X Tutup
Skip to content

Commit fa4c1c5

Browse files
stamparmstamparm
committed
Some more PEPing (I hope that I haven't broke anything)
1 parent 8166a4e commit fa4c1c5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+1174
-1305
lines changed

‎lib/controller/checks.py‎

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,7 @@ def checkSqlInjection(place, parameter, value):
146146
# error message, simple heuristic check or via DBMS-specific
147147
# payload), ask the user to limit the tests to the fingerprinted
148148
# DBMS
149-
if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), \
150-
SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
149+
if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
151150
msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms)
152151
msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]"
153152
kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else []
@@ -156,9 +155,7 @@ def checkSqlInjection(place, parameter, value):
156155
# message, via simple heuristic check or via DBMS-specific
157156
# payload), ask the user to extend the tests to all DBMS-specific,
158157
# regardless of --level and --risk values provided
159-
if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) \
160-
and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or \
161-
kb.heuristicDbms or injection.dbms):
158+
if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms):
162159
msg = "for the remaining tests, do you want to include all tests "
163160
msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms)
164161
msg += "level (%d)" % conf.level if conf.level < 5 else ""
@@ -242,19 +239,15 @@ def checkSqlInjection(place, parameter, value):
242239

243240
# Skip tests if title, vector or DBMS is not included by the
244241
# given test filter
245-
if conf.testFilter and not any(conf.testFilter in str(item) or \
246-
re.search(conf.testFilter, str(item), re.I) for item in \
247-
(test.title, test.vector, payloadDbms)):
242+
if conf.testFilter and not any(conf.testFilter in str(item) or re.search(conf.testFilter, str(item), re.I) for item in (test.title, test.vector, payloadDbms)):
248243
debugMsg = "skipping test '%s' because its " % title
249244
debugMsg += "name/vector/DBMS is not included by the given filter"
250245
logger.debug(debugMsg)
251246
continue
252247

253248
# Skip tests if title, vector or DBMS is included by the
254249
# given skip filter
255-
if conf.testSkip and any(conf.testSkip in str(item) or \
256-
re.search(conf.testSkip, str(item), re.I) for item in \
257-
(test.title, test.vector, payloadDbms)):
250+
if conf.testSkip and any(conf.testSkip in str(item) or re.search(conf.testSkip, str(item), re.I) for item in (test.title, test.vector, payloadDbms)):
258251
debugMsg = "skipping test '%s' because its " % title
259252
debugMsg += "name/vector/DBMS is included by the given skip filter"
260253
logger.debug(debugMsg)
@@ -588,10 +581,10 @@ def genCmpPayload():
588581
# body for the test's <grep> regular expression
589582
try:
590583
page, headers, _ = Request.queryPage(reqPayload, place, content=True, raise404=False)
591-
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) \
592-
or extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE) \
593-
or extractRegexResult(check, listToStrValue((headers[key] for key in headers.keys() if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE) \
594-
or extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)
584+
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE)
585+
output = output or extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE)
586+
output = output or extractRegexResult(check, listToStrValue((headers[key] for key in headers.keys() if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE)
587+
output = output or extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)
595588

596589
if output:
597590
result = output == "1"
@@ -873,8 +866,7 @@ def checkFalsePositives(injection):
873866

874867
retVal = True
875868

876-
if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in injection.data) or\
877-
(len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[PAYLOAD.TECHNIQUE.UNION].title):
869+
if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in injection.data) or (len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[PAYLOAD.TECHNIQUE.UNION].title):
878870
pushValue(kb.injection)
879871

880872
infoMsg = "checking if the injection point on %s " % injection.place
@@ -971,7 +963,7 @@ def checkFilteredChars(injection):
971963

972964
# inference techniques depend on character '>'
973965
if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
974-
if not checkBooleanExpression("%d>%d" % (randInt+1, randInt)):
966+
if not checkBooleanExpression("%d>%d" % (randInt + 1, randInt)):
975967
warnMsg = "it appears that the character '>' is "
976968
warnMsg += "filtered by the back-end server. You are strongly "
977969
warnMsg += "advised to rerun with the '--tamper=between'"

‎lib/controller/controller.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -406,8 +406,7 @@ def start():
406406
if conf.nullConnection:
407407
checkNullConnection()
408408

409-
if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) \
410-
and (kb.injection.place is None or kb.injection.parameter is None):
409+
if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) and (kb.injection.place is None or kb.injection.parameter is None):
411410

412411
if not any((conf.string, conf.notString, conf.regexp)) and PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech:
413412
# NOTE: this is not needed anymore, leaving only to display

‎lib/controller/handler.py‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -56,19 +56,19 @@ def setHandler():
5656
"""
5757

