(columnFile, regex=None)
| 186 | return kb.data.cachedTables |
| 187 | |
| 188 | def columnExists(columnFile, regex=None): |
| 189 | if kb.choices.columnExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: |
| 190 | warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED]) |
| 191 | warnMsg += "for common column existence check" |
| 192 | logger.warning(warnMsg) |
| 193 | |
| 194 | message = "are you sure you want to continue? [y/N] " |
| 195 | kb.choices.columnExists = readInput(message, default='N', boolean=True) |
| 196 | |
| 197 | if not kb.choices.columnExists: |
| 198 | return None |
| 199 | |
| 200 | if not conf.tbl: |
| 201 | errMsg = "missing table parameter" |
| 202 | raise SqlmapMissingMandatoryOptionException(errMsg) |
| 203 | |
| 204 | if conf.db and Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: |
| 205 | conf.db = conf.db.upper() |
| 206 | |
| 207 | result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (randomStr(), randomStr()))) |
| 208 | |
| 209 | if result: |
| 210 | errMsg = "can't use column existence check because of detected invalid results " |
| 211 | errMsg += "(most likely caused by inability of the used injection " |
| 212 | errMsg += "to distinguish erroneous results)" |
| 213 | raise SqlmapDataException(errMsg) |
| 214 | |
| 215 | message = "which common columns (wordlist) file do you want to use?\n" |
| 216 | message += "[1] default '%s' (press Enter)\n" % columnFile |
| 217 | message += "[2] custom" |
| 218 | choice = readInput(message, default='1') |
| 219 | |
| 220 | if choice == '2': |
| 221 | message = "what's the custom common columns file location?\n" |
| 222 | columnFile = readInput(message) or columnFile |
| 223 | |
| 224 | infoMsg = "checking column existence using items from '%s'" % columnFile |
| 225 | logger.info(infoMsg) |
| 226 | |
| 227 | columns = getFileItems(columnFile, unique=True) |
| 228 | columns.extend(_addPageTextWords()) |
| 229 | columns = filterListValue(columns, regex) |
| 230 | |
| 231 | for table in conf.tbl.split(','): |
| 232 | table = safeSQLIdentificatorNaming(table, True) |
| 233 | |
| 234 | if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): |
| 235 | table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table) |
| 236 | |
| 237 | kb.threadContinue = True |
| 238 | kb.bruteMode = True |
| 239 | |
| 240 | threadData = getCurrentThreadData() |
| 241 | threadData.shared.count = 0 |
| 242 | threadData.shared.limit = len(columns) |
| 243 | threadData.shared.files = [] |
| 244 | |
| 245 | def columnExistsThread(): |
no test coverage detected
searching dependent graphs…