setStacked
from lib.request import inject
def stackedTest():
if conf.direct:
return
if kb.stackedTest is not None:
return kb.stackedTest