5858
items = [
59-
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
60-
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
61-
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
62-
(DBMS.MSSQL, MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn),
63-
(DBMS.SQLITE, SQLITE_ALIASES, SQLiteMap, SQLiteConn),
64-
(DBMS.ACCESS, ACCESS_ALIASES, AccessMap, AccessConn),
65-
(DBMS.FIREBIRD, FIREBIRD_ALIASES, FirebirdMap, FirebirdConn),
66-
(DBMS.MAXDB, MAXDB_ALIASES, MaxDBMap, MaxDBConn),
67-
(DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
68-
(DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
69-
(DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
70-
(DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
71-
]
59+
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
60+
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
61+
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
62+
(DBMS.MSSQL, MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn),
63+
(DBMS.SQLITE, SQLITE_ALIASES, SQLiteMap, SQLiteConn),
64+
(DBMS.ACCESS, ACCESS_ALIASES, AccessMap, AccessConn),
65+
(DBMS.FIREBIRD, FIREBIRD_ALIASES, FirebirdMap, FirebirdConn),
66+
(DBMS.MAXDB, MAXDB_ALIASES, MaxDBMap, MaxDBConn),
67+
(DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn),
68+
(DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn),
69+
(DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn),
70+
(DBMS.INFORMIX, INFORMIX_ALIASES, InformixMap, InformixConn),
71+
]
7272

7373
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else None for _ in items)
7474
if _:

‎lib/core/agent.py‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -294,17 +294,21 @@ def cleanupPayload(self, payload, origValue=None):
294294
if payload is None:
295295
return
296296

297-
_ = (
298-
("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\
299-
("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\
300-
("[HASH_REPLACE]", kb.chars.hash_), ("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
301-
)
302-
payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload)
303-
304-
for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)):
297+
replacements = (
298+
("[DELIMITER_START]", kb.chars.start),
299+
("[DELIMITER_STOP]", kb.chars.stop),
300+
("[AT_REPLACE]", kb.chars.at),
301+
("[SPACE_REPLACE]", kb.chars.space),
302+
("[DOLLAR_REPLACE]", kb.chars.dollar),
303+
("[HASH_REPLACE]", kb.chars.hash_),
304+
("[GENERIC_SQL_COMMENT]", GENERIC_SQL_COMMENT)
305+
)
306+
payload = reduce(lambda x, y: x.replace(y[0], y[1]), replacements, payload)
307+
308+
for _ in set(re.findall(r"(?i)\[RANDNUM(?:\d+)?\]", payload)):
305309
payload = payload.replace(_, str(randomInt()))
306310

307-
for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)):
311+
for _ in set(re.findall(r"(?i)\[RANDSTR(?:\d+)?\]", payload)):
308312
payload = payload.replace(_, randomStr())
309313

310314
if origValue is not None and "[ORIGVALUE]" in payload:
@@ -928,7 +932,7 @@ def limitQuery(self, num, query, field=None, uniqueField=None):
928932
limitedQuery += " %s" % limitStr
929933

930934
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
931-
if not " ORDER BY " in limitedQuery:
935+
if " ORDER BY " not in limitedQuery:
932936
limitStr = limitStr.replace(") WHERE LIMIT", " ORDER BY 1 ASC) WHERE LIMIT")
933937
elif " ORDER BY " in limitedQuery and "SELECT " in limitedQuery:
934938
limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]

‎lib/core/bigarray.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
"""
77

88
try:
9-
import cPickle as pickle
9+
import cPickle as pickle
1010
except:
11-
import pickle
11+
import pickle
1212

1313
import bz2
1414
import itertools

‎lib/core/convert.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ def loads(str):
9494

9595
try:
9696
retVal = loads(base64decode(value))
97-
except TypeError:
97+
except TypeError:
9898
retVal = loads(base64decode(bytes(value)))
9999

100100
return retVal

‎lib/core/defaults.py‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,20 @@
88
from lib.core.datatype import AttribDict
99

1010
_defaults = {
11-
"csvDel": ',',
12-
"timeSec": 5,
13-
"googlePage": 1,
14-
"verbose": 1,
15-
"delay": 0,
16-
"timeout": 30,
17-
"retries": 3,
18-
"saFreq": 0,
19-
"threads": 1,
20-
"level": 1,
21-
"risk": 1,
22-
"dumpFormat": "CSV",
23-
"tech": "BEUSTQ",
24-
"torType": "SOCKS5",
11+
"csvDel": ',',
12+
"timeSec": 5,
13+
"googlePage": 1,
14+
"verbose": 1,
15+
"delay": 0,
16+
"timeout": 30,
17+
"retries": 3,
18+
"saFreq": 0,
19+
"threads": 1,
20+
"level": 1,
21+
"risk": 1,
22+
"dumpFormat": "CSV",
23+
"tech": "BEUSTQ",
24+
"torType": "SOCKS5",
2525
}
2626

