| 40 | pass |
| 41 | |
| 42 | def sqlQuery(self, query): |
| 43 | output = None |
| 44 | sqlType = None |
| 45 | query = query.rstrip(';') |
| 46 | |
| 47 | |
| 48 | try: |
| 49 | for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): |
| 50 | for sqlStatement in sqlStatements: |
| 51 | if query.lower().startswith(sqlStatement): |
| 52 | sqlType = sqlTitle |
| 53 | break |
| 54 | |
| 55 | if not re.search(r"\b(OPENROWSET|INTO)\b", query, re.I) and (not sqlType or "SELECT" in sqlType): |
| 56 | infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query) |
| 57 | logger.info(infoMsg) |
| 58 | |
| 59 | if Backend.isDbms(DBMS.MSSQL): |
| 60 | match = re.search(r"(\bFROM\s+)([^\s]+)", query, re.I) |
| 61 | if match and match.group(2).count('.') == 1: |
| 62 | query = query.replace(match.group(0), "%s%s" % (match.group(1), match.group(2).replace('.', ".dbo."))) |
| 63 | |
| 64 | query = re.sub(r"(?i)\w+%s\.?" % METADB_SUFFIX, "", query) |
| 65 | |
| 66 | output = inject.getValue(query, fromUser=True) |
| 67 | |
| 68 | if sqlType and "SELECT" in sqlType and isListLike(output): |
| 69 | for i in xrange(len(output)): |
| 70 | if isListLike(output[i]): |
| 71 | output[i] = joinValue(output[i]) |
| 72 | |
| 73 | return output |
| 74 | elif not isStackingAvailable() and not conf.direct: |
| 75 | warnMsg = "execution of non-query SQL statements is only " |
| 76 | warnMsg += "available when stacked queries are supported" |
| 77 | logger.warning(warnMsg) |
| 78 | |
| 79 | return None |
| 80 | else: |
| 81 | if sqlType: |
| 82 | infoMsg = "executing %s statement: '%s'" % (sqlType if sqlType is not None else "SQL", query) |
| 83 | else: |
| 84 | infoMsg = "executing unknown SQL command: '%s'" % query |
| 85 | logger.info(infoMsg) |
| 86 | |
| 87 | inject.goStacked(query) |
| 88 | |
| 89 | output = NULL |
| 90 | |
| 91 | except SqlmapNoneDataException as ex: |
| 92 | logger.warning(ex) |
| 93 | |
| 94 | return output |
| 95 | |
| 96 | def sqlShell(self): |
| 97 | infoMsg = "calling %s shell. To quit type " % Backend.getIdentifiedDbms() |