³ò
‰ŸFc           @   sG   d  d k  Z  d  d k Z d  d k Z d  d k Z d d d „  ƒ  YZ d S(   iÿÿÿÿNt   Resumec           B   s,   e  Z d  Z d „  Z d d „ Z d „  Z RS(   sx   
    This class defines methods used to resume a blind SQL injection
    output value

    @author: Bernardo Damele
    c         C   s   | |  _  t i d ƒ |  _ d  S(   Nt	   sqlmapLog(   t   argst   loggingt	   getLoggert   logger(   t   selfR   (    (    s4   /usr/local/www/apache22/data/stuff/sql/lib/resume.pyt   __init__   s    	c         C   sK  |  i  | ƒ } | i d d ƒ i d d ƒ } | d j o t i d | t i ƒ p t | ƒ d j o d Sn |  i i p d Sn d |  i i j o d	 } d
 }	 nG d |  i i j o d	 } d }	 n$ d |  i i j o d } d }	 n |  i i	 o. t
 i i d t i d ƒ ƒ t
 i i ƒ  n | d j o | i | | | d ƒ }
 n | | }
 |  i | |
 t ƒ \ } } | p d Sn t | ƒ t | ƒ j o6 d |  i i } | d | 7} |  i i | ƒ | Sntt | ƒ t | ƒ j  oZd |  i i } | d | 7} |  i i | ƒ |  i i o: |  i i i d |  i i | | f ƒ |  i i i ƒ  n | d j o6 | i | |	 | t | ƒ d t | ƒ f d ƒ }
 n$ |	 | t | ƒ d t | ƒ f }
 |  i | |
 ƒ \ } } t | ƒ t | ƒ t | ƒ j o2 d } | d 7} | d 7} |  i i | ƒ d Sn d | | f Sn d S(   s   
        This method is the effective resume of the pending part or
        entire output of a blind SQL injection query
        t   __NEWLINE__s   
t   __TAB__s   	t   SELECTs   \A(COUNT|LTRIM)\(i   t   MySQLs
   LENGTH(%s)s   MID((%s), %d, %d)t
   PostgreSQLs   SUBSTR((%s), %d, %d)s   Microsoft SQL Servers   LTRIM(STR(LEN(%s)))s   SUBSTRING((%s), %d, %d)s+   [%s] [INFO] retrieved the length of query: s   %Xs   read from file '%s': s   %ss   resumed from file '%s': s
   %s][%s][%ss%   the total length of the query is not s'   right, sqlmap is going to retrieve the s"   query value from the beginning nows   %s%sN(   t   unescapet   replacet   ret   searcht   It   lent   NoneR   t   fingerprintt   verboset   syst   stdoutt   writet   timet   strftimet   flusht   bisectionAlgorithmt   Falset   intt
   outputFileR   t   infot	   writeFilet   urlt   warn(   R   t   origExprt   regExprt   resumedValuet   baseUrlt   methodt   origExprUnescapedt   resumedValueReplacedt
   firstDbStrt   secondDbStrt   newExprt   countt   lengtht   logMsgt
   finalValuet   warnMsg(    (    s4   /usr/local/www/apache22/data/stuff/sql/lib/resume.pyt   __effectiveResumeValue   s`    9



&6##

c         C   sø   |  i  i |  i  i | } t i d | t i ƒ } t i d | t i ƒ } t i d | t i ƒ } | p | oS | o | i ƒ  d } n | o | i ƒ  d } n |  i | | | | d ƒ Sn2 | o* | i ƒ  d } |  i | | | | ƒ Sn d S(   s„   
        This method is called by request.getValue() to resume part or
        entire output of a blind SQL injection query
        s5   \ASELECT TOP\s+[\d]+\s+([\w\-\_'"\,\;\(\)\@\ ]+) FROMs'   \ASELECT ([\w\-\_'"\,\;\(\)\@\ ]+) FROMs   \A(.+)i    R
   N(	   R   t   resumedQueriesR"   R   R   R   t   groupst   _Resume__effectiveResumeValueR   (   R   t
   expressionR'   R&   t   selectTopExprt
   selectExprt   miscExpr(    (    s4   /usr/local/www/apache22/data/stuff/sql/lib/resume.pyt   resumeValuea   s    N(   t   __name__t
   __module__t   __doc__R   R   R6   R;   (    (    (    s4   /usr/local/www/apache22/data/stuff/sql/lib/resume.pyR    
   s   	J(    (   R   R   R   R   R    (    (    (    s4   /usr/local/www/apache22/data/stuff/sql/lib/resume.pys   <module>   s   
