lib/parse/html.py · javaalpha/sqlmap

代码拉取完成,页面将自动刷新

扫描微信二维码支付

取消

支付完成

richgiteeai

Watch

不关注关注所有动态仅关注版本发行动态关注但不提醒动态

1 Star 0 Fork 1

javaalpha/sqlmap

forked from yeqingchen1/sqlmap

代码 Issues 0 Pull Requests 0 Wiki 统计流水线

服务

加入 Gitee

与超过 1400万开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)

免费加入

已有帐号? 立即登录

文件

master

分支 (2)

标签 (53)

管理

master

gh-pages

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2

克隆/下载

HTTPS SSH SVN SVN+SSH 下载ZIP

提示

下载代码请复制以下命令到终端执行

为确保你提交的代码身份被 Gitee 正确识别,请执行以下命令完成配置

git config --global user.name userName 
git config --global user.email userEmail

初次使用 SSH 协议进行代码克隆、推送等操作时,需按下述提示完成 SSH 配置

1 生成 RSA 密钥

2 获取 RSA 公钥内容,并配置到 SSH公钥中

在 Gitee 上使用 SVN,请访问使用指南

使用 HTTPS 协议时,命令行会出现如下账号密码验证步骤。基于安全考虑,Gitee 建议配置并使用私人令牌替代登录密码进行克隆、推送等操作

Username for 'https://gitee.com': userName

Password for 'https://userName@gitee.com': # 私人令牌

分支 2

标签 53

sqlmap

lib

parse

html.py

html.py 2.39 KB

#!/usr/bin/env python

"""
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import re

from xml.sax.handler import ContentHandler

from lib.core.common import urldecode
from lib.core.common import parseXmlFile
from lib.core.data import kb
from lib.core.data import paths
from lib.core.threads import getCurrentThreadData

class HTMLHandler(ContentHandler):
 """
 This class defines methods to parse the input HTML page to
 fingerprint the back-end database management system
 """

def __init__(self, page):
 ContentHandler.__init__(self)

self._dbms = None
 self._page = (page or "")
 self._lower_page = self._page.lower()
 self._urldecoded_page = urldecode(self._page)

self.dbms = None

def _markAsErrorPage(self):
 threadData = getCurrentThreadData()
 threadData.lastErrorPage = (threadData.lastRequestUID, self._page)

def startElement(self, name, attrs):
 if self.dbms:
 return

if name == "dbms":
 self._dbms = attrs.get("value")

elif name == "error":
 regexp = attrs.get("regexp")
 if regexp not in kb.cache.regex:
 keywords = re.findall(r"\w+", re.sub(r"\\.", " ", regexp))
 keywords = sorted(keywords, key=len)
 kb.cache.regex[regexp] = keywords[-1].lower()

if kb.cache.regex[regexp] in self._lower_page and re.search(regexp, self._urldecoded_page, re.I):
 self.dbms = self._dbms
 self._markAsErrorPage()

def htmlParser(page):
 """
 This function calls a class that parses the input HTML page to
 fingerprint the back-end database management system
 """

xmlfile = paths.ERRORS_XML
 handler = HTMLHandler(page)
 key = hash(page)

if key in kb.cache.parsedDbms:
 retVal = kb.cache.parsedDbms[key]
 if retVal:
 handler._markAsErrorPage()
 return retVal

parseXmlFile(xmlfile, handler)

if handler.dbms and handler.dbms not in kb.htmlFp:
 kb.lastParserStatus = handler.dbms
 kb.htmlFp.append(handler.dbms)
 else:
 kb.lastParserStatus = None

kb.cache.parsedDbms[key] = handler.dbms

# generic SQL warning/error messages
 if re.search(r"SQL (warning|error|syntax)", page, re.I):
 handler._markAsErrorPage()

return handler.dbms

一键复制编辑原始数据按行查看历史

Miroslav Stampar 提交于 2019年05月08日 18:47 +08:00 . Last preparations for DREI

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86

#!/usr/bin/env python

"""
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import re

from xml.sax.handler import ContentHandler

from lib.core.common import urldecode
from lib.core.common import parseXmlFile
from lib.core.data import kb
from lib.core.data import paths
from lib.core.threads import getCurrentThreadData

class HTMLHandler(ContentHandler):
 """
 This class defines methods to parse the input HTML page to
 fingerprint the back-end database management system
 """

 def __init__(self, page):
 ContentHandler.__init__(self)

 self._dbms = None
 self._page = (page or "")
 self._lower_page = self._page.lower()
 self._urldecoded_page = urldecode(self._page)

 self.dbms = None

 def _markAsErrorPage(self):
 threadData = getCurrentThreadData()
 threadData.lastErrorPage = (threadData.lastRequestUID, self._page)

 def startElement(self, name, attrs):
 if self.dbms:
 return

 if name == "dbms":
 self._dbms = attrs.get("value")

 elif name == "error":
 regexp = attrs.get("regexp")
 if regexp not in kb.cache.regex:
 keywords = re.findall(r"\w+", re.sub(r"\\.", " ", regexp))
 keywords = sorted(keywords, key=len)
 kb.cache.regex[regexp] = keywords[-1].lower()

 if kb.cache.regex[regexp] in self._lower_page and re.search(regexp, self._urldecoded_page, re.I):
 self.dbms = self._dbms
 self._markAsErrorPage()

def htmlParser(page):
 """
 This function calls a class that parses the input HTML page to
 fingerprint the back-end database management system
 """

 xmlfile = paths.ERRORS_XML
 handler = HTMLHandler(page)
 key = hash(page)

 if key in kb.cache.parsedDbms:
 retVal = kb.cache.parsedDbms[key]
 if retVal:
 handler._markAsErrorPage()
 return retVal

 parseXmlFile(xmlfile, handler)

 if handler.dbms and handler.dbms not in kb.htmlFp:
 kb.lastParserStatus = handler.dbms
 kb.htmlFp.append(handler.dbms)
 else:
 kb.lastParserStatus = None

 kb.cache.parsedDbms[key] = handler.dbms

 # generic SQL warning/error messages
 if re.search(r"SQL (warning|error|syntax)", page, re.I):
 handler._markAsErrorPage()

 return handler.dbms