(expression, fromUser=False, batch=False, unpack=True, charsetType=None, firstChar=None, lastChar=None, dump=False)
return ", ".join(output for output in outputs) if not isNoneValue(outputs) else None
Retrieve the output of a SQL query characted by character taking
    advantage of an blind SQL injection vulnerability on the affected
    parameter through a bisection algorithm.
Retrieve the output of a SQL query characted by character taking
    advantage of an blind SQL injection vulnerability on the affected
    parameter through a bisection algorithm.
Retrieve the output of a SQL query characted by character taking advantage of an blind SQL injection vulnerability on the affected parameter through a bisection algorithm .
def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, charsetType=None, firstChar=None, lastChar=None, dump=False):
    """
    Retrieve the output of a SQL query characted by character taking
    advantage of an blind SQL injection vulnerability on the affected
    parameter through a bisection algorithm.
    """

    initTechnique(kb.technique)

    query = agent.prefixQuery(kb.injection.data[kb.technique].vector)
    query = agent.suffixQuery(query)
    payload = agent.payload(newValue=query)
    count = None
    startLimit = 0
    stopLimit = None
    outputs = BigArray()

    if not unpack:
        return _goInference(payload, expression, charsetType, firstChar, lastChar, dump)

    _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression)

    rdbRegExp = re.search("RDB\$GET_CONTEXT\([^)]+\)", expression, re.I)
    if rdbRegExp and Backend.isDbms(DBMS.FIREBIRD):
        expressionFieldsList = [expressionFields]

    if len(expressionFieldsList) > 1:
        infoMsg = "the SQL query provided has more than one field. "
        infoMsg += "sqlmap will now unpack it into distinct queries "
        infoMsg += "to be able to retrieve the output even if we "
        infoMsg += "are going blind"
        logger.info(infoMsg)

    # If we have been here from SQL query/shell we have to check if
    # the SQL query might return multiple entries and in such case
    # forge the SQL limiting the query output one entry at a time
    # NOTE: we assume that only queries that get data from a table
    # can return multiple entries
    if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \
      not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \
      expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \
      and not re.search(SQL_SCALAR_REGEX, expression, re.I):
        expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression)

        if limitCond:
            test = True

            if not stopLimit or stopLimit <= 1:
                if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]):
                    test = False

            if test:
                # Count the number of SQL query entries output
                countFirstField = queries[Backend.getIdentifiedDbms()].count.query % expressionFieldsList[0]
                countedExpression = expression.replace(expressionFields, countFirstField, 1)

                if " ORDER BY " in countedExpression.upper():
                    _ = countedExpression.upper().rindex(" ORDER BY ")
                    countedExpression = countedExpression[:_]

                if not stopLimit:
                    count = _goInference(payload, countedExpression, charsetType=CHARSET_TYPE.DIGITS, firstChar=firstChar, lastChar=lastChar)

                    if isNumPosStrValue(count):
                        count = int(count)

                        if batch or count == 1:
                            stopLimit = count
                        else:
                            message = "the SQL query provided can return "
                            message += "%d entries. How many " % count
                            message += "entries do you want to retrieve?\n"
                            message += "[a] All (default)\n[#] Specific number\n"
                            message += "[q] Quit"
                            test = readInput(message, default="a")

                            if not test or test[0] in ("a", "A"):
                                stopLimit = count

                            elif test[0] in ("q", "Q"):
                                raise SqlmapUserQuitException

                            elif test.isdigit() and int(test) > 0 and int(test) <= count:
                                stopLimit = int(test)

                                infoMsg = "sqlmap is now going to retrieve the "
                                infoMsg += "first %d query output entries" % stopLimit
                                logger.info(infoMsg)

                            elif test[0] in ("#", "s", "S"):
                                message = "how many? "
                                stopLimit = readInput(message, default="10")

                                if not stopLimit.isdigit():
                                    errMsg = "invalid choice"
                                    logger.error(errMsg)

                                    return None

                                else:
                                    stopLimit = int(stopLimit)

                            else:
                                errMsg = "invalid choice"
                                logger.error(errMsg)

                                return None

                    elif count and not count.isdigit():
                        warnMsg = "it was not possible to count the number "
                        warnMsg += "of entries for the SQL query provided. "
                        warnMsg += "sqlmap will assume that it returns only "
                        warnMsg += "one entry"
                        logger.warn(warnMsg)

                        stopLimit = 1

                    elif (not count or int(count) == 0):
                        if not count:
                            warnMsg = "the SQL query provided does not "
                            warnMsg += "return any output"
                            logger.warn(warnMsg)

