mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-08-04 14:55:40 +00:00
110 lines
4.5 KiB
Python
110 lines
4.5 KiB
Python
#!/usr/bin/env python
|
|
|
|
"""
|
|
Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
|
|
See the file 'LICENSE' for copying permission
|
|
"""
|
|
|
|
from .atlas import _FREQ_ORDER
|
|
from .atlas import _PRINTABLE_SORTED
|
|
from .atlas import _REPL
|
|
from .atlas import _unichr
|
|
from .records import Dialect
|
|
from .oracle import _OracleCore
|
|
from .discovery import _Discovery
|
|
from .extraction import _Extraction
|
|
from .enumeration import _Enumeration
|
|
|
|
|
|
class Esperanto(_OracleCore, _Discovery, _Extraction, _Enumeration):
|
|
"""DBMS-agnostic blind extractor. Behaviour lives in four mixins by concern
|
|
(oracle / discovery / extraction / enumeration); this class only holds
|
|
construction + the query counter."""
|
|
|
|
def __init__(self, oracle, verbose=False, maxlen=4096, retries=1, quorum=1,
|
|
maxbytes=None, max_queries=None):
|
|
"""oracle: callable(condition_str) -> bool.
|
|
quorum>1 turns on majority voting (2*quorum-1 samples) so a noisy or
|
|
intermittently-erroring oracle can't flip a single probe and corrupt a
|
|
result; retries re-attempts a raised call before it counts as an error.
|
|
maxlen caps text characters; maxbytes separately caps byte/hex recovery
|
|
(default 4*maxlen); max_queries is an optional hard oracle-call ceiling."""
|
|
if not callable(oracle):
|
|
raise TypeError("oracle must be callable")
|
|
self.oracle = oracle
|
|
self.verbose = verbose
|
|
self.maxlen = maxlen
|
|
self.maxbytes = maxlen * 4 if maxbytes is None else maxbytes
|
|
self.retries = retries
|
|
self.quorum = max(1, quorum)
|
|
self.max_queries = max_queries
|
|
self.dialect = Dialect()
|
|
self._queries = 0
|
|
self._errors = 0
|
|
self._hexProbed = False
|
|
self._hexOrdered = None
|
|
self._backslashEscape = None
|
|
self._codeTmpl = None
|
|
self._comparator = "gt" # ordered-compare op: "gt" / "between" / "membership"
|
|
self._inOk = True # IN(...) usable (order-free subset bisection)
|
|
self._lastTruncated = False
|
|
self._discovered = False
|
|
self._probing = False # True while laddering CANDIDATE rungs (discovery or lazy _ensure*): an
|
|
# undecidable probe there = "rung unusable" -> False; elsewhere (reading
|
|
# committed data) an undecidable probe stays undecided so it degrades loudly
|
|
self._progress = None # optional host callback(str) for live feedback
|
|
|
|
@property
|
|
def queryCount(self):
|
|
return self._queries
|
|
|
|
|
|
def hostExtract(oracle, strategy, expr, maxlen=4096):
|
|
"""Reference HOST inference loop driven ONLY by an InferenceStrategy + oracle.
|
|
|
|
This is the proof that the strategy is a sufficient hand-off: it reproduces
|
|
char-by-char extraction with zero dependency on Esperanto's own retrieval code -
|
|
exactly what sqlmap's `bisection()`/`queryOutputLength()` would do instead, but in
|
|
~30 lines. Covers the char-comparison modes (code / collation / ordinal /
|
|
equality); hex mode is reachable the same way via strategy.renderHex()."""
|
|
ask = lambda cond: bool(oracle(cond))
|
|
L = strategy.renderLength(expr)
|
|
if not ask("%s>=0" % L):
|
|
return None
|
|
if ask("%s=0" % L):
|
|
return ""
|
|
lo, hi = 1, min(8, maxlen)
|
|
while hi < maxlen and ask("%s>%d" % (L, hi)):
|
|
lo, hi = hi + 1, min(hi * 2, maxlen)
|
|
while lo < hi:
|
|
mid = (lo + hi) // 2
|
|
lo, hi = (mid + 1, hi) if ask("%s>%d" % (L, mid)) else (lo, mid)
|
|
length = lo
|
|
|
|
def read(pos):
|
|
mode = strategy.compare_mode
|
|
if mode == "code":
|
|
code = strategy.renderCode(expr, pos)
|
|
top = 0x10FFFF
|
|
for cap in (127, 255, 0xFFFF, 0x10FFFF):
|
|
if not ask("%s>%d" % (code, cap)):
|
|
top = cap
|
|
break
|
|
a, b = 0, top
|
|
while a < b:
|
|
m = (a + b) // 2
|
|
a, b = (m + 1, b) if ask("%s>%d" % (code, m)) else (a, m)
|
|
return _unichr(a)
|
|
if mode in ("collation", "ordinal"):
|
|
cs = _PRINTABLE_SORTED
|
|
a, b = 0, len(cs) - 1
|
|
while a < b:
|
|
m = (a + b) // 2
|
|
a, b = (m + 1, b) if ask(strategy.renderCharCmp(expr, pos, cs[m], ">")) else (a, m)
|
|
return cs[a]
|
|
for ch in _FREQ_ORDER: # equality scan
|
|
if ask(strategy.renderCharCmp(expr, pos, ch, "=")):
|
|
return ch
|
|
return _REPL
|
|
|
|
return "".join(read(i) for i in range(1, length + 1))
|