(expression, unpack=True, limited=False)
| 64 | from thirdparty.odict import OrderedDict |
| 65 | |
| 66 | def _oneShotUnionUse(expression, unpack=True, limited=False): |
| 67 | retVal = hashDBRetrieve("%s%s" % (conf.hexConvert or False, expression), checkConf=True) # as UNION data is stored raw unconverted |
| 68 | |
| 69 | threadData = getCurrentThreadData() |
| 70 | threadData.resumed = retVal is not None |
| 71 | |
| 72 | if retVal is None: |
| 73 | vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector |
| 74 | |
| 75 | if not kb.jsonAggMode: |
| 76 | injExpression = unescaper.escape(agent.concatQuery(expression, unpack)) |
| 77 | kb.unionDuplicates = vector[7] |
| 78 | kb.forcePartialUnion = vector[8] |
| 79 | |
| 80 | # Note: introduced columns in 1.4.2.42#dev |
| 81 | try: |
| 82 | kb.tableFrom = vector[9] |
| 83 | kb.unionTemplate = vector[10] |
| 84 | except IndexError: |
| 85 | pass |
| 86 | |
| 87 | query = agent.forgeUnionQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, limited) |
| 88 | where = PAYLOAD.WHERE.NEGATIVE if conf.limitStart or conf.limitStop else vector[6] |
| 89 | else: |
| 90 | injExpression = unescaper.escape(expression) |
| 91 | where = vector[6] |
| 92 | query = agent.forgeUnionQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, False) |
| 93 | |
| 94 | payload = agent.payload(newValue=query, where=where) |
| 95 | |
| 96 | # Perform the request |
| 97 | page, headers, _ = Request.queryPage(payload, content=True, raise404=False) |
| 98 | |
| 99 | if page and kb.chars.start.upper() in page and kb.chars.start not in page: |
| 100 | singleTimeWarnMessage("results seems to be upper-cased by force. sqlmap will automatically lower-case them") |
| 101 | |
| 102 | page = page.lower() |
| 103 | |
| 104 | incrementCounter(PAYLOAD.TECHNIQUE.UNION) |
| 105 | |
| 106 | if kb.jsonAggMode: |
| 107 | for _page in (page or "", (page or "").replace('\\"', '"')): |
| 108 | if Backend.isDbms(DBMS.MSSQL): |
| 109 | output = extractRegexResult(r"%s(?P<result>.*)%s" % (kb.chars.start, kb.chars.stop), removeReflectiveValues(_page, payload)) |
| 110 | |
| 111 | if output: |
| 112 | try: |
| 113 | retVal = None |
| 114 | output_decoded = htmlUnescape(output) |
| 115 | json_data = json.loads(output_decoded, object_pairs_hook=OrderedDict) |
| 116 | |
| 117 | if not isinstance(json_data, list): |
| 118 | json_data = [json_data] |
| 119 | |
| 120 | if json_data and isinstance(json_data[0], dict): |
| 121 | fields = list(json_data[0].keys()) |
| 122 | |
| 123 | if fields: |
no test coverage detected
searching dependent graphs…