                        return None

                elif (not stopLimit or stopLimit == 0):
                    return None

                try:
                    try:
                        for num in xrange(startLimit, stopLimit):
                            output = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, num=num, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump)
                            outputs.append(output)
                    except OverflowError:
                        errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit)
                        errMsg += "with switch '--fresh-queries'"
                        raise SqlmapDataException(errMsg)

                except KeyboardInterrupt:
                    print
                    warnMsg = "user aborted during dumping phase"
                    logger.warn(warnMsg)

                return outputs

    elif Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().startswith("SELECT ") and " FROM " not in expression.upper():
        expression += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]

    outputs = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump)

    return ", ".join(output for output in outputs) if not isNoneValue(outputs) else None
def _goInferenceProxy ( expression , fromUser = False , batch = False , unpack = True , charsetType = None , firstChar = None , lastChar = None , dump = False ) : initTechnique ( kb . technique ) query = agent . prefixQuery ( kb . injection . data [ kb . technique ] . vector ) query = agent . suffixQuery ( query ) payload = agent . payload ( newValue = query ) count = None startLimit = 0 stopLimit = None outputs = BigArray ( ) if not unpack : return _goInference ( payload , expression , charsetType , firstChar , lastChar , dump ) _ , _ , _ , _ , _ , expressionFieldsList , expressionFields , _ = agent . getFields ( expression ) rdbRegExp = re . search ( "RDB\$GET_CONTEXT\([^)]+\)" , expression , re . I ) if rdbRegExp and Backend . isDbms ( DBMS . FIREBIRD ) : expressionFieldsList = [ expressionFields ] if len ( expressionFieldsList ) > 1 : infoMsg = "the SQL query provided has more than one field. " infoMsg += "sqlmap will now unpack it into distinct queries " infoMsg += "to be able to retrieve the output even if we " infoMsg += "are going blind" logger . info ( infoMsg ) # If we have been here from SQL query/shell we have to check if # the SQL query might return multiple entries and in such case # forge the SQL limiting the query output one entry at a time # NOTE: we assume that only queries that get data from a table # can return multiple entries if fromUser and " FROM " in expression . upper ( ) and ( ( Backend . getIdentifiedDbms ( ) not in FROM_DUMMY_TABLE ) or ( Backend . getIdentifiedDbms ( ) in FROM_DUMMY_TABLE and not expression . upper ( ) . endswith ( FROM_DUMMY_TABLE [ Backend . getIdentifiedDbms ( ) ] ) ) ) and not re . search ( SQL_SCALAR_REGEX , expression , re . I ) : expression , limitCond , topLimit , startLimit , stopLimit = agent . limitCondition ( expression ) if limitCond : test = True if not stopLimit or stopLimit <= 1 : if Backend . getIdentifiedDbms ( ) in FROM_DUMMY_TABLE and expression . upper ( ) . endswith ( FROM_DUMMY_TABLE [ Backend . getIdentifiedDbms ( ) ] ) : test = False if test : # Count the number of SQL query entries output countFirstField = queries [ Backend . getIdentifiedDbms ( ) ] . count . query % expressionFieldsList [ 0 ] countedExpression = expression . replace ( expressionFields , countFirstField , 1 ) if " ORDER BY " in countedExpression . upper ( ) : _ = countedExpression . upper ( ) . rindex ( " ORDER BY " ) countedExpression = countedExpression [ : _ ] if not stopLimit : count = _goInference ( payload , countedExpression , charsetType = CHARSET_TYPE . DIGITS , firstChar = firstChar , lastChar = lastChar ) if isNumPosStrValue ( count ) : count = int ( count ) if batch or count == 1 : stopLimit = count else : message = "the SQL query provided can return " message += "%d entries. How many " % count message += "entries do you want to retrieve?\n" message += "[a] All (default)\n[#] Specific number\n" message += "[q] Quit" test = readInput ( message , default = "a" ) if not test or test [ 0 ] in ( "a" , "A" ) : stopLimit = count elif test [ 0 ] in ( "q" , "Q" ) : raise SqlmapUserQuitException elif test . isdigit ( ) and int ( test ) > 0 and int ( test ) <= count : stopLimit = int ( test ) infoMsg = "sqlmap is now going to retrieve the " infoMsg += "first %d query output entries" % stopLimit logger . info ( infoMsg ) elif test [ 0 ] in ( "#" , "s" , "S" ) : message = "how many? " stopLimit = readInput ( message , default = "10" ) if not stopLimit . isdigit ( ) : errMsg = "invalid choice" logger . error ( errMsg ) return None else : stopLimit = int ( stopLimit ) else : errMsg = "invalid choice" logger . error ( errMsg ) return None elif count and not count . isdigit ( ) : warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" logger . warn ( warnMsg ) stopLimit = 1 elif ( not count or int ( count ) == 0 ) : if not count : warnMsg = "the SQL query provided does not " warnMsg += "return any output" logger . warn ( warnMsg ) return None elif ( not stopLimit or stopLimit == 0 ) : return None try : try : for num in xrange ( startLimit , stopLimit ) : output = _goInferenceFields ( expression , expressionFields , expressionFieldsList , payload , num = num , charsetType = charsetType , firstChar = firstChar , lastChar = lastChar , dump = dump ) outputs . append ( output ) except OverflowError : errMsg = "boundary limits (%d,%d) are too large. Please rerun " % ( startLimit , stopLimit ) errMsg += "with switch '--fresh-queries'" raise SqlmapDataException ( errMsg ) except KeyboardInterrupt : print warnMsg = "user aborted during dumping phase" logger . warn ( warnMsg ) return outputs elif Backend . getIdentifiedDbms ( ) in FROM_DUMMY_TABLE and expression . upper ( ) . startswith ( "SELECT " ) and " FROM " not in expression . upper ( ) : expression += FROM_DUMMY_TABLE [ Backend . getIdentifiedDbms ( ) ] outputs = _goInferenceFields ( expression , expressionFields , expressionFieldsList , payload , charsetType = charsetType , firstChar = firstChar , lastChar = lastChar , dump = dump ) return ", " . join ( output for output in outputs ) if not isNoneValue ( outputs ) else None