2727
defaults = AttribDict(_defaults)

‎lib/core/dicts.py‎

Lines changed: 44 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -208,54 +208,60 @@
208208
}
209209

210210
SQL_STATEMENTS = {
211-
"SQL SELECT statement": (
212-
"select ",
213-
"show ",
214-
" top ",
215-
" distinct ",
216-
" from ",
217-
" from dual",
218-
" where ",
219-
" group by ",
220-
" order by ",
221-
" having ",
222-
" limit ",
223-
" offset ",
224-
" union all ",
225-
" rownum as ",
226-
"(case ", ),
211+
"SQL SELECT statement": (
212+
"select ",
213+
"show ",
214+
" top ",
215+
" distinct ",
216+
" from ",
217+
" from dual",
218+
" where ",
219+
" group by ",
220+
" order by ",
221+
" having ",
222+
" limit ",
223+
" offset ",
224+
" union all ",
225+
" rownum as ",
226+
"(case ",
227+
),
227228

228-
"SQL data definition": (
229+
"SQL data definition": (
229230
"create ",
230231
"declare ",
231232
"drop ",
232233
"truncate ",
233-
"alter ", ),
234+
"alter ",
235+
),
234236

235237
"SQL data manipulation": (
236-
"bulk ",
237-
"insert ",
238-
"update ",
239-
"delete ",
240-
"merge ",
241-
"load ", ),
238+
"bulk ",
239+
"insert ",
240+
"update ",
241+
"delete ",
242+
"merge ",
243+
"load ",
244+
),
242245

243-
"SQL data control": (
244-
"grant ",
245-
"revoke ", ),
246+
"SQL data control": (
247+
"grant ",
248+
"revoke ",
249+
),
246250

247-
"SQL data execution": (
248-
"exec ",
249-
"execute ",
250-
"values ",
251-
"call ", ),
251+
"SQL data execution": (
252+
"exec ",
253+
"execute ",
254+
"values ",
255+
"call ",
256+
),
252257

253-
"SQL transaction": (
254-
"start transaction ",
255-
"begin work ",
256-
"begin transaction ",
257-
"commit ",
258-
"rollback ", ),
258+
"SQL transaction": (
259+
"start transaction ",
260+
"begin work ",
261+
"begin transaction ",
262+
"commit ",
263+
"rollback ",
264+
),
259265
}
260266

261267
POST_HINT_CONTENT_TYPES = {

‎lib/core/enums.py‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -242,40 +242,40 @@ class REDIRECTION:
242242

243243
class PAYLOAD:
244244
SQLINJECTION = {
245-
1: "boolean-based blind",
246-
2: "error-based",
247-
3: "inline query",
248-
4: "stacked queries",
249-
5: "AND/OR time-based blind",
250-
6: "UNION query",
251-
}
245+
1: "boolean-based blind",
246+
2: "error-based",
247+
3: "inline query",
248+
4: "stacked queries",
249+
5: "AND/OR time-based blind",
250+
6: "UNION query",
251+
}
252252

253253
PARAMETER = {
254-
1: "Unescaped numeric",
255-
2: "Single quoted string",
256-
3: "LIKE single quoted string",
257-
4: "Double quoted string",
258-
5: "LIKE double quoted string",
259-
}
254+
1: "Unescaped numeric",
255+
2: "Single quoted string",
256+
3: "LIKE single quoted string",
257+
4: "Double quoted string",
258+
5: "LIKE double quoted string",
259+
}
260260

261261
RISK = {
262-
0: "No risk",
263-
1: "Low risk",
264-
2: "Medium risk",
265-
3: "High risk",
266-
}
262+
0: "No risk",
263+
1: "Low risk",
264+
2: "Medium risk",
265+
3: "High risk",
266+
}
267267

268268
CLAUSE = {
269-
0: "Always",
270-
1: "WHERE",
271-
2: "GROUP BY",
272-
3: "ORDER BY",
273-
4: "LIMIT",
274-
5: "OFFSET",
275-
6: "TOP",
276-
7: "Table name",
277-
8: "Column name",
278-
}
269+
0: "Always",
270+
1: "WHERE",
271+
2: "GROUP BY",
272+
3: "ORDER BY",
273+
4: "LIMIT",
274+
5: "OFFSET",
275+
6: "TOP",
276+
7: "Table name",
277+
8: "Column name",
278+
}
279279

280280
class METHOD:
281281
COMPARISON = "comparison"

0 commit comments

Comments
 (0)
X Tutup